Java
Monthly
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
Proxied plaintext WebSocket (ws://) requests issued through AsyncHttpClient before 3.0.12 or 2.16.1 leak the configured proxy's credentials to the origin WebSocket server. When an HTTP proxy requiring authentication is in use, the tunneled ws:// upgrade is built with the proxy's Proxy-Authorization header and an absolute-form request target, so the origin endpoint operator - or any party able to observe origin-bound traffic - can recover Basic credentials directly or capture a Digest challenge-response for offline cracking or replay. Exploitation depends on a non-default configuration (an authenticated HTTP proxy plus an application-initiated ws:// request), yields only proxy credentials rather than user or application data, and is rated CVSS 3.1 base 5.9; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Improper verification of the WebSocket opening handshake in AsyncHttpClient (AHC) versions prior to 3.0.12 and 2.16.1 lets a malicious or man-in-the-middle WebSocket endpoint have frames decoded and delivered to the application's WebSocketListener even though the server's Sec-WebSocket-Accept value was missing or invalid and the 101 upgrade was never authenticated. Only Java applications that use the WebSocketUpgradeHandler on an affected AHC release and connect to an attacker-controlled or intercepted endpoint are exposed, and because the request future still fails and the channel is closed the window for delivering coalesced frames is narrow and the impact is limited to integrity of listener-delivered data. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, consistent with its low CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
HTTP Digest authentication in AsyncHttpClient (Java) prior to 3.0.12 and 2.16.1 derives the client nonce (cnonce) from ThreadLocalRandom rather than a cryptographically secure source, weakening the Digest exchange against chosen-plaintext and credential-precomputation attacks for an observer who can infer generator state. The issue is rated CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), so per the assessed vector no authentication is required from a remote attacker, but exploitation is statistical and high-complexity rather than a direct exploit. Only applications that use AsyncHttpClient's Digest auth via Realm.Builder are affected; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV is not indicated).
Cross-origin cookie injection in AsyncHttpClient (AHC) Java library before 3.0.13 and 2.16.1 allows an attacker-controlled host beneath a registry-level public suffix such as co.uk to set a cookie for that suffix itself, which the shared ThreadSafeCookieStore then replays to unrelated hosts under the same suffix. The failure lies in ThreadSafeCookieStore, which performs domain matching but never applies the RFC 6265 Section 5.3 step 5 rule that rejects a Domain attribute naming a public suffix; the practical result is that session-relevant cookie values can be injected or overwritten across origins sharing that registry. Impact is integrity-only (I:H, no confidentiality or availability loss) and exploitation is scenario-dependent, requiring one cookie store shared across requests to both an attacker host and a victim host under the same suffix, which is why the assessed vector carries High attack complexity and a present Attack Requirement. No public exploit code or active exploitation was identified at time of analysis; fixes are released as version 3.0.13 and 2.16.1.
AsyncHttpClient (AHC), a Java library for asynchronous HTTP requests, contains an incomplete cookie Domain validation flaw in its ThreadSafeCookieStore: from 2.16.0 through 2.16.1 and from 3.0.11 through 3.0.13, the store fails to apply private-section and default public-suffix rules, A-label (IDN) normalization, locale-independent lowercasing, and proper host-only and numeric/IP host checks, so a cookie set by one origin can be stored and later replayed to a different origin. Applications that share a single client instance across distinct trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation; the assessed impact is integrity-only (CVSS 3.1 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) with no data disclosure. Exploitation is constrained by a non-default deployment pattern (per-origin or per-trust-boundary clients are not affected) and by the attacker needing to control or inject a Set-Cookie response from one of the shared origins; no public exploit code was identified at time of analysis, and the vendor has released a fix in version 3.0.14.
Cookie-store handling in AsyncHttpClient (AHC) versions 2.1.0 through 2.16.1 and 3.0.0 through 3.0.13 lets a shared client instance attach one user's stored cookies to another user's request, causing the outbound request to execute under the wrong session. The enabled-by-default cookie store replaces a Cookie header set explicitly via setHeader or addHeader whenever the store holds any cookie for the origin, a gap that survives the earlier CVE-2024-53990 fix (which only covered cookies supplied through addCookie). Exploitation is conditional rather than broadly weaponizable: it requires a multi-tenant shared client, an authenticated participant (CVSS PR:L), at least one caller supplying the Cookie header directly, and a stored cookie for the same origin, with timing/ordering dependence reflected in the high attack complexity (AC:H) of the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N vector; no public exploit identified at time of analysis and no CISA KEV listing. A vendor-released patch, version 3.0.14, is available.
Denial of service in yawkat lz4-java before 1.11.2: an attacker who can feed compressed bytes into LZ4DecompressorWithLength's buffer-allocating decompress methods can exhaust JVM heap. A five-byte payload whose four-byte length header declares a huge output causes the library to allocate up to roughly 2 GiB before it validates the compressed data, resulting in OutOfMemoryError and transient heap pressure. The flaw is remotely triggerable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but availability-only with low impact (C:N/I:N/A:L), yielding a 5.3 score; no public exploit code was identified at time of analysis, and the vendor-released fix is version 1.11.2.
Heap exhaustion in the yawkat LZ4 Java library before 1.11.2 allows remote denial of service: net.jpountz.lz4.LZ4BlockInputStream.refill() checks that the compressedLen field of a legacy LZ4Block header is nonnegative but then allocates a compressed-input buffer of exactly that attacker-controlled size before any payload is read. Because each header is only a handful of bytes, a header-only stream can request a near-2 GiB allocation and crash the JVM with OutOfMemoryError, affecting any application that decompresses attacker-influenced LZ4 legacy-block data with the default reader configuration; no public exploit code or active exploitation was identified at time of analysis (CVSS 5.3, availability-only impact). The flaw is fixed in version 1.11.2, which rejects non-canonical oversized blocks by default.
Denial of service in LZ4 Java (lz4-java) prior to 1.11.4 allows unauthenticated remote attackers to exhaust memory and CPU by supplying a crafted LZ4 frame stream to net.jpountz.lz4.LZ4FrameInputStream in its default concatenated-frame mode; each minimal empty maximum-block-size frame forces readHeader() to allocate two 4 MiB block buffers (roughly 8 MiB per 11 input bytes) with no decompressed output, so decompressed-size limits do not mitigate the issue. The vulnerability is moderate severity (CVSS 5.3, A:L) and is fixed in 1.11.4; readSingleFrame mode is not affected, and no public exploit or KEV entry has been identified at time of analysis.
Uncontrolled recursion in yawkat LZ4 Java's net.jpountz.lz4.LZ4BlockInputStream can crash the decoding thread: when the stream is explicitly configured with stopOnEmptyBlock set to false, each well-formed empty LZ4 block causes refill() to call itself recursively, so an attacker-supplied compressed stream containing a long run of empty blocks drives the stack to exhaustion and throws StackOverflowError. Only applications that both use LZ4BlockInputStream with the non-default stopOnEmptyBlock=false setting and feed it attacker-controlled or injectable compressed data are exposed; the default stopOnEmptyBlock=true is not affected, no authentication or user interaction is required under those conditions (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the decoding thread with no memory corruption, confidentiality, or integrity effect. There is no public exploit identified at time of analysis and the flaw is fixed in version 1.11.4.
Stored cross-site scripting in the Class2HTML report generator shipped with Apache Commons BCEL before 6.13.0 lets attacker-controlled strings from a Java class file (class, field and method names, constant-pool entries, attribute values and anchors) be written into generated HTML reports without escaping, so script executes in the browser of anyone who opens the report. The issue is unauthenticated (CVSS 4.0 PR:N) but highly conditional: the deployment must actually use the Class2HTML/AttributeHTML/CodeHTML/ConstantHTML utilities to render HTML from class files an attacker can influence, and a victim must then open the resulting report (UI:P), which is why the CVSS 4.0 base score is only 2.3 because attack requirements are present (AT:P) even though the independent assessment rates the same flaw 7.1 under CVSS 3.1 with scope change (S:C). This is not reachable through ordinary BCEL bytecode parsing or manipulation; no public exploit has been identified at time of analysis and the flaw is fixed in 6.13.0.
RabbitMQ Java Client library releases prior to 5.35.0 can leak plaintext broker credentials because ConnectionFactoryConfigurator.load() wraps AMQP URI parsing failures in IllegalArgumentException messages that contain the raw amqp://user:pass@host URI. Any application that supplies credentials inside the connection URI and then hits a setup error - malformed URI syntax or a TLS NoSuchAlgorithmException/KeyManagementException - will write those credentials into startup logs, APM dashboards, CI output, or copied stack traces, where users without broker access may read them. This is a genuine but low-urgency credential-disclosure issue rather than a widely-exploitable critical flaw: exploitation is passive and conditional, requires the attacker to already have read access to the log sink, and only affects the configurator load() path where credentials are embedded in the URI. No public exploit identified at time of analysis; the vulnerable behavior is fixed in version 5.35.0, and the CVSS 4.0 score of 5.7 (AV:L/AC:L/AT:P/PR:L, VC:H) reflects that local, low-privilege, log-reading access with specific preconditions is needed.
Malformed UTF-8 echoed back through an AMQP shortstr property can permanently disable RPC consumers built on the RabbitMQ Java client before 5.36.0, forcing the affected consumer to fail on every redelivery of a single poison message. An attacker with low-privileged broker access publishes a request whose property value (for example correlation-id) contains invalid UTF-8; ValueReader.readShortstr decodes those bytes into U+FFFD replacement characters, which re-encode to more than the 255-byte AMQP shortstr limit that ValueWriter.writeShortstr enforces, so reply publication throws an unchecked exception. In RpcServer.mainloop() and tutorial-style echo consumers that exception aborts the loop before acknowledgement, the broker requeues the message, and the consumer is stuck until the queue is purged. No public exploit identified at time of analysis; impact is confined to availability of the target consumer (reported CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution, authentication bypass, or data exposure.
Improper authorization (CWE-285) in jshERP through version 3.5 allows an authenticated, low-privileged user to manipulate financial receipt records by invoking the updateAccountHeadAndDetail function in AccountHeadService.java, which fails to enforce proper permission checks. The flaw is remotely exploitable with low attack complexity and no user interaction (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N), but exploitation requires a valid low-privilege account, so the practical risk is insider abuse or misuse of any obtained credentials rather than unauthenticated external compromise. Impact is limited to integrity and availability of financial receipt data (VI:L/VA:L) with no confidentiality exposure, and publicly available exploit code exists (referenced in GitHub issue 167); the vendor was notified via an issue report but has not responded, and no vendor-released patch was identified at time of analysis.
Improper authorization in SpringBlade up to 5.0.1 allows an authenticated remote user to access role or user detail records they do not own by manipulating the ID parameter in the RoleController User Detail endpoint. The flaw is a CWE-285 improper authorization issue (insecure direct object reference) that affects only confidentiality, with no integrity or availability impact and no code execution; publicly available exploit code exists, and no CISA KEV listing is present. The independent assessment rates this as a moderate, not urgent, priority, and notes that while the CVSS vector indicates high privileges (PR:H), the practical privilege level may be lower because any logged-in user could likely exploit the IDOR.
Improper authorization in the SpringBlade Java microservice framework (all versions up to 5.0.1) lets an authenticated user holding high privileges manipulate the initPassword argument exposed by the Parameter Submit Management controller (ParamController) and change system parameters they should not be able to control. The endpoint is remotely reachable, but exploitation requires an existing elevated session with no user interaction, and the assessed impact is LOW across confidentiality, integrity and availability (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the project has not responded to the issue report, so no vendor-released patch is available at time of analysis.
Server-side request forgery in Penpot before 2.18.0 allows an authenticated user who controls a media-import URL, or an administrator who controls a webhook URL, to reach internal and cloud-metadata endpoints by supplying IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001:0000::/32) that embed a blocked IPv4 destination such as 169.254.169.254, 127.0.0.1, link-local, or RFC1918 addresses. The bypass works because the backend blocklist app.util.ssrf/blocked-address? applies its extra CIDR checks only to IPv4 values and relies on Java InetAddress predicates that do not classify transition-mechanism addresses; exploitation further requires the request to traverse a NAT64 gateway or the attacker to control a DNS AAAA record the Penpot server resolves, with cloud environments that already run DNS64/NAT64 directly exploitable, while non-NAT64 deployments depend on the harder attacker-controlled AAAA path. Media import can disclose response bodies, whereas webhook delivery exposes only response status as a network-probing side channel, and there is no public exploit identified at time of analysis. Penpot 2.18.0 is the vendor-released fix (commit 326d83e780ae120b45ccd6f3d7bd24922b54461c).
