Information Disclosure
Monthly
A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read application data. [CVSS 3.3 LOW]
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
Redcap versions up to 14.3.13 contains a vulnerability that allows attackers to enumerate usernames due to an observable discrepancy between login attempts (CVSS 5.3).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 6.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. [CVSS 5.3 MEDIUM]
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Resource lock poisoning in ZwiiCMS prior to 13.7.00 allows authenticated low-privilege users to deny administrators access to administrative functionality by exploiting a race between lock acquisition and authorization. The application incorrectly acquires and binds a temporary resource lock to the requesting session before completing the authorization check - meaning even a request that ultimately returns 404 holds the lock until the attacker's session is cleared. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the requirement for a pre-existing authenticated session.
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
WP Messiah BoomDevs WordPress Coming Soon plugin through version 1.0.4 exposes sensitive system information to unauthorized access, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability stems from improper access controls on sensitive data endpoints, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). With an EPSS score of 0.01% (2nd percentile), exploitation likelihood is minimal despite the information disclosure nature of the defect.
Direct Payments WP WordPress plugin through version 1.3.2 exposes embedded sensitive system information to unauthorized parties via CWE-497 exposure mechanisms, allowing attackers to retrieve confidential data without requiring authentication. The vulnerability affects all versions up to and including 1.3.2, with an EPSS score of 0.01% indicating minimal observed exploitation probability despite the information disclosure nature of the flaw.
Local privilege escalation and unauthorized raw-disk access in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22) arise because the SYSTEM-level regService applies a security descriptor with no explicit DACL to a device object, letting a low-privileged local user open the object and issue raw disk operations that can disrupt the system, expose sensitive data, or elevate privileges. Exploitation is local-only (AV:L, PR:L, UI:N, 7.8) and publicly available exploit code exists (a PoC gist is linked from NVD), though the product's narrow maritime-navigation deployment base limits broad exposure and no active exploitation is confirmed (no CISA KEV listing).
Post Video Players WordPress plugin through version 1.163 exposes sensitive embedded data to unauthorized users via improper information disclosure mechanisms. The vulnerability allows attackers to retrieve sensitive system information that should be restricted from public access, affecting the plugin's core video playlist and gallery functionality. With an extremely low EPSS score of 0.04%, active exploitation appears minimal despite the information disclosure risk.
Information disclosure in Razvan Stanga's Varnish/Nginx Proxy Caching WordPress plugin through version 1.8.3 allows sensitive data embedded in cached responses to be exposed to unauthorized users. The vulnerability stems from improper handling of sensitive information during proxy caching operations, enabling attackers to retrieve cached data containing credentials, tokens, or other confidential material. No authentication is required to exploit this issue, and EPSS analysis indicates a 4.43% probability of exploitation (89th percentile), suggesting moderate real-world risk despite the lack of known public exploits.
Download Media Library WordPress plugin through version 0.2.1 exposes sensitive system information to unauthorized users via embedded data retrieval. The vulnerability allows unauthenticated attackers to access restricted system details without proper access controls, though real-world exploitation probability remains low (EPSS 0.04%). No public exploit code or active exploitation has been confirmed.
The Efí Bank Gerencianet Oficial WordPress plugin through version 3.1.3 exposes sensitive data by embedding it into sent HTTP requests or responses, allowing attackers to retrieve payment-related information without authentication. This information disclosure vulnerability (CWE-201) affects all installations of the affected plugin versions and is classified as low-risk based on EPSS score (0.04%, 12th percentile), with no public exploit code or active exploitation confirmed.
The Terms descriptions WordPress plugin versions 3.4.10 and earlier expose sensitive data through embedded information in sent data, allowing unauthenticated attackers to retrieve embedded sensitive information. This information disclosure vulnerability (CWE-201) affects all installations of the plugin up to version 3.4.10. No public exploit code has been identified, and the EPSS score of 0.04% indicates minimal real-world exploitation probability, though the vulnerability remains a concern for sites storing sensitive term metadata.
