Java
Monthly
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session when that victim visits a crafted URL or interacts with a manipulated page. Exploitation requires two independent gates: a valid low-privileged AEM account (PR:L) and successful social engineering of the victim (UI:R), and the impact stays confined to the victim's browser context with no availability loss and no server-side code execution. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is 0.25% (15th percentile), consistent with a genuine but low-priority issue rather than an urgent one.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including the AEM Cloud Service and 6.5 LTS builds - allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who browses to the affected page. Exploitation requires a valid author-level account plus a victim who visits the poisoned page, so this is a low-to-medium priority issue rather than an immediate remote-compromise risk; there is no public exploit identified at time of analysis and the EPSS score is only 0.25% (15th percentile), indicating very low predicted exploitation activity. Impact is limited to script execution in the victim's session (C:L/I:L) with no server-side code execution or availability loss.
Improper access control in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows a local, low-privileged authenticated user - if they can persuade a legitimate user to interact with a crafted element - to bypass security checks and perform limited unauthorized writes, potentially causing denial of service. With CVSS 5.6, EPSS 0.13% (2nd percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this is a genuinely low-priority issue whose realistic exploitation is constrained by the need for local access, existing credentials, and user interaction.
Arbitrary file system read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier results from an Improper Restriction of XML External Entity Reference (CWE-611) flaw in ColdFusion's XML parsing, which lets an attacker coerce the parser into resolving crafted external entities and disclose sensitive files from the server's file system. Exploitation is doubly gated per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N: the attacker must already hold high (administrative-level) privileges and a legitimate user must interact by submitting or processing attacker-influenced XML, and the scope change (S:C) means the resulting read can reach resources beyond the directly vulnerable component. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.49% (40th percentile), and Adobe has published a fix in security bulletin APSB25-105.
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier can occur when a high-privileged attacker supplies maliciously crafted serialized data and induces user interaction to trigger deserialization. The flaw is network-reachable and, if exploited, can change scope and fully compromise confidentiality, integrity, and availability, but it requires an authenticated high-privilege (PR:H) account plus a user action (UI:R), so it is not remotely unauthenticated. No public exploit identified at time of analysis; no CISA KEV status is provided, EPSS is 9.54% (95th percentile), and Adobe has published advisory APSB25-105 for patching.
Remote code execution in Ladybug (wearefrank/ladybug) versions prior to 3.0-20251107.114628 allows network attackers with low-level privileges to execute arbitrary code by uploading crafted gzip-compressed XML payloads to the /iaf/ladybug/api/report/{storage} or /iaf/ladybug/api/report/upload endpoints, which are then unsafely deserialized. This is a CWE-502 deserialization of untrusted data issue with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though EPSS indicates a low probability of exploitation (0.33%, 24th percentile). No user interaction is required, and the vendor has released a patch in version 3.0-20251107.114628.
Local attackers with a low-privileged account on a host running Robocode 1.9.3.6 can exploit an insecure temporary file creation flaw in the battle recording component (RecordManager) to overwrite arbitrary files or potentially achieve code execution via a race condition. The vulnerability requires winning a timing race against the application's File.createTempFile followed by delete and createNewFile calls while a battle recording is being written, and exploitation is limited to local scenarios where the victim is actively running Robocode. No public exploit code or active exploitation has been identified at time of analysis, and the independent assessment rates the practical risk lower than the headline CVSS 4.0 score of 9.3 due to the local-only attack vector and non-deterministic race window.
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Path traversal in oci-helper version 3.2.4 and earlier allows authenticated attackers with low privileges to manipulate the
Unauthenticated remote attackers can read sensitive files inside the XWiki webapp/ directory in instances deployed with the XWiki Jetty package (XJetty), exposing credential-bearing configuration files such as WEB-INF/xwiki.cfg, WEB-INF/xwiki.properties, and WEB-INF/hibernate.cfg.xml via direct HTTP requests. The flaw affects XWiki 16.7.0 through 16.10.10, 17.0.0-rc1 through 17.4.3, and 17.5.0 through 17.6.x; deployments that run XWiki as a WAR on an independently configured servlet container (for example Tomcat) are not affected. A vendor-released patch is available (16.10.11, 17.4.4, 17.7.0) and publicly available exploit code exists, though this is not confirmed actively exploited (no CISA KEV listing) and EPSS sits at 1.77% (82nd percentile). Despite the 'Authentication Bypass' tag, this is a pure information-disclosure issue with no write, integrity, or code-execution impact.