Denial of service in the Apache Struts REST plugin affects Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0: a remote unauthenticated request with an oversized body is read into memory without any size bound, letting a single request exhaust the Java heap and deny service to other users. Exposure is limited to applications that actually deploy the optional REST plugin and accept request bodies - Struts core is unaffected, and the vendor confirms that no additional setting has to be enabled for a default REST-plugin deployment to be reachable, while form submissions and multipart uploads are not parsed by the affected code path. No CISA KEV listing, public exploit code, or EPSS score was present in the source data, so active exploitation is not confirmed; vendor-fixed releases 6.12.0 and 7.4.0 cap request bodies at 2 MB (2,097,152 characters) by default.
Unlimited credential-guessing against the linlinjava litemall admin login endpoint is possible because the application imposes no lockout, throttling, CAPTCHA, or failed-attempt limit on the AdminAuthController in the litemall-admin-api module (CWE-307), affecting versions up to and including 1.8.0. A remote, unauthenticated attacker (CVSS 4.0 vector PR:N) can repeatedly submit password guesses, but exploitation is rated difficult and high-complexity: the flaw only removes the brute-force barrier rather than bypassing authentication, so it still depends on weak, default, or guessable admin credentials and on the admin-api component being deployed and network-reachable. Publicly available exploit code exists, and the vendor has not responded to the issue report; impact is confined to low confidentiality with no integrity or availability effect, making this a genuinely low-priority issue despite the public documentation.
SQL injection in RainyGao DocSys (up to version 2.02.85) allows an attacker to inject arbitrary SQL through the 'url' argument handled by BaseController.createDBForMysql in the Database Management component, potentially exposing or altering backend data. Publicly available exploit code exists, and the CVSS 4.0 vector scores the issue 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with E:P), while an independent assessment using CVSS 3.1 rates it AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact - the discrepancy regarding privilege requirements reflects the fact that the vulnerable function configures a MySQL connection, an action that in practice is reached from the DocSys management interface and may require an authenticated or administrative session. The vendor was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Bouncy Castle for Java before 1.86 leaks secret-derived information from its HQC post-quantum KEM through two side channels, allowing a local attacker who can observe CPU cache behaviour or precisely measure decapsulation timing to recover information about the HQC private key. Only deployments that actually perform HQC encapsulation or decapsulation on the affected library are exposed, and exploitation requires either code co-resident on the same physical host or many carefully controlled timing measurements, so isolated single-tenant hardware largely neutralises the cache channel. There is no public exploit identified at time of analysis; this is a genuine cryptographic weakness but a comparatively low-urgency operational priority, and a vendor fix is available in version 1.86.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Path traversal in Logback-classic (0.9.14 through 1.6.4) allows remote unauthenticated attackers to create and append log files outside the intended directory when a FileAppender path is built from an attacker-influenced MDC value, such as an HTTP header. Exploitation requires a non-default configuration where a SiftingAppender uses an MDC discriminator for the file path; no public exploit identified at time of analysis, and the vendor has released a patch in version 1.6.5. The reporter assigned a CVSS 4.0 score of 6.3, reflecting medium severity with limited integrity and availability impact.
Unbounded key-derivation cost parameters in Bouncy Castle for Java before 1.86 allow a denial of service against applications that parse attacker-influenced cryptographic structures: PBKDF2 iteration counts, derived-key lengths, scrypt parallelization factor p, and OpenSSH v1 bcrypt round counts were read straight from untrusted input and used to drive the KDF before any password or MAC verification could reject the data. Affected code paths include the RFC 9579 PBMAC1 MAC calculator builders (JcePBMac1CalculatorBuilder, PKCS12PBEUtils.createPBMac1Calculator reached via PKCS12PfxPdu.isMacValid), the PKCS#8/PKCS#12 scrypt cost guards, the raw JCA PBKDF2 provider, and OpenSSH v1 private-key parsing in Bouncy Castle for Java, LTS (before 2.73.13) and FIPS (bcpkix-fips before 1.0.13 / 2.0.13 / 2.1.13). Impact is availability-only (CVSS:4.0 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L): exploitation requires the victim application to passively process a malicious blob and is unauthenticated (PR:N), but no key material or data is exposed, and there is no public exploit identified at time of analysis.
Missing authentication in the Instant Buy component of ZongXR SuperMarket 1.0.0.0 lets remote attackers invoke the startBuy function without proving a valid session, simply by manipulating the Username argument passed to InstantBuyController.java. Impact is limited to integrity and availability at low severity (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no confidentiality loss, and publicly available exploit code exists though there is no confirmation of active exploitation. The authentication prerequisite is ambiguous - the CWE-306 classification and description imply no credentials are needed, while the vendor's CVSS 4.0 vector encodes low-privilege (PR:L) access - so the true auth requirement should be treated as unconfirmed. Real-world risk is low primarily because this is an obscure hobby/open-source project that is rarely exposed in production.
Unauthenticated remote attackers can delete arbitrary order records in ZongXR SuperMarket 1.0.0.0 because the OrderController.deleteOrder endpoint lacks authentication checks (CWE-306). Publicly available exploit code exists (GitHub issue #31), and the project maintainer has not responded to the report. With a CVSS 4.0 score of 6.9 (medium) and an independent assessment confirming only low integrity and availability impact, the vulnerability poses a low-to-moderate risk, primarily limited by the product's rare deployment in production environments.
Missing authentication in the ZongXR SuperMarket 1.0.0.0 order-save endpoint (OrderController.addOrder) allows unauthenticated remote attackers to submit order actions while passing an arbitrary userId argument, letting them act on behalf of other accounts without any credentials. The root cause is CWE-306: the handler performs no authentication check at all, so the caller-supplied userId is implicitly trusted. Publicly available exploit code exists (documented in the project's own GitHub issue #32), but real-world priority is low because SuperMarket is a niche, non-production Java project with no large-scale enterprise deployment footprint - the practical limit is whether an instance is network-reachable, and no privileges or user interaction are required (CVSS:4.0 PR:N/UI:N; our assessment scores it AV:N/AC:L/PR:N/UI:N with limited integrity impact, C:N/I:L/A:N).
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
SQL injection in risesoft-y9 WorkFlow-Engine (all versions up to and including 9.6.10) lets a remote attacker manipulate the 'year' and 'processInstanceId' arguments passed to the getByIdAndYear function of CustomHistoricProcessServiceImpl.java, with two independent injectable sink positions rather than one. Publicly available exploit code exists (there is no CISA KEV listing, so active exploitation is not confirmed), and the vendor was contacted early but never responded or shipped a fix. The vendor-supplied vector rates the flaw unauthenticated (PR:N), while the independent assessment scores it PR:L because the affected code path sits behind the product's OAuth2 Resource Filter and may require a valid access token; defenders should determine whether the endpoint is reachable before authentication. Impact is bounded (low confidentiality, integrity and availability), so this is a low-to-moderate real-world risk that hinges on whether a given self-hosted instance is internet-exposed.
Memory exhaustion in the sshd-sftp component of Apache MINA SSHD (1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets an authenticated remote SFTP client crash the server by driving the SFTP v6 check-file-name/check-file-handle extension to build an oversized reply entirely in server memory. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the session must be authenticated and must negotiate SFTP protocol version 6, and the attacker must point the request at a very large (possibly sparse) file using a tiny block size such as the 256-byte minimum, so that file-size divided by block size yields an enormous number of hashes; availability impact is high while confidentiality and integrity are unaffected. This is a genuine but bounded availability risk with no public exploit identified at time of analysis, and deployments that already cap SFTP message size (typically 256kB, as OpenSSH does) are not exposed.
Memory exhaustion denial of service in Apache MINA SSHD's SCP subsystem (module sshd-scp) affects all releases before 2.20.0 and the 3.0.0-M1 through 3.0.0-M5 milestones, requiring a connected SSH peer that has reached the SCP protocol handler - on a server deployment this typically means successful low-privilege authentication, which is the main gating factor (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium). The peer only needs to stream a single malformed SCP command line that never terminates with an LF, causing the handler to buffer the endless input until the JVM throws OutOfMemoryError and the application crashes; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is a bounded availability issue for deployments that expose or use the SCP subsystem.
Improper input validation in the sshd-git component of Apache MINA SSHD lets authenticated SSH clients write arbitrary files onto the server by invoking 'git archive' with the single-argument '-o=file.zip' form. Only deployments that use GitPgmCommandFactory to expose remote JGit command execution to SSH clients are affected, and the attacker must hold valid SSH credentials (PR:L), so impact is a conditional integrity violation (C:N/I:H/A:N, CVSS 6.5) rather than a confidentiality or availability compromise. The flaw is an incomplete fix for CVE-2026-58624, which restricted git subcommands but missed the '-o=file.zip' variant; no public exploit code and no confirmed active exploitation were identified at time of analysis, and fixed releases are available (2.20.0 and 3.0.0-M6).
SQL injection in mahonelau kykms (rolling release up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7) allows remote attackers to inject arbitrary SQL through the column argument of QueryGenerator.doMultiFieldsOrder, a multi-field ordering routine in the SqlInjectionUtil component. The flaw is CWE-89 improper neutralization of SQL commands and, because the injection lands in an ORDER BY clause, exploitation is typically limited to blind/boolean or error-based extraction rather than direct UNION dumping. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation at time of analysis. The provided CVSS 4.0 vector claims network reachability with no privileges (PR:N) and no user interaction, yet the independent assessment notes that JeecgBoot-style deployments commonly authenticate sortable data-query endpoints, so a valid session may be required in practice - verify against the specific kykms build.
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow definitions across project boundaries through the batch-copy and batch-move endpoints, which omit the project-level permission check. Exploitation requires a valid account on the instance with access to at least one project but without the required permissions on the targeted projects, and the effect is limited to low confidentiality and integrity impact (cross-project workflow manipulation) with no availability or code-execution impact; there is no public exploit identified at time of analysis and no confirmed active exploitation. Because the flaw matters mainly in multi-tenant or shared deployments with untrusted tenants, the aggregate signals place it at LOW-to-MEDIUM priority, but organizations relying on DolphinScheduler project isolation as a security boundary should patch promptly.
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permission on a project to modify workflow instances inside that same project by sending a request to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to enforce the write permission the operation requires. The flaw is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning remote, authenticated, low-complexity exploitation with a limited integrity impact and no confidentiality or availability impact; the attacker must already possess valid credentials and read access to the target project, so exposure is largely limited to insiders or compromised low-privilege accounts. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so it should be treated as a genuine but low-severity authorization bug rather than an urgent, actively exploited threat; upgrading to 3.4.3 fully remediates.
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privilege user read workflow information belonging to projects they are not authorized to access by calling the query-dynamic-sub-workflows API endpoint, which authenticates the caller but omits the project-scope authorization check (CWE-863). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring a valid account, with impact confined to confidentiality and no write or code-execution path. Exploitation also presumes the attacker knows or can guess workflow references in the target project, and it only matters where project-level isolation is treated as a security boundary (multi-tenant or multi-team deployments); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected Spring Boot Actuator endpoints by sending requests whose paths contain percent-encoded characters, causing the application's path-based authorization check to fail to match the request against its protected Actuator path list. Successful exploitation exposes operational and configuration data (for example environment properties or configuration beans) and, where sensitive or write-capable Actuator endpoints are enabled, potentially management functionality; the assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality and low integrity/availability impact, so no credentials or user interaction are required. No CVSS score or vector was published by NVD or Apache and no public exploit code was identified at time of analysis, though the technique is a well-understood class of path-matching evasion and exploitation is trivial once a reachable instance is found. Real-world severity is bounded by which Actuator endpoints the deployment exposes.
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/unauth-datasource endpoint and retrieve configuration and metadata for data sources they are not authorized to see. As assessed, exploitation requires a valid low-privileged account and network reachability to the web application (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and it is most impactful in multi-tenant deployments where data sources are meant to be isolated between users; the breadth of leaked fields is not specified by the vendor, so confidentiality impact depends on the deployment. There is no public exploit identified at time of analysis and no evidence of active exploitation.