ColorWay WordPress theme through version 4.2.3 embeds sensitive information in sent data, allowing unauthenticated attackers to retrieve embedded data without authentication. The vulnerability has an exceptionally low exploitation probability (EPSS 0.03%, 9th percentile) despite being information disclosure in nature, suggesting the sensitive data exposure requires specific conditions or limited practical impact. No active exploitation or public exploit code is documented at time of analysis.
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
Credential leakage in the Ruby URI gem's `+` operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in `URI#join` and `URI#merge` but left `URI#+` unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using `+` are concretely at risk of sending those credentials to attacker-controlled hosts.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Roxnor PopupKit popup-builder-block plugin through version 2.2.4 exposes sensitive system information to authenticated users via an information disclosure vulnerability. An authenticated attacker can retrieve embedded sensitive data that should not be accessible, potentially gaining insight into system configuration or other restricted information. The CVSS 4.3 score reflects low real-world impact (confidentiality only, low privileges required), and EPSS exploitation probability is minimal at 0.04%, indicating this is a lower-priority vulnerability despite affecting a WordPress plugin.
Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.
Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).
Sensitive data exposure in Contact Form 7 Mailchimp Extension plugin for WordPress (versions ≤0.9.68) allows unauthenticated remote attackers to retrieve embedded sensitive information through network-accessible endpoints. The vulnerability enables unauthorized access to confidential data with low attack complexity and no user interaction required. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis.
Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
Race condition in the Purchase Request Handler of PHPEMS up to version 11.0 allows remote attackers to corrupt purchase data integrity under precise timing conditions. Exploitation requires high complexity and many attempts, with limited impact on information disclosure. A public proof-of-concept is available, but no active exploitation has been confirmed.
Race condition in PHPEMS Coupon Handler component up to version 11.0 allows authenticated remote attackers to manipulate coupon processing logic, potentially resulting in integrity compromise. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation despite publicly available proof-of-concept code. EPSS score of 0.04% indicates low real-world exploitation probability despite public POC availability.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
WP Project Manager plugin through version 3.0.1 exposes sensitive information in sent data due to improper information handling, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability affects all installations of the weDevs plugin and has been identified with an extremely low EPSS score (0.05%, 14th percentile), suggesting minimal practical exploitation likelihood despite the information disclosure classification.
Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.
Sensitive information disclosure in Gmission Web Fax 3.0 (before 3.0.1) enables a locally authenticated low-privileged user to access protected fax data without proper authorization. The root cause is missing authorization checks (CWE-200) that can be abused by an authenticated local actor to read confidential information beyond their intended access scope. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Information disclosure in PbootCMS up to 3.2.12 allows remote attackers to directly request and download the SQLite database file /data/pbootcms.db, potentially exposing sensitive data. A public exploit is available, but exploitation is difficult and EPSS (0.06%) indicates very low probability of widespread exploitation. No active exploitation has been confirmed.
Information disclosure in Halo up to 2.21.10 can be triggered by a remote attacker with low privileges via high-complexity manipulation of the /actuator configuration handler, potentially leaking limited configuration data. Public exploit code exists, but active exploitation has not been confirmed and EPSS indicates a negligible exploitation probability (0.03%). The low CVSS 4.0 score and high attack complexity further reduce the real-world
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Improper authorization in JeecgBoot's position management API allows authenticated low-privilege users to enumerate personnel assigned to arbitrary organizational positions by manipulating the positionId parameter at the /sys/position/getPositionUserList endpoint. All versions up to and including 3.9.0 are confirmed affected per NVD CPE data. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and EPSS of 0.04% (11th percentile) indicate this is a limited-impact, difficult-to-exploit information disclosure - no active exploitation has been confirmed.
Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active
Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.
Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.
Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
OpenCart versions up to 4.1.0.3 are vulnerable to a race condition in the Single-Use Coupon Handler component that allows remote attackers to perform unauthorized manipulation resulting in information disclosure. The attack requires high complexity and no authentication, with a CVSS score of 2.9 indicating low impact. Publicly available exploit code exists, though the vendor did not respond to early disclosure notification.