We are tasked with analyzing CVE-2025-13811 and producing a JSON object with the specified fields. We must synthesize multiple intelligence sources. Here's the data we have: - CVE ID: CVE-2025-13811 - Description: Affects jsnjfz WebStack-Guns 1.0, file PageFactory.java, argument 'sort' leads to SQL injection. Remote attack possible, exploit publicly disclosed, vendor contacted but no response. - CVSS Score: 2.1 (but there is a CVSS v4.0 vector, note: CVSS v4.0 vector doesn't map to a 2.1 score; maybe it's a typo or they provided a vector with base score? CVSS v4.0 vector provided but with all base metrics set to X? Wait, the vector is: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That includes AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The base score for that would be: using CVSS 4.0 calculator, AV:N (network), AC:L (low attack complexity), AT:N (no attack requirements), PR:L (low privileges required), UI:N (no user interaction), VC:L (low impact on confidentiality), VI:L (low impact on integrity), VA:L (low impact on availability), SC:N, SI:N, SA:N. The base score would be 2.3? Actually, let's compute: Base Score = likelihood subscore + impact subscore. Likelihood subscore: [8.1 - (0.0+0.0+0.0+0.2+0.0)] = 7.9? I need to recall CVSS 4.0 formula. Simpler: use the fact that the given score is 2.1, but that might be the CVSS v2 or v3 score. Actually, they provided "CVSS Score: 2.1" but also a CVSS v4.0 vector. It might be that the CVSS v4.0 vector's base score is 2.3, but they approximated as 2.1? Either way, the vector indicates network attack vector with low privileges, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit maturity: P (proof-of-concept). So we'll use this for our assessment. - EPSS Score: 0.04% (percentile 12%) very low probability of exploitation. - POC/Exploit: Publicly available. Tags: SQLi, Java. - KEV: Not mentioned, so NO. - Patch: Not available, vendor unresponsive. - CPE: cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:* - References include GitHub POC, VulDB entries. We need to construct a JSON with the required fields. Each field is a string (paragraph). Let's go through each field: 1. "product_name": "1-3 words ONLY. The specific product or service name affected. Pick primary one: 'WebStack-Guns'" (since jsnjfz is the organization). "WebStack-Guns" is the product name. So product_name: "WebStack-Guns" 2. "summary": 2-3 sentence plain-language summary. Must not copy description. Start with impact verb and product. Exploitation conditions: it's an SQL injection in PageFactory.java 'sort' argument. The vector indicates low privileges required, network exploitation. Exploit available publicly. Vendor unresponsive. EPSS low. So summary: "SQL injection in WebStack-Guns 1.0 allows remote authenticated attackers to manipulate database queries via the 'sort' parameter in PageFactory.java. Exploit code is publicly available, but the vulnerability has low EPSS score and limited real-world impact due to low privilege requirements and low C/I/A impacts. Vendor has not responded to disclosure." 3. "technical_context": Explain technology/library/protocol involved. CWE-74 is improper neutralization of special elements in output used by a downstream component ('Injection'). Since it's Java and SQL injection, likely uses mybatis or JDBC where user input is not parameterized. File: PageFactory.java, constant factory. So we'll mention Java-based web application, likely uses MyBatis or JDBC, argument 'sort' inadvertently concatenated into SQL. Use CPE to identify exact affected product. State that the vulnerability is an SQL injection in the sort parameter of a page factory class. 4. "risk_assessment": CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base score about 2.3. EPSS 0.04% (12%), low probability. POC available, but not in KEV. Low impact on confidentiality, integrity, availability. So real risk is low. Also note that the attack requires low privileges, which limits exploitation to authenticated users. So the risk is low. Mention that the PR:L indicates that an attacker needs some authenticated access, so it's not remote unauthenticated. The vendor hasn't responded, so no patch. Contrast the CVSS severity (Low) with the low EPSS; all signals point to low priority. Include that. 5. "affected_products": List affected products: jsnjfz WebStack-Guns version 1.0. Use CPE string. There is a vendor advisory? VulDB links may serve as advisory. So write: "jsnjfz WebStack-Guns version 1.0 is affected (cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*). The vulnerability is documented in VulDB entry 333821 and a GitHub proof-of-concept report. No official vendor advisory is available." 