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.
Missing authorization in REBUILD up to 4.4.11 allows unauthenticated remote attackers to manipulate the url or fileKey parameter sent to /commons/file-editor-save, enabling unauthorized read and write actions against the file-editor resource. Publicly available exploit code exists, but no fixed version has been published and the vendor did not respond to the disclosure. The issue is medium severity with low confidentiality, integrity, and availability impact; priority depends on whether the Rebuild web interface is exposed.
Rebuild instances up to and including 4.4.7 and 4.5.0-beta5 expose a login endpoint (/user/login) that fails to properly validate authentication, allowing unauthenticated remote attackers to bypass the intended login control (CWE-287). Exploitation requires no credentials, no user interaction, and low complexity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), so any internet- or network-reachable Rebuild login page in its default configuration is a viable target. Publicly available exploit code exists and the vulnerability is documented by VulDB with a linked GitHub POC, but it has not been confirmed as actively exploited (not in CISA KEV); all impacts are rated Low, so successful abuse appears to yield partial access rather than full administrative takeover. The vendor was contacted but did not respond, and no vendor-released patch has been identified, making exposure reduction the primary near-term defense.
Disabled mall4j accounts (through 4.0) can indefinitely renew their sessions by calling POST /token/refresh, because the refresh flow issues a new token without re-checking the account's enabled flag, letting a user that an administrator deactivated retain the access they already had. The attacker must already hold a valid, non-expired refresh token obtained before deactivation, so this is an authenticated access-control persistence flaw (CVSS 5.3, CWE-613), not an unauthenticated bypass or a route to new accounts. Publicly available exploit code exists (a proof-of-concept Python script), but no active exploitation has been confirmed (not in CISA KEV), and the practical impact is limited to preserving prior access rather than escalating privileges.
Vertical privilege escalation in mall4j through 4.0 lets any self-registered storefront customer reach back-office administrative endpoints - including menu listings, file uploads, and configuration routes - by presenting the same sa-token session that was issued for the customer storefront. The flaw (CWE-287 improper authentication) is that the session validation layer never checks the sysType field that is supposed to separate customer from admin identity, so only endpoints already guarded by @PreAuthorize remain safe. Independently assessed at CVSS 5.3 with limited confidentiality and integrity impact, this is a genuine but moderate-priority privilege-escalation bug; publicly available exploit code exists, and there is no KEV-listed evidence of confirmed active exploitation.
Unauthenticated shipment-tracking disclosure in mall4j through version 4.0 lets remote attackers retrieve carrier names, waybill numbers, and full logistics trails for any order by calling the yami-shop-api DeliveryController checkDelivery endpoint with an order number and no credentials. Because the handler performs neither authentication nor ownership verification, any caller who can supply a valid order number - and sequential or guessable numbering would permit enumeration - can harvest tracking data in bulk. Publicly available exploit code exists (a proof-of-concept Python script), but the issue is not confirmed as actively exploited; per the independent assessment this is a real but low-to-moderate priority information-disclosure problem, since impact is limited to confidentiality of shipment metadata with no integrity or availability effects.
Unauthenticated attackers can delete arbitrary product reviews in mall4j through 4.0 by sending DELETE requests to the /prodComm endpoint in ProdCommController, which applies no authentication or authorization checks to the prodCommId parameter (CWE-306). Publicly available exploit code exists, and no credentials or user interaction are required; the only prerequisite is knowing or enumerating a valid review ID. The impact is limited to integrity tampering with review records, with no confidentiality or availability loss assessed in our independent review, making this a low-severity data-tampering issue rather than a high-impact compromise.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Username argument of the User Management endpoint /callrec/userAddAction.do so that unsanitized input is incorporated into an LDAP directory query, resulting in low-impact disclosure of directory information. The attack is reachable remotely and requires no user interaction, but it is gated behind a valid low-privilege account and a deployment whose user management is backed by an LDAP directory. Publicly available exploit code exists, including a proof-of-concept linked from the VulDB disclosure, and the vendor was contacted but did not respond; EPSS and CISA KEV do not indicate confirmed active exploitation. With a CVSS 5.3 base score and confidentiality-only impact (C:L, no integrity or availability effect), this is a high-CVSS-appearance-but-modest-real-risk issue.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 lets an attacker inject script through the viewRoleId or cfType parameter of the Play Audio Page endpoint /callrec/audio.jsp, executing in the browser of any user who opens a crafted link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, base 5.1) shows the attack is network-reachable but constrained: a low-privilege authenticated account is required and a legitimate user must interact with the link, so it is neither unauthenticated nor zero-click, and the assessed impact is limited to integrity (VI:L) with no confidentiality or availability effect recorded. Publicly available exploit code exists and the vendor did not respond to disclosure, so no patched version is available and deployed 9.7.0 instances remain exposed.
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that instantiate the two-argument handler constructors) allow a remote attacker to exhaust server heap memory by posting an oversized body - or a chunked body without a Content-Length header - to the agent context path, causing a denial of service. The issue affects ag-ui releases up to 2026-09-23 and is rated low-to-moderate (CVSS 4.0 base 5.3; our independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the handler's lack of built-in authentication means the practical privilege requirement depends on how each deployment fronts the endpoint; an upstream fix exists as pull request #2671 but is not yet merged/accepted.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Stored cross-site scripting in zhistaredu StarTraining 3.8.1 and earlier lets an authenticated user upload a file whose MIME type is misclassified by MimeTypeUtils.java, so the content is stored and later rendered as HTML/script in a victim's browser; the attacker's script then executes in the context of the StarTraining web application. Exploitation requires a valid account with access to the Upload Endpoint plus a second user who views the uploaded content, and publicly available exploit code exists. This is a low-real-risk issue despite being a network-reachable stored XSS: the vendor was contacted but never responded, and no vendor-released patch has been identified, so the practical severity is bounded by the credential and user-interaction prerequisites.
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filter is switched off by setting xss.enabled to false in the application.yml configuration file. This issue is not independently exploitable: it is a defense-in-depth gap that amplifies the companion injection flaw CVE-2026-100880, and both must be present for an attack to succeed. Exploitation requires authenticated low-privilege access (PR:L) and victim interaction (UI:P) and is rated as highly complex, with the vendor assigning a CVSS base of 2.1; publicly available exploit code exists (published via the ArrestX StarTraining advisories repository), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate privileges by manipulating the userId/roleIds parameters sent to the authRole endpoint, because the SysUser.isAdmin authorization logic trusts caller-supplied identifiers instead of the authenticated principal. Publicly available exploit code exists (published in the ArrestX StarTraining advisories repository as ST-VULN-004), but there is no evidence of confirmed active exploitation, and no vendor patch has been released. Independent assessment classifies this as a genuine but low-priority issue: exploitation requires a valid low-privileged account, the affected product has a very small footprint, and mitigation currently depends on access controls.
Resource exhaustion in Elasticsearch allows an authenticated high-privilege user to consume excessive node resources, causing denial of service through availability loss (CVSS 4.9). Affected deployments are all Elasticsearch versions before the vendor-fixed releases 8.19.22, 9.4.7, and 9.5.3, as reflected by the CPE wildcard and Elastic Security Advisory ESA-2026-184. Exploitation requires an authenticated account with high privileges (CVSS PR:H) and network access to the cluster API; there is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Impact is limited to availability, with no confidentiality or integrity effect, and realistic risk is confined to malicious insiders or attackers who already hold privileged credentials.
Authenticated denial of service in Elasticsearch lets a valid low-privilege account drive the node or cluster into uncontrolled resource consumption through an allocation-heavy request path, degrading or halting availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only users holding at least a low-privileged, network-reachable API account can trigger it - an unauthenticated remote attacker cannot, and there is no confidentiality or integrity impact. Elastic rates this a genuine but modest-severity availability issue rather than a top-tier priority: no public exploit code has been identified at time of analysis, no CISA KEV listing applies, and the advisory does not name the specific endpoint or query construct that acts as the allocation sink. Vendor-released patches exist in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-183).
Denial of service in Elasticsearch is possible because of uncontrolled resource consumption (CWE-400) that allows an authenticated user to drive excessive allocation and exhaust cluster resources. Elasticsearch deployments prior to 9.4.7 and 9.5.4 are affected; the issue is remote and low-complexity but requires valid low-privilege credentials or an API key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the impact is limited to availability with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation, and the vendor-scored severity of 6.5 places this as a moderate availability-only issue rather than a top-tier priority.
Denial of service in Elasticsearch allows a network-reachable, low-privilege authenticated user to exhaust cluster resources through excessive allocation, degrading availability down to a full outage while leaving data confidentiality and integrity intact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The flaw is an uncontrolled resource consumption bug (CWE-400 / CAPEC-130 Excessive Allocation), and the CPE record lists elastic:elasticsearch without version constraints, so every unpatched Elasticsearch deployment is presumed affected pending the vendor advisory ESA-2026-176. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires valid low-privilege credentials (a low-tier user, service account, or API key), which limits the population of attackers able to trigger it. The specific endpoint, query type, or configuration that produces the excessive allocation is not named in the available data describing the flaw and must be confirmed against the Elastic advisory.
Unauthenticated remote attackers can desynchronize HTTP/1.1 response parsing in Netty's HttpServerCodec (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.16.Final and all versions up to and including 4.1.136.Final by pipelining a GET carrying 'Expect: 100-continue' immediately followed by a HEAD request on the same keep-alive connection. Because the codec pairs each outbound response - including the 100 Continue informational response - with a queued inbound method via pollMethod(), the GET's 200 OK is matched to HEAD and its entity body is dropped, while the following 200 OK (intended for HEAD) is emitted with a body; this misattributes content across responses, enabling response splitting and unsafe reuse of the connection. It is a genuine but moderate-priority integrity flaw (vendor CVSS 4.0 score 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and vendor-released patches available in 4.2.17.Final and 4.1.137.Final.
Routing and access-control bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final allows a remote unauthenticated attacker to send a single HEADERS frame with conflicting :authority and host header values, causing different components in a multi-component request path to make inconsistent decisions. This moderate-severity integrity issue is fixed in 4.2.18.Final; no public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in Apache Roller 6.1.5 lets unauthenticated remote attackers inject script into the HTML form rendered by the optional LdapCommentAuthenticator, which writes request parameter values into the page without escaping (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is tightly constrained: only sites explicitly configured to use LdapCommentAuthenticator are affected, the victim's session must already have the authenticator form loaded, and the victim must follow an attacker-crafted link. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the credentials are credited to 姬珏 (CyberLeo); the net assessment is a low-to-moderate priority issue rather than an urgent one.
Stored cross-site scripting in Apache Roller 6.1.5 lets an unauthenticated remote attacker post a comment containing a javascript: URI that survives HTML comment formatting and executes in the browser of any visitor who clicks the crafted link. Exploitation is gated by a non-default configuration - the site must enable HTML in comments (users.comments.htmlenabled=true) and use the HTMLSubset comment formatter - and by required user interaction, while comment moderation, where enabled, delays publication of the malicious comment. Apache rates the issue Moderate (CVSS 3.1: 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and fixed it in 6.1.6 by restricting restored links to http, https and mailto URIs; no public exploit identified at time of analysis.
Stored cross-site scripting in Apache Roller 6.1.5 lets an unauthenticated remote attacker persist a crafted URL in the comment-author field so that script executes in the browser session of a weblog moderator or global administrator who later opens the comment moderation page. The flaw is rated CVSS 3.1 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting unauthenticated submission, required reviewer interaction, and impact scoped to the privileged reviewer's session with no availability loss. No public exploit code has been identified at time of analysis - no public exploit identified at time of analysis - and exploitation is not confirmed actively exploited (CISA KEV); successful abuse requires that the site allow comments on at least one weblog and that a moderator actually review the pending comment in the web UI, but the vendor states no non-default server setting is required.
Stored cross-site scripting in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist a crafted comment-author URL through the incoming Trackback endpoint, which the shipped Trackback verification and moderation defaults approve and render as an active link; a visitor who clicks that link executes attacker-controlled script in the weblog's origin. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attack requires no authentication but does require user interaction, since the payload only fires on click rather than automatically on page load, so it is not a self-executing compromise. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the vendor has released Apache Roller 6.1.6, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links.