PandaX JWT Secret Handler uses hard-coded cryptographic keys in the config.yml file, allowing remote attackers to bypass authentication and decrypt sensitive JWT tokens with high attack complexity. The vulnerability affects the product up to commit fb8ff40f7ce5dfebdf66306c6d85625061faf7e5, and although public exploit code exists, the extremely low EPSS score (0.05%) and high attack complexity suggest limited real-world exploitation despite network accessibility.
Actiontech SQLE up to version 4.2511.0 uses a hard-coded cryptographic key in its JWT Secret Handler (sqle/utils/jwt.go), allowing remote attackers with no authentication or user interaction to gain limited information disclosure. The vulnerability results from improper handling of the JWTSecretKey argument, though exploitation is rated as difficult due to high attack complexity. Publicly available exploit code exists, and the vendor has committed to addressing this in an upcoming release.
Improper authorization in getmaxun maxun up to version 0.0.28 allows authenticated remote attackers to access unauthorized resources via manipulation of the authentication endpoint router in server/src/routes/auth.ts, with publicly available exploit code and an EPSS score of 0.15% indicating low real-world exploitation probability despite confirmed public disclosure.
Use of hard-coded cryptographic keys in getmaxun maxun up to version 0.0.28 allows remote unauthenticated attackers to manipulate the api_key parameter in the authentication route, potentially disclosing sensitive information with high attack complexity. Publicly available exploit code exists, though EPSS scoring (0.07%) and vendor non-responsiveness suggest limited real-world exploitation pressure despite confirmed POC availability.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
UART interface debug and test access control bypass in TOZED ZLT M30s firmware versions up to 1.47 allows physical attackers to access on-chip debug interfaces with improper authentication, leading to information disclosure and potential system manipulation. Exploitation requires direct physical device access and is difficult to execute, but publicly available exploit code exists and the vendor has not responded to disclosure. With an EPSS score of 0.03% and CVSS 0.3, real-world risk is minimal despite public POC availability.
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.
A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read application data. [CVSS 3.3 LOW]
An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. [CVSS 6.5 MEDIUM]
Redcap versions up to 14.3.13 contains a vulnerability that allows attackers to enumerate usernames due to an observable discrepancy between login attempts (CVSS 5.3).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 6.3 MEDIUM]
Signal K Server is a server application that runs on a central hub in a boat. [CVSS 5.3 MEDIUM]
In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists. [CVSS 5.3 MEDIUM]
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.
Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Resource lock poisoning in ZwiiCMS prior to 13.7.00 allows authenticated low-privilege users to deny administrators access to administrative functionality by exploiting a race between lock acquisition and authorization. The application incorrectly acquires and binds a temporary resource lock to the requesting session before completing the authorization check - meaning even a request that ultimately returns 404 holds the lock until the attacker's session is cleared. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the requirement for a pre-existing authenticated session.
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
WP Messiah BoomDevs WordPress Coming Soon plugin through version 1.0.4 exposes sensitive system information to unauthorized access, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability stems from improper access controls on sensitive data endpoints, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). With an EPSS score of 0.01% (2nd percentile), exploitation likelihood is minimal despite the information disclosure nature of the defect.
Direct Payments WP WordPress plugin through version 1.3.2 exposes embedded sensitive system information to unauthorized parties via CWE-497 exposure mechanisms, allowing attackers to retrieve confidential data without requiring authentication. The vulnerability affects all versions up to and including 1.3.2, with an EPSS score of 0.01% indicating minimal observed exploitation probability despite the information disclosure nature of the flaw.
Local privilege escalation and unauthorized raw-disk access in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22) arise because the SYSTEM-level regService applies a security descriptor with no explicit DACL to a device object, letting a low-privileged local user open the object and issue raw disk operations that can disrupt the system, expose sensitive data, or elevate privileges. Exploitation is local-only (AV:L, PR:L, UI:N, 7.8) and publicly available exploit code exists (a PoC gist is linked from NVD), though the product's narrow maritime-navigation deployment base limits broad exposure and no active exploitation is confirmed (no CISA KEV listing).