6. "remediation": No patch available. Suggest compensating controls: Since SQL injection in sort parameter, input validation, use parameterized queries, or deploy a Web Application Firewall to block malicious sort inputs. Also consider restricting access to the affected endpoint if possible. As no fix version, say "No vendor-released patch is available. Mitigations include validating and sanitizing the 'sort' parameter to allow only expected values, using prepared statements, or deploying a WAF rule to block SQL injection attempts. Restrict access to the affected functionality to trusted users only." 7. "exploit_scenario": Attack scenario: Given PR:L, attacker needs authenticated access with low privileges. They send a crafted request to the endpoint that processes the sort parameter, injecting SQL, potentially reading or modifying database contents. Since VC/VI/VA are low, impact is minor. Mention POC available. So: "An authenticated attacker with low privileges sends a malicious HTTP request containing a crafted sort parameter. The injected SQL is executed, leading to potential low-level data leakage or modification." 8. "exploitation_conditions": From description, the unknown code in PageFactory.java and argument sort. The CVSS vector indicates PR:L, so exploitation requires low-level authentication. So conditions: attacker must be authenticated with low privileges and the application must use the unsanitized sort argument in SQL. No other special configuration noted. So: "Exploitation requires authentication as a low-privileged user on WebStack-Guns 1.0. The vulnerable 'sort' parameter must be processed by the PageFactory class without input sanitization." 9. "attack_chain": We need steps separated by arrows. Based on description: network access -> send crafted sort param -> SQL injection -> data manipulation/disclosure. Since PR:L, need to authenticate first. So: "Authenticate to application as low-privileged user → Identify vulnerable PageFactory endpoint → Send HTTP request with malicious sort parameter → SQL injection executes → Read or modify database records (low impact)." 10. "confidence_notes": Data completeness: exploit confirmed by public POC on GitHub, vendor contacted but no response, so no official patch. CVSS vector provided by VulDB, so confidence in the vector is high? But note the CVSS v4.0 vector is from VulDB, and NVD might not have analyzed it yet. The EPSS is from FIRST. So: "Exploit publicly available via GitHub POC. CVSS v4.0 base metrics and impact confirmed by VulDB. No vendor advisory or fix. The low impact ratings (VC:L, VI:L, VA:L) suggest limited severity despite the SQL injection nature." 11. "prevalence": One word. WebStack-Guns is a niche web stack management tool. Not widely known. Likely low adoption. So "low". 12. "prevalence_basis": Short justification: "Niche web management framework, limited adoption." So: "Niche web framework with limited enterprise deployment." 13. "assessed_cvss_vector": Our own independent CVSS 3.1 vector based on description and conditions. Let's map: AV:N (network attack), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U? The description says it's a manipulation of argument sort leading to SQL injection, no mention of scope change. So S:U. C:L/I:L/A:L? The CVSS v4.0 gave VC:L/VI:L/VA:L, so low impact. In CVSS 3.1, low means partial. So C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would be base score 6.3 (medium). But the v4.0 score was low. Actually, in CVSS 4.0 low impact scores lead to low base score because impact is much lower. So in 3.1, the low impacts still give a medium score. But the description might actually allow full database access? The description doesn't specify magnitude, but the v4.0 vector gave low impacts. We'll stick with that. So the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we need to justify: It's a SQL injection with network vector, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality, integrity, availability impact. So rationale: "Requires low privileges (PR:L) and network access; low impact assumed due to limited data exposure." 14. "assessed_cvss_rationale": one sentence. "Network-exploitable with low privileges; low impact assumed from description and similar CVSS scores." Or "SQL injection with low complexity, low privileges; limited to low data impact." So: "Low attack complexity and privileges; limited confidentiality, integrity, and availability impact based on vulnerability report." 15. "assessed_cvss40_vector": We'll use the provided v4.0 vector as base, but we must ensure it's consistent with our 3.1 assessment. The v4.0 vector provided actually has AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's the base vector. That's already the vector we'd use. So we can output that. But if we need to provide our own independent one, it's the same. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now, assemble the JSON. All fields strings, no arrays. Make sure not to copy description, original synthesis. Use the terms as per rules: exploitation conditions, confidence, etc. For prevalence, we said low, basis: "Niche web framework with limited enterprise deployment." Risk assessment: must contrast CVSS score (low base score in v4.0) with EPSS (low). The v4.0 score was 2.3, but v3.1 would be 6.3, but the provided score is 2.1 (likely they computed v4.0 base). So we'll mention that the CVSS v4.0 base score is low (2.3), indicating low severity, EPSS very low, no active exploitation, no KEV. So risk is low. Patch missing but impact limited. Remediation: note that vendor did not respond so no patch, suggest parameterized queries, WAF, restrict access. Also mention that since PR:L, only authenticated users can exploit, so limiting access further reduces risk. Attack chain: I'll structure as: "Authenticate as low-privileged user → Locate vulnerable endpoint → Send crafted HTTP request with malicious sort parameter → SQL injection modifies query logic
Path traversal in WebStack-Guns 1.0 exposes arbitrary server-side files to unauthenticated remote attackers through the CAPTCHA image rendering endpoint. The `renderPicture` function in `KaptchaController.java` fails to sanitize user-supplied file path input, allowing directory traversal sequences to escape the intended image directory and read sensitive files such as configuration files, credentials, or application source. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, leaving version 1.0 permanently unpatched.
Server-side request forgery in orion-ops allows authenticated remote attackers to manipulate SSH connection parameters (host, port, credentials) to trigger outbound requests from the server, potentially reaching internal services. The vulnerability affects all versions up to commit 5925824 and has a publicly available proof-of-concept exploit. Exploitation requires low-privilege access and may impact confidentiality, integrity, and availability of internal assets.
A security vulnerability in orionsec orion-ops (CVSS 7.3). Risk factors: public PoC available.
A security vulnerability in orionsec orion-ops (CVSS 4.3). Risk factors: public PoC available.
A security vulnerability in nutzam NutzBoot (CVSS 7.3). Risk factors: public PoC available.
Deserialization in nutzam NutzBoot's LiteRpc-Serializer component allows remote attackers to potentially read sensitive data from affected systems. An exploit is publicly available; no active exploitation has been confirmed. The vulnerability carries an extremely low CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact, though real-world impact may be greater if deserialization gadget chains permit arbitrary code execution.
Information disclosure in NutzBoot 2.6.0-SNAPSHOT allows remote attackers with low privileges to access sensitive Ethereum wallet data via a manipulation of the EthModule.java endpoint. Public exploit code is available, but no active exploitation has been confirmed; EPSS estimates very low exploitation probability (0.04%).
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the Keycloak LDAP User Federation provider. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in Dromara dataCompare up to 1.0.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in wwwlike vlife up to 2.0.1.java of the component VLifeApi. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A weakness has been identified in lsfusion platform up to 6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in lsfusion platform up to 6.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in lsfusion platform up to 6.1. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224.java. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Information disclosure in the Jenkins Eggplant Runner Plugin (0.0.1.301.v963cffe8ddb_8 and earlier) weakens a built-in Java runtime safeguard by clearing the `jdk.http.auth.tunneling.disabledSchemes` system property, which by default stops the JDK from answering a proxy 407 challenge with Basic credentials over an HTTP CONNECT tunnel. The practical exposure is narrow: it only matters when the Jenkins controller or agent makes outbound HTTPS connections through a proxy that uses Basic authentication, and a privileged attacker already positioned to intercept traffic between Jenkins and that proxy must be present to observe the re-enabled credential exchange - reflected in the High attack-complexity rating (CVSS 5.9, AC:H, PR:N, UI:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.32% (23rd percentile); this is a moderate-priority hardening issue rather than an urgent one.
Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.
Improper authorization in TIME-SEA-PLUS PayController.java alipayIsSucceed function allows authenticated remote attackers to disclose sensitive information related to order status handling. The vulnerability affects versions up to commit fb299162f18498dd9cf17da906886d80a077d53b, with publicly available exploit code disclosed but low real-world exploitation probability (EPSS 0.03%). Attack requires valid user credentials and network access but does not enable privilege escalation or data modification.
Tibbo AggreGate Network Manager versions below 6.40.05 expose Java system properties, server path details, and version information to unauthenticated remote attackers through the /cwmp/happyaxis.jsp diagnostic endpoint, requiring no credentials or user interaction (CVSS 4.0 6.9, CVSS 3.1 C:L). The EPSS score is 0.37% (29th percentile) and no public exploit identified at time of analysis; this CWE-497 information disclosure is reconnaissance-only and does not by itself grant access, modify data, or disrupt service, though internet-exposed instances remain the highest risk.
Integrity-only data modification in Oracle Database Server's Java VM component (versions 19.3-19.28, 21.3-21.19, and 23.4-23.9) allows unauthenticated, network-positioned attackers to create, delete, or modify critical data or all Java VM accessible data via Oracle Net, though high attack complexity (AC:H) makes exploitation difficult and no public exploit is identified at time of analysis. Oracle's October 2025 Critical Patch Update addresses this moderate-severity (CVSS 5.9) vulnerability, which has a low EPSS score (0.23%, 13th percentile) and is not listed in CISA KEV.
Unauthorized read of a limited subset of runtime data is possible in Oracle GraalVM for JDK 17.0.16 and 21.0.8 through the Compiler component, reachable by an unauthenticated attacker with network access (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 3.7). The weakness is rated high attack complexity because the attacker must satisfy undisclosed, difficult-to-control preconditions, which is why Oracle labels it difficult to exploit; there is no integrity or availability impact. No public exploit code has been identified, EPSS is 0.26% (17th percentile), and there is no CISA KEV listing, so this is a low-priority item limited to deployments actually running the two affected GraalVM for JDK versions in a network-reachable configuration.
Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows remote unauthenticated attackers to alter sensitive data through APIs and multiple protocols via difficult-to-exploit integrity bypass. Affected versions include Java SE 21.0.8 and 25, GraalVM for JDK 21.0.8, and GraalVM Enterprise Edition 21.3.15. The vulnerability carries a low EPSS score (0.03%, 10th percentile) and no active exploitation has been identified, indicating limited real-world priority despite network accessibility.
Unauthorized data access in Oracle Java SE JAXP component allows remote unauthenticated attackers to exfiltrate sensitive information from multiple Java platforms including Oracle Java SE (8u461 through 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). Exploitation requires no authentication, low complexity, and can occur through web services supplying malicious data to JAXP APIs or via sandboxed Java Web Start/applet deployments loading untrusted code. Oracle released patches in October 2025 Critical Patch Update with EPSS data unavailable at time of analysis. CVSS 7.5 reflects pure confidentiality impact with network attack vector.
Improper access control in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to create, delete, or modify critical data when APIs in the Security component are exposed via web services or similar mechanisms. The vulnerability affects Java 8u461 through 25 and carries a CVSS 5.9 with high integrity impact, though exploitation is difficult (AC:H) and no public exploit or active KEV status has been confirmed.