Stored cross-site scripting in Apache Roller 6.1.5 allows an authenticated user with media-upload rights to store active content on Roller's origin, which executes when a victim opens the uploaded file. Exploitation is constrained: the media-upload feature is disabled by default, so only non-default installations that enable it are exposed, and the attacker must already hold upload privileges while the victim must actively open the file. No public exploit identified at time of analysis; this is a genuine but low-priority issue given the non-default configuration and required victim interaction.
Sensitive file disclosure in Apache Roller 6.1.5 allows an authenticated weblog administrator (CVSS PR:L) to read arbitrary files on the application classpath - including Roller configuration files that may contain secrets - by authoring a Velocity template that uses the #include or #parse directive to load a resource outside the active theme namespace. Roller's Velocity sandbox does not confine these directives, no non-default configuration is required, and any weblog whose administrator can author templates is affected; no public exploit identified at time of analysis.
Reflected cross-site scripting in Apache Roller 6.1.5 lets remote attackers inject script into the frontpage theme's directory page by supplying a crafted blog-directory parameter that is reflected without proper escaping; the script then executes in the browser of any visitor who follows the crafted link. Only weblogs using the bundled 'frontpage' theme are affected, and exploitation requires the victim to click a malicious link (UI:R) - no credentials are needed to craft or deliver it, but no public exploit code has been identified at time of analysis. The NVD CVSS 3.1 score of 6.1 (medium, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects limited confidentiality and integrity impact confined to the weblog origin, with the theme dependency and mandatory user interaction keeping real-world exploitability below what the network-reachable vector suggests.
Missing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthenticated attackers to post form entries directly to the public submission API, because the password gate is implemented only in front-end JavaScript. An attacker only needs the form key that is exposed in any public share link; no account, no user interaction, and no special configuration are required. Publicly available exploit code exists (a Python PoC targeting the submission endpoint), but there is no indication of confirmed active exploitation (not in CISA KEV), and the impact is bounded to unauthorized submission injection - existing responses cannot be read and availability is unaffected.
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /user/form/data/create, because that endpoint never enforces the form's publish status, time window, quota, or per-IP limits - letting an attacker falsify or inflate collected survey results. The defect requires only a low-privileged TDuck account (CVSS 3.1 PR:L) plus the target form key, is remotely exploitable over HTTP with no user interaction, and is strictly an integrity issue: no confidential data can be read and no denial of service results. Publicly available exploit code exists (a bypass PoC script for the data-create endpoint), but there is no confirmed active exploitation and no CISA KEV listing; independent assessment rates this a genuine but low-severity authorization defect.
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form through 6.0 because the FormThemeController write endpoints enforce neither an administrative role nor ownership of the affected theme resources. The flaw is a missing-authorization (CWE-862) issue reachable by any holder of a valid low-privilege account (CVSS 4.0 vector PR:L, AV:N, AC:L, UI:N) with no confidentiality impact - only integrity and availability effects on themes shared across other users' forms. Publicly available exploit code exists (a proof-of-concept script targeting the theme write path), but there is no confirmed active exploitation in the wild; the NVD score of 5.3 is credible and consistent with this limited, credential-gated impact.
Unauthenticated credential disclosure in X-SpringBoot (yzcheng90) through version 6.0 allows remote attackers to read tenant appKey and appSecret values from the GET /application/manager/select endpoint, which performs no authentication check and applies no field filtering to the response. With those credentials an attacker can drive the affected tenant's configured SMS provider to send arbitrary messages, enabling SMS bombing, cost abuse, and impersonation of the legitimate application. The issue is trivially exploitable - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (vendor score 6.9 under CVSS 4.0) - and publicly available exploit code exists in a GitHub PoC repository; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis. Direct impact is bounded: the disclosure affects SMS credentials and message-sending capability rather than full system compromise.
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
Deserialization of untrusted data in the LangChain4j-agentic module's AgenticScopeSerializer.fromJson path allows an attacker who can already write to an AgenticScope persistence store to trigger arbitrary class instantiation through Jackson's insecure default typing. Affected versions are the 1.5.3, 1.11.10 and 1.18.1 beta lines up to and including 1.5.3-beta10, 1.11.10-beta18 and 1.18.1-beta27, with fixes released in 1.5.3-beta11, 1.11.10-beta19 and 1.18.1-beta28 under advisory GHSA-gmwr-7wmf-mrjm. Publicly available exploit code exists, but effective risk is low: exploitation requires that the application have explicitly enabled AgenticScope persistence (opt-in and off by default) and that the attacker already control the writable backing store, with attack complexity rated high; this issue is not confirmed actively exploited (not in CISA KEV), and EPSS-style scoring is negligible given the reported CVSS base of 2.1.
Authorization bypass in Sanluan PublicCMS up to and including 6.202506.e lets an authenticated administrative user read user and department records outside their authorized scope by tampering with the userId or deptId parameter handled by the exportExcel/exportData functions. Because the server never verifies that the requested identifier falls within the caller's own department or permission scope (CWE-639), a low-privileged backend account can pull exports it should not see; the impact is confidentiality-only with no modification or denial-of-service component. Publicly available exploit code exists (a PoC published in the GitHub CVERequest repository), but the flaw is not confirmed actively exploited (CISA KEV), the vendor did not respond to the disclosure, and no vendor patch is available - making this a low-priority issue despite being remotely reachable.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Server-side request forgery in the chat-server component of songxinjianqwe Chat (ChatServer.java) allows remote, unauthenticated attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs. The flaw is reachable over the network with low complexity and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), but all impact metrics are rated Low (VC:L/VI:L/VA:L) with no downstream-system impact, so practical damage is limited to constrained or blind SSRF-style information leakage and internal-network probing rather than full internal pivoting. Publicly available exploit code exists (referenced from a GitHub issue), and VulDB reports that the vendor was contacted but did not respond; the project uses a rolling release model, so no specific fixed version is documented. Affected deployments are typically hobbyist Java chat-server instances rather than internet-exposed production services.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Authenticated path traversal in the ruoyi-vue-pro (Yudao) WeChat MP material-upload component lets a low-privileged user write files outside the intended upload directory by embedding '../' sequences in a multipart filename passed to getOriginalFilename() in MpMaterialServiceImpl. Versions up to and including the 2026.08 release are affected whenever the yudao-module-mp module is deployed; the CVSS 4.0 base score is 2.1 (our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, i.e. remote but requiring a valid account, with limited integrity impact only). Publicly available exploit code exists per the disclosing researcher, and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.
Information disclosure in O2OA (up to and including 9.5.3 and 10.0.2) lets an authenticated remote attacker read data they should not be able to access by supplying a manipulated fileUrl argument to the list function of the Cipher Connection Handler (CipherConnectionAction.java). The flaw is a CWE-200 exposure of sensitive information rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/E:P), mapped independently to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, low impact, requiring a valid session but no user interaction. Publicly available exploit code exists (a public GitHub issue demonstrates the technique) and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor was contacted but did not respond, and no vendor-released patch has been identified.
Unauthorized read access to book records in TaleLin lin-cms-spring-boot 0.2.1 and earlier is possible through the searchBook function in BookController.java; remote unauthenticated attackers can reach the book endpoint and retrieve records without proper authorization. A publicly available exploit exists, but there is no confirmed active exploitation (CISA KEV) and no vendor patch identified. The 6.9 CVSS 4.0 score reflects a confidentiality-only impact; our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making real-world risk low-to-moderate and dependent on whether the book endpoint is network-exposed.
Improper authorization in TaleLin lin-cms-spring-boot through 0.2.1 lets unauthenticated remote attackers read book records by invoking the getBooks function in BookController.java; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) confirms no privileges or user interaction are required, and impact is limited to confidentiality. Publicly available exploit code exists, and the vendor did not respond to early disclosure, so no vendor-released patch was identified at time of analysis. This is a real but low-severity issue that should be triaged as low-to-moderate priority, with the primary limiting factors being the product's rarity and the read-only scope of the exposure.
Missing authorization in Jivejdon's UpdateThreadToForumAction (present from commit d58a36b0 through commit ee67a65e) lets any authenticated user relocate another user's forum thread into an arbitrary forum by submitting crafted threadId and forumId values to /message/threadToForum/save. The flaw stems from an absent ownership or role check in the action handler (CWE-862), and it is constrained in practice because only threads with no replies can be moved and the attacker must already hold a valid account, so impact is limited to integrity (thread relocation) with no confidentiality or availability loss and a CVSS 5.3 / CVSS:3.1 5.3 rating. There is no public exploit identified at time of analysis and no confirmed active exploitation, so this is a modest-severity issue rather than an urgent one.
Proxied plaintext WebSocket (ws://) requests issued through AsyncHttpClient before 3.0.12 or 2.16.1 leak the configured proxy's credentials to the origin WebSocket server. When an HTTP proxy requiring authentication is in use, the tunneled ws:// upgrade is built with the proxy's Proxy-Authorization header and an absolute-form request target, so the origin endpoint operator - or any party able to observe origin-bound traffic - can recover Basic credentials directly or capture a Digest challenge-response for offline cracking or replay. Exploitation depends on a non-default configuration (an authenticated HTTP proxy plus an application-initiated ws:// request), yields only proxy credentials rather than user or application data, and is rated CVSS 3.1 base 5.9; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Improper verification of the WebSocket opening handshake in AsyncHttpClient (AHC) versions prior to 3.0.12 and 2.16.1 lets a malicious or man-in-the-middle WebSocket endpoint have frames decoded and delivered to the application's WebSocketListener even though the server's Sec-WebSocket-Accept value was missing or invalid and the 101 upgrade was never authenticated. Only Java applications that use the WebSocketUpgradeHandler on an affected AHC release and connect to an attacker-controlled or intercepted endpoint are exposed, and because the request future still fails and the channel is closed the window for delivering coalesced frames is narrow and the impact is limited to integrity of listener-delivered data. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, consistent with its low CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
HTTP Digest authentication in AsyncHttpClient (Java) prior to 3.0.12 and 2.16.1 derives the client nonce (cnonce) from ThreadLocalRandom rather than a cryptographically secure source, weakening the Digest exchange against chosen-plaintext and credential-precomputation attacks for an observer who can infer generator state. The issue is rated CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), so per the assessed vector no authentication is required from a remote attacker, but exploitation is statistical and high-complexity rather than a direct exploit. Only applications that use AsyncHttpClient's Digest auth via Realm.Builder are affected; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV is not indicated).
Cross-origin cookie injection in AsyncHttpClient (AHC) Java library before 3.0.13 and 2.16.1 allows an attacker-controlled host beneath a registry-level public suffix such as co.uk to set a cookie for that suffix itself, which the shared ThreadSafeCookieStore then replays to unrelated hosts under the same suffix. The failure lies in ThreadSafeCookieStore, which performs domain matching but never applies the RFC 6265 Section 5.3 step 5 rule that rejects a Domain attribute naming a public suffix; the practical result is that session-relevant cookie values can be injected or overwritten across origins sharing that registry. Impact is integrity-only (I:H, no confidentiality or availability loss) and exploitation is scenario-dependent, requiring one cookie store shared across requests to both an attacker host and a victim host under the same suffix, which is why the assessed vector carries High attack complexity and a present Attack Requirement. No public exploit code or active exploitation was identified at time of analysis; fixes are released as version 3.0.13 and 2.16.1.
AsyncHttpClient (AHC), a Java library for asynchronous HTTP requests, contains an incomplete cookie Domain validation flaw in its ThreadSafeCookieStore: from 2.16.0 through 2.16.1 and from 3.0.11 through 3.0.13, the store fails to apply private-section and default public-suffix rules, A-label (IDN) normalization, locale-independent lowercasing, and proper host-only and numeric/IP host checks, so a cookie set by one origin can be stored and later replayed to a different origin. Applications that share a single client instance across distinct trust domains can therefore receive attacker-injected cookies and may be exposed to session fixation; the assessed impact is integrity-only (CVSS 3.1 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) with no data disclosure. Exploitation is constrained by a non-default deployment pattern (per-origin or per-trust-boundary clients are not affected) and by the attacker needing to control or inject a Set-Cookie response from one of the shared origins; no public exploit code was identified at time of analysis, and the vendor has released a fix in version 3.0.14.