Post Video Players WordPress plugin through version 1.163 exposes sensitive embedded data to unauthorized users via improper information disclosure mechanisms. The vulnerability allows attackers to retrieve sensitive system information that should be restricted from public access, affecting the plugin's core video playlist and gallery functionality. With an extremely low EPSS score of 0.04%, active exploitation appears minimal despite the information disclosure risk.
Information disclosure in Razvan Stanga's Varnish/Nginx Proxy Caching WordPress plugin through version 1.8.3 allows sensitive data embedded in cached responses to be exposed to unauthorized users. The vulnerability stems from improper handling of sensitive information during proxy caching operations, enabling attackers to retrieve cached data containing credentials, tokens, or other confidential material. No authentication is required to exploit this issue, and EPSS analysis indicates a 4.43% probability of exploitation (89th percentile), suggesting moderate real-world risk despite the lack of known public exploits.
Download Media Library WordPress plugin through version 0.2.1 exposes sensitive system information to unauthorized users via embedded data retrieval. The vulnerability allows unauthenticated attackers to access restricted system details without proper access controls, though real-world exploitation probability remains low (EPSS 0.04%). No public exploit code or active exploitation has been confirmed.
The Efí Bank Gerencianet Oficial WordPress plugin through version 3.1.3 exposes sensitive data by embedding it into sent HTTP requests or responses, allowing attackers to retrieve payment-related information without authentication. This information disclosure vulnerability (CWE-201) affects all installations of the affected plugin versions and is classified as low-risk based on EPSS score (0.04%, 12th percentile), with no public exploit code or active exploitation confirmed.
The Terms descriptions WordPress plugin versions 3.4.10 and earlier expose sensitive data through embedded information in sent data, allowing unauthenticated attackers to retrieve embedded sensitive information. This information disclosure vulnerability (CWE-201) affects all installations of the plugin up to version 3.4.10. No public exploit code has been identified, and the EPSS score of 0.04% indicates minimal real-world exploitation probability, though the vulnerability remains a concern for sites storing sensitive term metadata.
ColorWay WordPress theme through version 4.2.3 embeds sensitive information in sent data, allowing unauthenticated attackers to retrieve embedded data without authentication. The vulnerability has an exceptionally low exploitation probability (EPSS 0.03%, 9th percentile) despite being information disclosure in nature, suggesting the sensitive data exposure requires specific conditions or limited practical impact. No active exploitation or public exploit code is documented at time of analysis.
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
Credential leakage in the Ruby URI gem's `+` operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in `URI#join` and `URI#merge` but left `URI#+` unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using `+` are concretely at risk of sending those credentials to attacker-controlled hosts.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Roxnor PopupKit popup-builder-block plugin through version 2.2.4 exposes sensitive system information to authenticated users via an information disclosure vulnerability. An authenticated attacker can retrieve embedded sensitive data that should not be accessible, potentially gaining insight into system configuration or other restricted information. The CVSS 4.3 score reflects low real-world impact (confidentiality only, low privileges required), and EPSS exploitation probability is minimal at 0.04%, indicating this is a lower-priority vulnerability despite affecting a WordPress plugin.
Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.
Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).
Sensitive data exposure in Contact Form 7 Mailchimp Extension plugin for WordPress (versions ≤0.9.68) allows unauthenticated remote attackers to retrieve embedded sensitive information through network-accessible endpoints. The vulnerability enables unauthorized access to confidential data with low attack complexity and no user interaction required. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis.
Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
Race condition in the Purchase Request Handler of PHPEMS up to version 11.0 allows remote attackers to corrupt purchase data integrity under precise timing conditions. Exploitation requires high complexity and many attempts, with limited impact on information disclosure. A public proof-of-concept is available, but no active exploitation has been confirmed.
Race condition in PHPEMS Coupon Handler component up to version 11.0 allows authenticated remote attackers to manipulate coupon processing logic, potentially resulting in integrity compromise. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation despite publicly available proof-of-concept code. EPSS score of 0.04% indicates low real-world exploitation probability despite public POC availability.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
WP Project Manager plugin through version 3.0.1 exposes sensitive information in sent data due to improper information handling, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability affects all installations of the weDevs plugin and has been identified with an extremely low EPSS score (0.05%, 14th percentile), suggesting minimal practical exploitation likelihood despite the information disclosure classification.
Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.
Sensitive information disclosure in Gmission Web Fax 3.0 (before 3.0.1) enables a locally authenticated low-privileged user to access protected fax data without proper authorization. The root cause is missing authorization checks (CWE-200) that can be abused by an authenticated local actor to read confidential information beyond their intended access scope. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Information disclosure in PbootCMS up to 3.2.12 allows remote attackers to directly request and download the SQLite database file /data/pbootcms.db, potentially exposing sensitive data. A public exploit is available, but exploitation is difficult and EPSS (0.06%) indicates very low probability of widespread exploitation. No active exploitation has been confirmed.
Information disclosure in Halo up to 2.21.10 can be triggered by a remote attacker with low privileges via high-complexity manipulation of the /actuator configuration handler, potentially leaking limited configuration data. Public exploit code exists, but active exploitation has not been confirmed and EPSS indicates a negligible exploitation probability (0.03%). The low CVSS 4.0 score and high attack complexity further reduce the real-world
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Improper authorization in JeecgBoot's position management API allows authenticated low-privilege users to enumerate personnel assigned to arbitrary organizational positions by manipulating the positionId parameter at the /sys/position/getPositionUserList endpoint. All versions up to and including 3.9.0 are confirmed affected per NVD CPE data. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and EPSS of 0.04% (11th percentile) indicate this is a limited-impact, difficult-to-exploit information disclosure - no active exploitation has been confirmed.
Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active
Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.
Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.
Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
OpenCart versions up to 4.1.0.3 are vulnerable to a race condition in the Single-Use Coupon Handler component that allows remote attackers to perform unauthorized manipulation resulting in information disclosure. The attack requires high complexity and no authentication, with a CVSS score of 2.9 indicating low impact. Publicly available exploit code exists, though the vendor did not respond to early disclosure notification.
PandaX JWT Secret Handler uses hard-coded cryptographic keys in the config.yml file, allowing remote attackers to bypass authentication and decrypt sensitive JWT tokens with high attack complexity. The vulnerability affects the product up to commit fb8ff40f7ce5dfebdf66306c6d85625061faf7e5, and although public exploit code exists, the extremely low EPSS score (0.05%) and high attack complexity suggest limited real-world exploitation despite network accessibility.
Actiontech SQLE up to version 4.2511.0 uses a hard-coded cryptographic key in its JWT Secret Handler (sqle/utils/jwt.go), allowing remote attackers with no authentication or user interaction to gain limited information disclosure. The vulnerability results from improper handling of the JWTSecretKey argument, though exploitation is rated as difficult due to high attack complexity. Publicly available exploit code exists, and the vendor has committed to addressing this in an upcoming release.
Improper authorization in getmaxun maxun up to version 0.0.28 allows authenticated remote attackers to access unauthorized resources via manipulation of the authentication endpoint router in server/src/routes/auth.ts, with publicly available exploit code and an EPSS score of 0.15% indicating low real-world exploitation probability despite confirmed public disclosure.
Use of hard-coded cryptographic keys in getmaxun maxun up to version 0.0.28 allows remote unauthenticated attackers to manipulate the api_key parameter in the authentication route, potentially disclosing sensitive information with high attack complexity. Publicly available exploit code exists, though EPSS scoring (0.07%) and vendor non-responsiveness suggest limited real-world exploitation pressure despite confirmed POC availability.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
UART interface debug and test access control bypass in TOZED ZLT M30s firmware versions up to 1.47 allows physical attackers to access on-chip debug interfaces with improper authentication, leading to information disclosure and potential system manipulation. Exploitation requires direct physical device access and is difficult to execute, but publicly available exploit code exists and the vendor has not responded to disclosure. With an EPSS score of 0.03% and CVSS 0.3, real-world risk is minimal despite public POC availability.
Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.