Cookie-store handling in AsyncHttpClient (AHC) versions 2.1.0 through 2.16.1 and 3.0.0 through 3.0.13 lets a shared client instance attach one user's stored cookies to another user's request, causing the outbound request to execute under the wrong session. The enabled-by-default cookie store replaces a Cookie header set explicitly via setHeader or addHeader whenever the store holds any cookie for the origin, a gap that survives the earlier CVE-2024-53990 fix (which only covered cookies supplied through addCookie). Exploitation is conditional rather than broadly weaponizable: it requires a multi-tenant shared client, an authenticated participant (CVSS PR:L), at least one caller supplying the Cookie header directly, and a stored cookie for the same origin, with timing/ordering dependence reflected in the high attack complexity (AC:H) of the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N vector; no public exploit identified at time of analysis and no CISA KEV listing. A vendor-released patch, version 3.0.14, is available.
Denial of service in yawkat lz4-java before 1.11.2: an attacker who can feed compressed bytes into LZ4DecompressorWithLength's buffer-allocating decompress methods can exhaust JVM heap. A five-byte payload whose four-byte length header declares a huge output causes the library to allocate up to roughly 2 GiB before it validates the compressed data, resulting in OutOfMemoryError and transient heap pressure. The flaw is remotely triggerable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but availability-only with low impact (C:N/I:N/A:L), yielding a 5.3 score; no public exploit code was identified at time of analysis, and the vendor-released fix is version 1.11.2.
Heap exhaustion in the yawkat LZ4 Java library before 1.11.2 allows remote denial of service: net.jpountz.lz4.LZ4BlockInputStream.refill() checks that the compressedLen field of a legacy LZ4Block header is nonnegative but then allocates a compressed-input buffer of exactly that attacker-controlled size before any payload is read. Because each header is only a handful of bytes, a header-only stream can request a near-2 GiB allocation and crash the JVM with OutOfMemoryError, affecting any application that decompresses attacker-influenced LZ4 legacy-block data with the default reader configuration; no public exploit code or active exploitation was identified at time of analysis (CVSS 5.3, availability-only impact). The flaw is fixed in version 1.11.2, which rejects non-canonical oversized blocks by default.
Denial of service in LZ4 Java (lz4-java) prior to 1.11.4 allows unauthenticated remote attackers to exhaust memory and CPU by supplying a crafted LZ4 frame stream to net.jpountz.lz4.LZ4FrameInputStream in its default concatenated-frame mode; each minimal empty maximum-block-size frame forces readHeader() to allocate two 4 MiB block buffers (roughly 8 MiB per 11 input bytes) with no decompressed output, so decompressed-size limits do not mitigate the issue. The vulnerability is moderate severity (CVSS 5.3, A:L) and is fixed in 1.11.4; readSingleFrame mode is not affected, and no public exploit or KEV entry has been identified at time of analysis.
Uncontrolled recursion in yawkat LZ4 Java's net.jpountz.lz4.LZ4BlockInputStream can crash the decoding thread: when the stream is explicitly configured with stopOnEmptyBlock set to false, each well-formed empty LZ4 block causes refill() to call itself recursively, so an attacker-supplied compressed stream containing a long run of empty blocks drives the stack to exhaustion and throws StackOverflowError. Only applications that both use LZ4BlockInputStream with the non-default stopOnEmptyBlock=false setting and feed it attacker-controlled or injectable compressed data are exposed; the default stopOnEmptyBlock=true is not affected, no authentication or user interaction is required under those conditions (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the decoding thread with no memory corruption, confidentiality, or integrity effect. There is no public exploit identified at time of analysis and the flaw is fixed in version 1.11.4.
Stored cross-site scripting in the Class2HTML report generator shipped with Apache Commons BCEL before 6.13.0 lets attacker-controlled strings from a Java class file (class, field and method names, constant-pool entries, attribute values and anchors) be written into generated HTML reports without escaping, so script executes in the browser of anyone who opens the report. The issue is unauthenticated (CVSS 4.0 PR:N) but highly conditional: the deployment must actually use the Class2HTML/AttributeHTML/CodeHTML/ConstantHTML utilities to render HTML from class files an attacker can influence, and a victim must then open the resulting report (UI:P), which is why the CVSS 4.0 base score is only 2.3 because attack requirements are present (AT:P) even though the independent assessment rates the same flaw 7.1 under CVSS 3.1 with scope change (S:C). This is not reachable through ordinary BCEL bytecode parsing or manipulation; no public exploit has been identified at time of analysis and the flaw is fixed in 6.13.0.
RabbitMQ Java Client library releases prior to 5.35.0 can leak plaintext broker credentials because ConnectionFactoryConfigurator.load() wraps AMQP URI parsing failures in IllegalArgumentException messages that contain the raw amqp://user:pass@host URI. Any application that supplies credentials inside the connection URI and then hits a setup error - malformed URI syntax or a TLS NoSuchAlgorithmException/KeyManagementException - will write those credentials into startup logs, APM dashboards, CI output, or copied stack traces, where users without broker access may read them. This is a genuine but low-urgency credential-disclosure issue rather than a widely-exploitable critical flaw: exploitation is passive and conditional, requires the attacker to already have read access to the log sink, and only affects the configurator load() path where credentials are embedded in the URI. No public exploit identified at time of analysis; the vulnerable behavior is fixed in version 5.35.0, and the CVSS 4.0 score of 5.7 (AV:L/AC:L/AT:P/PR:L, VC:H) reflects that local, low-privilege, log-reading access with specific preconditions is needed.
Malformed UTF-8 echoed back through an AMQP shortstr property can permanently disable RPC consumers built on the RabbitMQ Java client before 5.36.0, forcing the affected consumer to fail on every redelivery of a single poison message. An attacker with low-privileged broker access publishes a request whose property value (for example correlation-id) contains invalid UTF-8; ValueReader.readShortstr decodes those bytes into U+FFFD replacement characters, which re-encode to more than the 255-byte AMQP shortstr limit that ValueWriter.writeShortstr enforces, so reply publication throws an unchecked exception. In RpcServer.mainloop() and tutorial-style echo consumers that exception aborts the loop before acknowledgement, the broker requeues the message, and the consumer is stuck until the queue is purged. No public exploit identified at time of analysis; impact is confined to availability of the target consumer (reported CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution, authentication bypass, or data exposure.
Improper authorization (CWE-285) in jshERP through version 3.5 allows an authenticated, low-privileged user to manipulate financial receipt records by invoking the updateAccountHeadAndDetail function in AccountHeadService.java, which fails to enforce proper permission checks. The flaw is remotely exploitable with low attack complexity and no user interaction (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N), but exploitation requires a valid low-privilege account, so the practical risk is insider abuse or misuse of any obtained credentials rather than unauthenticated external compromise. Impact is limited to integrity and availability of financial receipt data (VI:L/VA:L) with no confidentiality exposure, and publicly available exploit code exists (referenced in GitHub issue 167); the vendor was notified via an issue report but has not responded, and no vendor-released patch was identified at time of analysis.
Improper authorization in SpringBlade up to 5.0.1 allows an authenticated remote user to access role or user detail records they do not own by manipulating the ID parameter in the RoleController User Detail endpoint. The flaw is a CWE-285 improper authorization issue (insecure direct object reference) that affects only confidentiality, with no integrity or availability impact and no code execution; publicly available exploit code exists, and no CISA KEV listing is present. The independent assessment rates this as a moderate, not urgent, priority, and notes that while the CVSS vector indicates high privileges (PR:H), the practical privilege level may be lower because any logged-in user could likely exploit the IDOR.
Improper authorization in the SpringBlade Java microservice framework (all versions up to 5.0.1) lets an authenticated user holding high privileges manipulate the initPassword argument exposed by the Parameter Submit Management controller (ParamController) and change system parameters they should not be able to control. The endpoint is remotely reachable, but exploitation requires an existing elevated session with no user interaction, and the assessed impact is LOW across confidentiality, integrity and availability (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and the project has not responded to the issue report, so no vendor-released patch is available at time of analysis.
Server-side request forgery in Penpot before 2.18.0 allows an authenticated user who controls a media-import URL, or an administrator who controls a webhook URL, to reach internal and cloud-metadata endpoints by supplying IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, or Teredo 2001:0000::/32) that embed a blocked IPv4 destination such as 169.254.169.254, 127.0.0.1, link-local, or RFC1918 addresses. The bypass works because the backend blocklist app.util.ssrf/blocked-address? applies its extra CIDR checks only to IPv4 values and relies on Java InetAddress predicates that do not classify transition-mechanism addresses; exploitation further requires the request to traverse a NAT64 gateway or the attacker to control a DNS AAAA record the Penpot server resolves, with cloud environments that already run DNS64/NAT64 directly exploitable, while non-NAT64 deployments depend on the harder attacker-controlled AAAA path. Media import can disclose response bodies, whereas webhook delivery exposes only response status as a network-probing side channel, and there is no public exploit identified at time of analysis. Penpot 2.18.0 is the vendor-released fix (commit 326d83e780ae120b45ccd6f3d7bd24922b54461c).
Denial of service in the Apache Struts REST plugin affects Struts 2.1.8 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0: a remote unauthenticated request with an oversized body is read into memory without any size bound, letting a single request exhaust the Java heap and deny service to other users. Exposure is limited to applications that actually deploy the optional REST plugin and accept request bodies - Struts core is unaffected, and the vendor confirms that no additional setting has to be enabled for a default REST-plugin deployment to be reachable, while form submissions and multipart uploads are not parsed by the affected code path. No CISA KEV listing, public exploit code, or EPSS score was present in the source data, so active exploitation is not confirmed; vendor-fixed releases 6.12.0 and 7.4.0 cap request bodies at 2 MB (2,097,152 characters) by default.
Unlimited credential-guessing against the linlinjava litemall admin login endpoint is possible because the application imposes no lockout, throttling, CAPTCHA, or failed-attempt limit on the AdminAuthController in the litemall-admin-api module (CWE-307), affecting versions up to and including 1.8.0. A remote, unauthenticated attacker (CVSS 4.0 vector PR:N) can repeatedly submit password guesses, but exploitation is rated difficult and high-complexity: the flaw only removes the brute-force barrier rather than bypassing authentication, so it still depends on weak, default, or guessable admin credentials and on the admin-api component being deployed and network-reachable. Publicly available exploit code exists, and the vendor has not responded to the issue report; impact is confined to low confidentiality with no integrity or availability effect, making this a genuinely low-priority issue despite the public documentation.
SQL injection in RainyGao DocSys (up to version 2.02.85) allows an attacker to inject arbitrary SQL through the 'url' argument handled by BaseController.createDBForMysql in the Database Management component, potentially exposing or altering backend data. Publicly available exploit code exists, and the CVSS 4.0 vector scores the issue 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with E:P), while an independent assessment using CVSS 3.1 rates it AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact - the discrepancy regarding privilege requirements reflects the fact that the vulnerable function configures a MySQL connection, an action that in practice is reached from the DocSys management interface and may require an authenticated or administrative session. The vendor was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Bouncy Castle for Java before 1.86 leaks secret-derived information from its HQC post-quantum KEM through two side channels, allowing a local attacker who can observe CPU cache behaviour or precisely measure decapsulation timing to recover information about the HQC private key. Only deployments that actually perform HQC encapsulation or decapsulation on the affected library are exposed, and exploitation requires either code co-resident on the same physical host or many carefully controlled timing measurements, so isolated single-tenant hardware largely neutralises the cache channel. There is no public exploit identified at time of analysis; this is a genuine cryptographic weakness but a comparatively low-urgency operational priority, and a vendor fix is available in version 1.86.
Key-size validation bypass in Bouncy Castle for Java before 1.86 (and Bouncy Castle for Java FIPS before bcpkix-fips 2.0.13 / 2.1.13) allows a key-transport EnvelopedData or AuthEnvelopedData message whose HKDF-derived content-encryption key does not match the advertised content-encryption algorithm to be accepted even when the application has explicitly enabled org.bouncycastle.cms.jcajce.JceKeyTransRecipient.setKeySizeValidation(true). The defect is confined to messages using RFC 9709 CEK derivation (id-alg-cek-hkdf-sha256); messages with a matching key size, non-HKDF messages, and recipients that never enable validation are unaffected, and the opt-in control is off by default, so this is a medium-severity defense-in-depth failure rather than a direct decryption or key-recovery primitive. Unauthenticated remote attackers who can supply CMS content to an application that has enabled the control can silently defeat the only mechanism the API offers for enforcing recovered key size; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor-released patch is available.
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Path traversal in Logback-classic (0.9.14 through 1.6.4) allows remote unauthenticated attackers to create and append log files outside the intended directory when a FileAppender path is built from an attacker-influenced MDC value, such as an HTTP header. Exploitation requires a non-default configuration where a SiftingAppender uses an MDC discriminator for the file path; no public exploit identified at time of analysis, and the vendor has released a patch in version 1.6.5. The reporter assigned a CVSS 4.0 score of 6.3, reflecting medium severity with limited integrity and availability impact.
Unbounded key-derivation cost parameters in Bouncy Castle for Java before 1.86 allow a denial of service against applications that parse attacker-influenced cryptographic structures: PBKDF2 iteration counts, derived-key lengths, scrypt parallelization factor p, and OpenSSH v1 bcrypt round counts were read straight from untrusted input and used to drive the KDF before any password or MAC verification could reject the data. Affected code paths include the RFC 9579 PBMAC1 MAC calculator builders (JcePBMac1CalculatorBuilder, PKCS12PBEUtils.createPBMac1Calculator reached via PKCS12PfxPdu.isMacValid), the PKCS#8/PKCS#12 scrypt cost guards, the raw JCA PBKDF2 provider, and OpenSSH v1 private-key parsing in Bouncy Castle for Java, LTS (before 2.73.13) and FIPS (bcpkix-fips before 1.0.13 / 2.0.13 / 2.1.13). Impact is availability-only (CVSS:4.0 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L): exploitation requires the victim application to passively process a malicious blob and is unauthenticated (PR:N), but no key material or data is exposed, and there is no public exploit identified at time of analysis.
Missing authentication in the Instant Buy component of ZongXR SuperMarket 1.0.0.0 lets remote attackers invoke the startBuy function without proving a valid session, simply by manipulating the Username argument passed to InstantBuyController.java. Impact is limited to integrity and availability at low severity (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no confidentiality loss, and publicly available exploit code exists though there is no confirmation of active exploitation. The authentication prerequisite is ambiguous - the CWE-306 classification and description imply no credentials are needed, while the vendor's CVSS 4.0 vector encodes low-privilege (PR:L) access - so the true auth requirement should be treated as unconfirmed. Real-world risk is low primarily because this is an obscure hobby/open-source project that is rarely exposed in production.
Unauthenticated remote attackers can delete arbitrary order records in ZongXR SuperMarket 1.0.0.0 because the OrderController.deleteOrder endpoint lacks authentication checks (CWE-306). Publicly available exploit code exists (GitHub issue #31), and the project maintainer has not responded to the report. With a CVSS 4.0 score of 6.9 (medium) and an independent assessment confirming only low integrity and availability impact, the vulnerability poses a low-to-moderate risk, primarily limited by the product's rare deployment in production environments.
Missing authentication in the ZongXR SuperMarket 1.0.0.0 order-save endpoint (OrderController.addOrder) allows unauthenticated remote attackers to submit order actions while passing an arbitrary userId argument, letting them act on behalf of other accounts without any credentials. The root cause is CWE-306: the handler performs no authentication check at all, so the caller-supplied userId is implicitly trusted. Publicly available exploit code exists (documented in the project's own GitHub issue #32), but real-world priority is low because SuperMarket is a niche, non-production Java project with no large-scale enterprise deployment footprint - the practical limit is whether an instance is network-reachable, and no privileges or user interaction are required (CVSS:4.0 PR:N/UI:N; our assessment scores it AV:N/AC:L/PR:N/UI:N with limited integrity impact, C:N/I:L/A:N).
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
SQL injection in risesoft-y9 WorkFlow-Engine (all versions up to and including 9.6.10) lets a remote attacker manipulate the 'year' and 'processInstanceId' arguments passed to the getByIdAndYear function of CustomHistoricProcessServiceImpl.java, with two independent injectable sink positions rather than one. Publicly available exploit code exists (there is no CISA KEV listing, so active exploitation is not confirmed), and the vendor was contacted early but never responded or shipped a fix. The vendor-supplied vector rates the flaw unauthenticated (PR:N), while the independent assessment scores it PR:L because the affected code path sits behind the product's OAuth2 Resource Filter and may require a valid access token; defenders should determine whether the endpoint is reachable before authentication. Impact is bounded (low confidentiality, integrity and availability), so this is a low-to-moderate real-world risk that hinges on whether a given self-hosted instance is internet-exposed.
Memory exhaustion in the sshd-sftp component of Apache MINA SSHD (1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets an authenticated remote SFTP client crash the server by driving the SFTP v6 check-file-name/check-file-handle extension to build an oversized reply entirely in server memory. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the session must be authenticated and must negotiate SFTP protocol version 6, and the attacker must point the request at a very large (possibly sparse) file using a tiny block size such as the 256-byte minimum, so that file-size divided by block size yields an enormous number of hashes; availability impact is high while confidentiality and integrity are unaffected. This is a genuine but bounded availability risk with no public exploit identified at time of analysis, and deployments that already cap SFTP message size (typically 256kB, as OpenSSH does) are not exposed.
Memory exhaustion denial of service in Apache MINA SSHD's SCP subsystem (module sshd-scp) affects all releases before 2.20.0 and the 3.0.0-M1 through 3.0.0-M5 milestones, requiring a connected SSH peer that has reached the SCP protocol handler - on a server deployment this typically means successful low-privilege authentication, which is the main gating factor (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium). The peer only needs to stream a single malformed SCP command line that never terminates with an LF, causing the handler to buffer the endless input until the JVM throws OutOfMemoryError and the application crashes; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is a bounded availability issue for deployments that expose or use the SCP subsystem.
Improper input validation in the sshd-git component of Apache MINA SSHD lets authenticated SSH clients write arbitrary files onto the server by invoking 'git archive' with the single-argument '-o=file.zip' form. Only deployments that use GitPgmCommandFactory to expose remote JGit command execution to SSH clients are affected, and the attacker must hold valid SSH credentials (PR:L), so impact is a conditional integrity violation (C:N/I:H/A:N, CVSS 6.5) rather than a confidentiality or availability compromise. The flaw is an incomplete fix for CVE-2026-58624, which restricted git subcommands but missed the '-o=file.zip' variant; no public exploit code and no confirmed active exploitation were identified at time of analysis, and fixed releases are available (2.20.0 and 3.0.0-M6).
SQL injection in mahonelau kykms (rolling release up to commit 8f130c2d85842d5b44caae78cc46d65e505949f7) allows remote attackers to inject arbitrary SQL through the column argument of QueryGenerator.doMultiFieldsOrder, a multi-field ordering routine in the SqlInjectionUtil component. The flaw is CWE-89 improper neutralization of SQL commands and, because the injection lands in an ORDER BY clause, exploitation is typically limited to blind/boolean or error-based extraction rather than direct UNION dumping. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation at time of analysis. The provided CVSS 4.0 vector claims network reachability with no privileges (PR:N) and no user interaction, yet the independent assessment notes that JeecgBoot-style deployments commonly authenticate sortable data-query endpoints, so a valid session may be required in practice - verify against the specific kykms build.
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow definitions across project boundaries through the batch-copy and batch-move endpoints, which omit the project-level permission check. Exploitation requires a valid account on the instance with access to at least one project but without the required permissions on the targeted projects, and the effect is limited to low confidentiality and integrity impact (cross-project workflow manipulation) with no availability or code-execution impact; there is no public exploit identified at time of analysis and no confirmed active exploitation. Because the flaw matters mainly in multi-tenant or shared deployments with untrusted tenants, the aggregate signals place it at LOW-to-MEDIUM priority, but organizations relying on DolphinScheduler project isolation as a security boundary should patch promptly.
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permission on a project to modify workflow instances inside that same project by sending a request to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to enforce the write permission the operation requires. The flaw is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning remote, authenticated, low-complexity exploitation with a limited integrity impact and no confidentiality or availability impact; the attacker must already possess valid credentials and read access to the target project, so exposure is largely limited to insiders or compromised low-privilege accounts. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so it should be treated as a genuine but low-severity authorization bug rather than an urgent, actively exploited threat; upgrading to 3.4.3 fully remediates.
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privilege user read workflow information belonging to projects they are not authorized to access by calling the query-dynamic-sub-workflows API endpoint, which authenticates the caller but omits the project-scope authorization check (CWE-863). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring a valid account, with impact confined to confidentiality and no write or code-execution path. Exploitation also presumes the attacker knows or can guess workflow references in the target project, and it only matters where project-level isolation is treated as a security boundary (multi-tenant or multi-team deployments); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected Spring Boot Actuator endpoints by sending requests whose paths contain percent-encoded characters, causing the application's path-based authorization check to fail to match the request against its protected Actuator path list. Successful exploitation exposes operational and configuration data (for example environment properties or configuration beans) and, where sensitive or write-capable Actuator endpoints are enabled, potentially management functionality; the assessed vector is AV:N/AC:L/PR:N/UI:N with high confidentiality and low integrity/availability impact, so no credentials or user interaction are required. No CVSS score or vector was published by NVD or Apache and no public exploit code was identified at time of analysis, though the technique is a well-understood class of path-matching evasion and exploitation is trivial once a reachable instance is found. Real-world severity is bounded by which Actuator endpoints the deployment exposes.
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/unauth-datasource endpoint and retrieve configuration and metadata for data sources they are not authorized to see. As assessed, exploitation requires a valid low-privileged account and network reachability to the web application (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and it is most impactful in multi-tenant deployments where data sources are meant to be isolated between users; the breadth of leaked fields is not specified by the vendor, so confidentiality impact depends on the deployment. There is no public exploit identified at time of analysis and no evidence of active exploitation.
Improper authorization in the api-admin backend of realjerrytang tacomall 1.0.0 lets remote attackers create organization-staff records with attacker-controlled isAdmin and jobId values, bypassing the privilege checks that OrgStaffServiceImpl.add is supposed to enforce. Publicly available exploit code exists (a GitHub proof-of-concept walking through the crafted request), and the upstream advisory assigns a CVSS 4.0 score of 6.9 with an E:P (proof-of-concept) exploit-maturity rating; the flaw is not listed in CISA KEV, so there is no confirmation of active exploitation. Our independent assessment is more conservative on prerequisites and impact, rating the issue low priority: exploitation realistically requires at least a low-privileged authenticated session on the management API rather than anonymous access, and confidentiality, integrity, and availability impacts are all limited given the niche open-source codebase and small deployment base.
Missing authorization in REBUILD up to 4.4.11 allows unauthenticated remote attackers to manipulate the url or fileKey parameter sent to /commons/file-editor-save, enabling unauthorized read and write actions against the file-editor resource. Publicly available exploit code exists, but no fixed version has been published and the vendor did not respond to the disclosure. The issue is medium severity with low confidentiality, integrity, and availability impact; priority depends on whether the Rebuild web interface is exposed.
Rebuild instances up to and including 4.4.7 and 4.5.0-beta5 expose a login endpoint (/user/login) that fails to properly validate authentication, allowing unauthenticated remote attackers to bypass the intended login control (CWE-287). Exploitation requires no credentials, no user interaction, and low complexity (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), so any internet- or network-reachable Rebuild login page in its default configuration is a viable target. Publicly available exploit code exists and the vulnerability is documented by VulDB with a linked GitHub POC, but it has not been confirmed as actively exploited (not in CISA KEV); all impacts are rated Low, so successful abuse appears to yield partial access rather than full administrative takeover. The vendor was contacted but did not respond, and no vendor-released patch has been identified, making exposure reduction the primary near-term defense.
Disabled mall4j accounts (through 4.0) can indefinitely renew their sessions by calling POST /token/refresh, because the refresh flow issues a new token without re-checking the account's enabled flag, letting a user that an administrator deactivated retain the access they already had. The attacker must already hold a valid, non-expired refresh token obtained before deactivation, so this is an authenticated access-control persistence flaw (CVSS 5.3, CWE-613), not an unauthenticated bypass or a route to new accounts. Publicly available exploit code exists (a proof-of-concept Python script), but no active exploitation has been confirmed (not in CISA KEV), and the practical impact is limited to preserving prior access rather than escalating privileges.
Vertical privilege escalation in mall4j through 4.0 lets any self-registered storefront customer reach back-office administrative endpoints - including menu listings, file uploads, and configuration routes - by presenting the same sa-token session that was issued for the customer storefront. The flaw (CWE-287 improper authentication) is that the session validation layer never checks the sysType field that is supposed to separate customer from admin identity, so only endpoints already guarded by @PreAuthorize remain safe. Independently assessed at CVSS 5.3 with limited confidentiality and integrity impact, this is a genuine but moderate-priority privilege-escalation bug; publicly available exploit code exists, and there is no KEV-listed evidence of confirmed active exploitation.
Unauthenticated shipment-tracking disclosure in mall4j through version 4.0 lets remote attackers retrieve carrier names, waybill numbers, and full logistics trails for any order by calling the yami-shop-api DeliveryController checkDelivery endpoint with an order number and no credentials. Because the handler performs neither authentication nor ownership verification, any caller who can supply a valid order number - and sequential or guessable numbering would permit enumeration - can harvest tracking data in bulk. Publicly available exploit code exists (a proof-of-concept Python script), but the issue is not confirmed as actively exploited; per the independent assessment this is a real but low-to-moderate priority information-disclosure problem, since impact is limited to confidentiality of shipment metadata with no integrity or availability effects.
Unauthenticated attackers can delete arbitrary product reviews in mall4j through 4.0 by sending DELETE requests to the /prodComm endpoint in ProdCommController, which applies no authentication or authorization checks to the prodCommId parameter (CWE-306). Publicly available exploit code exists, and no credentials or user interaction are required; the only prerequisite is knowing or enumerating a valid review ID. The impact is limited to integrity tampering with review records, with no confidentiality or availability loss assessed in our independent review, making this a low-severity data-tampering issue rather than a high-impact compromise.
Information disclosure in Eleveo Quality Management 9.7.0 allows an authenticated low-privilege remote attacker to read sensitive data via the createAndSaveAudit function of the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Publicly available exploit code exists, but exploitation requires a valid session and network access to the web tier, and the impact is limited to confidentiality with no integrity or availability effect. No vendor patch has been identified; the vendor did not respond to the disclosure.
LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Username argument of the User Management endpoint /callrec/userAddAction.do so that unsanitized input is incorporated into an LDAP directory query, resulting in low-impact disclosure of directory information. The attack is reachable remotely and requires no user interaction, but it is gated behind a valid low-privilege account and a deployment whose user management is backed by an LDAP directory. Publicly available exploit code exists, including a proof-of-concept linked from the VulDB disclosure, and the vendor was contacted but did not respond; EPSS and CISA KEV do not indicate confirmed active exploitation. With a CVSS 5.3 base score and confidentiality-only impact (C:L, no integrity or availability effect), this is a high-CVSS-appearance-but-modest-real-risk issue.
Path traversal in the Scorecard.jsp endpoint of Eleveo Quality Management 9.7.0 allows an authenticated remote attacker with a valid low-privilege session to escape the intended audio-upload directory of the Questionnaire Audio Upload component and read or write files within the web server's access rights. Publicly available exploit code exists, including a proof-of-concept archive linked from the disclosure, so the technique is reproducible by anyone who can first obtain application credentials; there is no CISA KEV listing or other confirmation of active exploitation. Impact is bounded to low confidentiality, integrity, and availability rather than remote code execution, and the vendor was contacted about the disclosure but did not respond.
Reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 lets an attacker inject script through the viewRoleId or cfType parameter of the Play Audio Page endpoint /callrec/audio.jsp, executing in the browser of any user who opens a crafted link. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, base 5.1) shows the attack is network-reachable but constrained: a low-privilege authenticated account is required and a legitimate user must interact with the link, so it is neither unauthenticated nor zero-click, and the assessed impact is limited to integrity (VI:L) with no confidentiality or availability effect recorded. Publicly available exploit code exists and the vendor did not respond to disclosure, so no patched version is available and deployed 9.7.0 instances remain exposed.
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that instantiate the two-argument handler constructors) allow a remote attacker to exhaust server heap memory by posting an oversized body - or a chunked body without a Content-Length header - to the agent context path, causing a denial of service. The issue affects ag-ui releases up to 2026-09-23 and is rated low-to-moderate (CVSS 4.0 base 5.3; our independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the handler's lack of built-in authentication means the practical privilege requirement depends on how each deployment fronts the endpoint; an upstream fix exists as pull request #2671 but is not yet merged/accepted.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Stored cross-site scripting in zhistaredu StarTraining 3.8.1 and earlier lets an authenticated user upload a file whose MIME type is misclassified by MimeTypeUtils.java, so the content is stored and later rendered as HTML/script in a victim's browser; the attacker's script then executes in the context of the StarTraining web application. Exploitation requires a valid account with access to the Upload Endpoint plus a second user who views the uploaded content, and publicly available exploit code exists. This is a low-real-risk issue despite being a network-reachable stored XSS: the vendor was contacted but never responded, and no vendor-released patch has been identified, so the practical severity is bounded by the credential and user-interaction prerequisites.
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filter is switched off by setting xss.enabled to false in the application.yml configuration file. This issue is not independently exploitable: it is a defense-in-depth gap that amplifies the companion injection flaw CVE-2026-100880, and both must be present for an attack to succeed. Exploitation requires authenticated low-privilege access (PR:L) and victim interaction (UI:P) and is rated as highly complex, with the vendor assigning a CVSS base of 2.1; publicly available exploit code exists (published via the ArrestX StarTraining advisories repository), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate privileges by manipulating the userId/roleIds parameters sent to the authRole endpoint, because the SysUser.isAdmin authorization logic trusts caller-supplied identifiers instead of the authenticated principal. Publicly available exploit code exists (published in the ArrestX StarTraining advisories repository as ST-VULN-004), but there is no evidence of confirmed active exploitation, and no vendor patch has been released. Independent assessment classifies this as a genuine but low-priority issue: exploitation requires a valid low-privileged account, the affected product has a very small footprint, and mitigation currently depends on access controls.
Resource exhaustion in Elasticsearch allows an authenticated high-privilege user to consume excessive node resources, causing denial of service through availability loss (CVSS 4.9). Affected deployments are all Elasticsearch versions before the vendor-fixed releases 8.19.22, 9.4.7, and 9.5.3, as reflected by the CPE wildcard and Elastic Security Advisory ESA-2026-184. Exploitation requires an authenticated account with high privileges (CVSS PR:H) and network access to the cluster API; there is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV). Impact is limited to availability, with no confidentiality or integrity effect, and realistic risk is confined to malicious insiders or attackers who already hold privileged credentials.
Authenticated denial of service in Elasticsearch lets a valid low-privilege account drive the node or cluster into uncontrolled resource consumption through an allocation-heavy request path, degrading or halting availability (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Only users holding at least a low-privileged, network-reachable API account can trigger it - an unauthenticated remote attacker cannot, and there is no confidentiality or integrity impact. Elastic rates this a genuine but modest-severity availability issue rather than a top-tier priority: no public exploit code has been identified at time of analysis, no CISA KEV listing applies, and the advisory does not name the specific endpoint or query construct that acts as the allocation sink. Vendor-released patches exist in Elasticsearch 8.19.22, 9.4.7, and 9.5.4 (ESA-2026-183).
Denial of service in Elasticsearch is possible because of uncontrolled resource consumption (CWE-400) that allows an authenticated user to drive excessive allocation and exhaust cluster resources. Elasticsearch deployments prior to 9.4.7 and 9.5.4 are affected; the issue is remote and low-complexity but requires valid low-privilege credentials or an API key (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), and the impact is limited to availability with no data disclosure or modification. There is no public exploit identified at time of analysis and no confirmed active exploitation, and the vendor-scored severity of 6.5 places this as a moderate availability-only issue rather than a top-tier priority.
Denial of service in Elasticsearch allows a network-reachable, low-privilege authenticated user to exhaust cluster resources through excessive allocation, degrading availability down to a full outage while leaving data confidentiality and integrity intact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The flaw is an uncontrolled resource consumption bug (CWE-400 / CAPEC-130 Excessive Allocation), and the CPE record lists elastic:elasticsearch without version constraints, so every unpatched Elasticsearch deployment is presumed affected pending the vendor advisory ESA-2026-176. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires valid low-privilege credentials (a low-tier user, service account, or API key), which limits the population of attackers able to trigger it. The specific endpoint, query type, or configuration that produces the excessive allocation is not named in the available data describing the flaw and must be confirmed against the Elastic advisory.
Unauthenticated remote attackers can desynchronize HTTP/1.1 response parsing in Netty's HttpServerCodec (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.16.Final and all versions up to and including 4.1.136.Final by pipelining a GET carrying 'Expect: 100-continue' immediately followed by a HEAD request on the same keep-alive connection. Because the codec pairs each outbound response - including the 100 Continue informational response - with a queued inbound method via pollMethod(), the GET's 200 OK is matched to HEAD and its entity body is dropped, while the following 200 OK (intended for HEAD) is emitted with a body; this misattributes content across responses, enabling response splitting and unsafe reuse of the connection. It is a genuine but moderate-priority integrity flaw (vendor CVSS 4.0 score 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no public exploit identified at time of analysis and vendor-released patches available in 4.2.17.Final and 4.1.137.Final.
Routing and access-control bypass in Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final allows a remote unauthenticated attacker to send a single HEADERS frame with conflicting :authority and host header values, causing different components in a multi-component request path to make inconsistent decisions. This moderate-severity integrity issue is fixed in 4.2.18.Final; no public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in Apache Roller 6.1.5 lets unauthenticated remote attackers inject script into the HTML form rendered by the optional LdapCommentAuthenticator, which writes request parameter values into the page without escaping (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is tightly constrained: only sites explicitly configured to use LdapCommentAuthenticator are affected, the victim's session must already have the authenticator form loaded, and the victim must follow an attacker-crafted link. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the credentials are credited to 姬珏 (CyberLeo); the net assessment is a low-to-moderate priority issue rather than an urgent one.
Stored cross-site scripting in Apache Roller 6.1.5 lets an unauthenticated remote attacker post a comment containing a javascript: URI that survives HTML comment formatting and executes in the browser of any visitor who clicks the crafted link. Exploitation is gated by a non-default configuration - the site must enable HTML in comments (users.comments.htmlenabled=true) and use the HTMLSubset comment formatter - and by required user interaction, while comment moderation, where enabled, delays publication of the malicious comment. Apache rates the issue Moderate (CVSS 3.1: 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and fixed it in 6.1.6 by restricting restored links to http, https and mailto URIs; no public exploit identified at time of analysis.
Stored cross-site scripting in Apache Roller 6.1.5 lets an unauthenticated remote attacker persist a crafted URL in the comment-author field so that script executes in the browser session of a weblog moderator or global administrator who later opens the comment moderation page. The flaw is rated CVSS 3.1 6.1 (medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting unauthenticated submission, required reviewer interaction, and impact scoped to the privileged reviewer's session with no availability loss. No public exploit code has been identified at time of analysis - no public exploit identified at time of analysis - and exploitation is not confirmed actively exploited (CISA KEV); successful abuse requires that the site allow comments on at least one weblog and that a moderator actually review the pending comment in the web UI, but the vendor states no non-default server setting is required.
Stored cross-site scripting in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist a crafted comment-author URL through the incoming Trackback endpoint, which the shipped Trackback verification and moderation defaults approve and render as an active link; a visitor who clicks that link executes attacker-controlled script in the weblog's origin. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) the attack requires no authentication but does require user interaction, since the payload only fires on click rather than automatically on page load, so it is not a self-executing compromise. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis, and the vendor has released Apache Roller 6.1.6, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links.
Stored cross-site scripting in Apache Roller 6.1.5 allows an authenticated user with media-upload rights to store active content on Roller's origin, which executes when a victim opens the uploaded file. Exploitation is constrained: the media-upload feature is disabled by default, so only non-default installations that enable it are exposed, and the attacker must already hold upload privileges while the victim must actively open the file. No public exploit identified at time of analysis; this is a genuine but low-priority issue given the non-default configuration and required victim interaction.
Sensitive file disclosure in Apache Roller 6.1.5 allows an authenticated weblog administrator (CVSS PR:L) to read arbitrary files on the application classpath - including Roller configuration files that may contain secrets - by authoring a Velocity template that uses the #include or #parse directive to load a resource outside the active theme namespace. Roller's Velocity sandbox does not confine these directives, no non-default configuration is required, and any weblog whose administrator can author templates is affected; no public exploit identified at time of analysis.
Reflected cross-site scripting in Apache Roller 6.1.5 lets remote attackers inject script into the frontpage theme's directory page by supplying a crafted blog-directory parameter that is reflected without proper escaping; the script then executes in the browser of any visitor who follows the crafted link. Only weblogs using the bundled 'frontpage' theme are affected, and exploitation requires the victim to click a malicious link (UI:R) - no credentials are needed to craft or deliver it, but no public exploit code has been identified at time of analysis. The NVD CVSS 3.1 score of 6.1 (medium, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects limited confidentiality and integrity impact confined to the weblog origin, with the theme dependency and mandatory user interaction keeping real-world exploitability below what the network-reachable vector suggests.
Missing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthenticated attackers to post form entries directly to the public submission API, because the password gate is implemented only in front-end JavaScript. An attacker only needs the form key that is exposed in any public share link; no account, no user interaction, and no special configuration are required. Publicly available exploit code exists (a Python PoC targeting the submission endpoint), but there is no indication of confirmed active exploitation (not in CISA KEV), and the impact is bounded to unauthorized submission injection - existing responses cannot be read and availability is unaffected.
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /user/form/data/create, because that endpoint never enforces the form's publish status, time window, quota, or per-IP limits - letting an attacker falsify or inflate collected survey results. The defect requires only a low-privileged TDuck account (CVSS 3.1 PR:L) plus the target form key, is remotely exploitable over HTTP with no user interaction, and is strictly an integrity issue: no confidential data can be read and no denial of service results. Publicly available exploit code exists (a bypass PoC script for the data-create endpoint), but there is no confirmed active exploitation and no CISA KEV listing; independent assessment rates this a genuine but low-severity authorization defect.
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form through 6.0 because the FormThemeController write endpoints enforce neither an administrative role nor ownership of the affected theme resources. The flaw is a missing-authorization (CWE-862) issue reachable by any holder of a valid low-privilege account (CVSS 4.0 vector PR:L, AV:N, AC:L, UI:N) with no confidentiality impact - only integrity and availability effects on themes shared across other users' forms. Publicly available exploit code exists (a proof-of-concept script targeting the theme write path), but there is no confirmed active exploitation in the wild; the NVD score of 5.3 is credible and consistent with this limited, credential-gated impact.
Unauthenticated credential disclosure in X-SpringBoot (yzcheng90) through version 6.0 allows remote attackers to read tenant appKey and appSecret values from the GET /application/manager/select endpoint, which performs no authentication check and applies no field filtering to the response. With those credentials an attacker can drive the affected tenant's configured SMS provider to send arbitrary messages, enabling SMS bombing, cost abuse, and impersonation of the legitimate application. The issue is trivially exploitable - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (vendor score 6.9 under CVSS 4.0) - and publicly available exploit code exists in a GitHub PoC repository; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis. Direct impact is bounded: the disclosure affects SMS credentials and message-sending capability rather than full system compromise.
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
Deserialization of untrusted data in the LangChain4j-agentic module's AgenticScopeSerializer.fromJson path allows an attacker who can already write to an AgenticScope persistence store to trigger arbitrary class instantiation through Jackson's insecure default typing. Affected versions are the 1.5.3, 1.11.10 and 1.18.1 beta lines up to and including 1.5.3-beta10, 1.11.10-beta18 and 1.18.1-beta27, with fixes released in 1.5.3-beta11, 1.11.10-beta19 and 1.18.1-beta28 under advisory GHSA-gmwr-7wmf-mrjm. Publicly available exploit code exists, but effective risk is low: exploitation requires that the application have explicitly enabled AgenticScope persistence (opt-in and off by default) and that the attacker already control the writable backing store, with attack complexity rated high; this issue is not confirmed actively exploited (not in CISA KEV), and EPSS-style scoring is negligible given the reported CVSS base of 2.1.
Authorization bypass in Sanluan PublicCMS up to and including 6.202506.e lets an authenticated administrative user read user and department records outside their authorized scope by tampering with the userId or deptId parameter handled by the exportExcel/exportData functions. Because the server never verifies that the requested identifier falls within the caller's own department or permission scope (CWE-639), a low-privileged backend account can pull exports it should not see; the impact is confidentiality-only with no modification or denial-of-service component. Publicly available exploit code exists (a PoC published in the GitHub CVERequest repository), but the flaw is not confirmed actively exploited (CISA KEV), the vendor did not respond to the disclosure, and no vendor patch is available - making this a low-priority issue despite being remotely reachable.
Improper identifier resolution in Brocade/Broadcom management software's Java cache-key handling can let an authenticated attacker on an adjacent network trigger identity mismatches, producing high integrity impact without confidentiality or availability loss. The flaw is a moderate-severity object-comparison logic issue that requires a low-privilege account and specific user-account structures, making it realistically LOW priority for most organizations. No public exploit identified at time of analysis; apply the vendor fix described in Broadcom support advisory 39000.
Authorization bypass in SpringBlade through 5.0.2 lets attackers read other users' account information by supplying an arbitrary userId to the user-auth-info endpoint backed by UserServiceImpl.userInfo, because the application never verifies that the requested user object belongs to the caller. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix is available. Although the supplied CVSS 4.0 vector lists PR:N, the endpoint is a user/auth-info API that in practice requires at least a low-privileged authenticated session, and the realistic impact is limited to read-only disclosure of user profile data (no modification or code execution).
Server-side request forgery in the chat-server component of songxinjianqwe Chat (ChatServer.java) allows remote, unauthenticated attackers to coerce the server into issuing HTTP requests to attacker-chosen URLs. The flaw is reachable over the network with low complexity and no user interaction (CVSS:4.0 AV:N/AC:L/PR:N/UI:N), but all impact metrics are rated Low (VC:L/VI:L/VA:L) with no downstream-system impact, so practical damage is limited to constrained or blind SSRF-style information leakage and internal-network probing rather than full internal pivoting. Publicly available exploit code exists (referenced from a GitHub issue), and VulDB reports that the vendor was contacted but did not respond; the project uses a rolling release model, so no specific fixed version is documented. Affected deployments are typically hobbyist Java chat-server instances rather than internet-exposed production services.
Open redirect in the Yudao (ruoyi-vue-pro) OAuth2 client component, affecting releases up to 2026.08, lets remote attackers manipulate the redirect_uri argument handled by validOAuthClientFromCache in OAuth2ClientServiceImpl.java so that a victim is bounced to an attacker-controlled site after clearing the authorization flow. No authentication is required (CVSS:4.0 PR:N), but the attack is not autonomous - it needs a victim to click a crafted authorization link and complete the flow (UI:P), and impact is limited to integrity-only redirection with no data disclosure or code execution. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is confirmed; the independent assessment rates this a genuine but modest issue (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).
Authenticated path traversal in the ruoyi-vue-pro (Yudao) WeChat MP material-upload component lets a low-privileged user write files outside the intended upload directory by embedding '../' sequences in a multipart filename passed to getOriginalFilename() in MpMaterialServiceImpl. Versions up to and including the 2026.08 release are affected whenever the yudao-module-mp module is deployed; the CVSS 4.0 base score is 2.1 (our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, i.e. remote but requiring a valid account, with limited integrity impact only). Publicly available exploit code exists per the disclosing researcher, and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Improper authorization in the yudao-module-pay component of ruoyi-vue-pro (YunaiV / zhijiantianya) lets an attacker manipulate the ID argument passed to updateDemoOrderPaid in PayDemoOrderController.java, modifying demo payment-order records the caller is not authorized to touch; CWE-285 classifies this as an IDOR-style broken access control, and the attack is remote with no user interaction. The affected surface is the DEMO order payment-callback handler of the pay module, so direct impact is confined to demo order data rather than live production payments, and exploitation requires the pay demo module to be enabled and the endpoint reachable. Publicly available exploit code exists, but there is no evidence of confirmed active exploitation (not listed in CISA KEV), and the vendor was contacted early about the disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
Cross-site scripting in RuoYi-Vue-Pro (all versions up to 2026.08) allows remote attackers to inject script through the File Upload component implemented in yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java, which is later rendered in the administrative interface without adequate output encoding. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor patch is available at time of analysis. Exploitation requires a victim to view the malicious file content (UI:P) and, per our independent assessment, realistically also depends on access to the upload endpoint and an authenticated user viewing the affected admin pages, keeping the practical severity in line with the CVSS 5.3 base score.
SQL injection in the GoView data-visualization component of ruoyi-vue-pro (Yudao) lets an authenticated low-privilege user inject arbitrary SQL through the report data endpoint, exposing or altering backend database contents. The flaw sits in GoViewDataServiceImpl.getDataBySQL, which passes a user-controlled 'sql' argument into a query, and it affects deployments up through the 2026.08 release where the yudao-module-report / GoView module is enabled and reachable. Publicly available exploit code exists and the vendor was contacted but did not respond, so no vendor-released patch was identified at time of analysis; the base score is modest (5.3 under CVSS 4.0, PR:L, E:P) but the confidentiality impact is assessed as high, and there is no evidence of confirmed active exploitation (CISA KEV).
Server-side request forgery in the AI Knowledge Module of ruoyi-vue-pro (versions through 2026.08) allows an authenticated low-privilege user to coerce the application server into issuing arbitrary outbound HTTP requests via the AiKnowledgeDocumentServiceImpl.readUrl document-import function, which fetches a caller-supplied URL without adequate validation. Exploitation is remote and low-complexity and requires only a valid low-privilege account plus an enabled/reachable AI Knowledge feature; the practical impact is bounded by what the server can reach on the internal network, such as internal HTTP services, admin panels, or cloud instance-metadata endpoints, resulting in limited confidentiality and integrity exposure. Publicly available exploit code exists, no CISA KEV entry confirms active exploitation, and the vendor was contacted about the disclosure but did not respond, so an upstream patch is not available and this is a genuine but moderate-priority issue whose real-world severity depends on the operator's outbound egress controls.
Improper neutralization of Spring Expression Language (SpEL) input in halo-dev Halo versions up to 2.25.4/2.26.1 lets unauthenticated remote attackers influence expression handling through the comment reply-notification subscription component, producing low-level confidentiality, integrity, and availability impact. Publicly available exploit code exists and the vendor did not respond to disclosure, but there is no CISA KEV listing, so active exploitation is not confirmed. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, a genuine but modest-severity issue.
Information disclosure in O2OA (up to and including 9.5.3 and 10.0.2) lets an authenticated remote attacker read data they should not be able to access by supplying a manipulated fileUrl argument to the list function of the Cipher Connection Handler (CipherConnectionAction.java). The flaw is a CWE-200 exposure of sensitive information rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/E:P), mapped independently to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only, low impact, requiring a valid session but no user interaction. Publicly available exploit code exists (a public GitHub issue demonstrates the technique) and the issue is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor was contacted but did not respond, and no vendor-released patch has been identified.
Unauthorized read access to book records in TaleLin lin-cms-spring-boot 0.2.1 and earlier is possible through the searchBook function in BookController.java; remote unauthenticated attackers can reach the book endpoint and retrieve records without proper authorization. A publicly available exploit exists, but there is no confirmed active exploitation (CISA KEV) and no vendor patch identified. The 6.9 CVSS 4.0 score reflects a confidentiality-only impact; our assessment is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, making real-world risk low-to-moderate and dependent on whether the book endpoint is network-exposed.
Improper authorization in TaleLin lin-cms-spring-boot through 0.2.1 lets unauthenticated remote attackers read book records by invoking the getBooks function in BookController.java; the CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) confirms no privileges or user interaction are required, and impact is limited to confidentiality. Publicly available exploit code exists, and the vendor did not respond to early disclosure, so no vendor-released patch was identified at time of analysis. This is a real but low-severity issue that should be triaged as low-to-moderate priority, with the primary limiting factors being the product's rarity and the read-only scope of the exposure.