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implementations as Groovy classes that are compiled and reloaded at runtime by the Syncope Core, and because that code was not isolated, a malicious administrator can inject Groovy code that executes remotely on the Core instance with the full privileges of the Syncope process, affecting confidentiality, integrity, and availability. The flaw is reachable only by an authenticated administrator (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) - unauthenticated or low-privileged users cannot trigger it - and it affects Apache Syncope 3.0.x before 3.0.14 and 4.0.x before 4.0.2. No public exploit code or confirmed active exploitation has been identified at time of analysis; the practical risk is best characterized as access-gated insider or compromised-admin abuse rather than a mass-exploitation threat.
Spring Framework versions 5.3.0 through 6.2.11 are vulnerable to a CSRF bypass in STOMP over WebSocket support, allowing an unauthenticated attacker to send unauthorized messages by tricking a victim into visiting a malicious page. This moderate-severity issue (CVSS 4.3) requires user interaction and only affects applications using Spring's STOMP/WebSocket messaging; confidentiality and availability are not impacted. No public exploit identified at time of analysis, and the EPSS score is low (0.31%, 22nd percentile).
Spring Cloud Gateway Server Webflux can expose environment variables and system properties when an untrusted third party can create a route using SpEL against an enabled, reachable, and unsecured gateway actuator endpoint. This is an information-disclosure issue, not remote code execution, and Spring Cloud Gateway Server WebMVC is not affected. Exploitation requires non-default actuator configuration such as management.endpoints.web.exposure.include=gateway together with management.endpoint.gateway.enabled=true or management.endpoint.gateway.access=unrestricted, so hardened deployments that keep the gateway actuator disabled or secured are not exposed; no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile).
Improper access control in WSO2 API Manager 2.0.0 through 3.2.1 and WSO2 API Control Plane 4.5.0 allows an authenticated low-privileged user to reach certain internal SOAP Admin Services and System REST APIs and perform unauthorized operations, including disclosure of server-level information. The issue is network-reachable with low attack complexity and confidentiality-only impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and APIs exposed through the API Manager's API Gateway data plane are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Server-side request forgery in the Remote Browser Plugin of Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate stored proxy repository credentials via crafted HTTP requests. Exploitation requires the Remote Browser Plugin to be enabled and the instance to have stored proxy repository credentials; Nexus Repository 3.x is not affected. No public exploit identified at time of analysis, and this is a genuinely high-risk issue that warrants prompt attention on affected instances.
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).
Information disclosure in kaifangqian-base's SysUserController.getAllUsers endpoint allows authenticated remote attackers to retrieve sensitive user data. The vulnerability affects the function up to commit 7b3faecda13848b3ced6c17c7423b76c5b47b8ab and requires login credentials (PR:L in CVSS 4.0), limiting exposure to authenticated users. Public exploit code exists, but the low CVSS score (2.1) and minimal EPSS percentile (8%) suggest limited real-world exploitation despite public availability.
Authorization bypass in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to manipulate the subjectId parameter in WrongBookController.java to access unauthorized resources. The vulnerability has a low CVSS score (2.1) due to limited confidentiality impact and requirement for prior authentication, but publicly available exploit code exists and the attack vector is entirely network-accessible.
Unrestricted file upload in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to upload arbitrary files via the uploadFile function in UploadController.java, potentially enabling remote code execution or system compromise. The vulnerability has publicly disclosed exploit code available. Despite a low CVSS score of 2.1 reflecting limited direct impact scope, the presence of public exploits and authentication bypass tags suggests practical exploitation risk in environments where attacker access is feasible.
Stored cross-site scripting (XSS) in westboy CicadasCMS Template Management Page allows high-privileged users to inject malicious scripts via the Save function in TemplateFileServiceImpl.java, affecting downstream users who interact with stored templates. The vulnerability requires high privileges and user interaction but carries CVSS 1.9 due to minimal integrity impact; however, publicly available exploit code exists, indicating real disclosure despite extremely low exploitation probability (EPSS 0.03%).
Absolute Secure Access deployments prior to version 14.10 ship a Warehouse component whose Java keystore file is written with overly permissive filesystem permissions, letting any local account read its contents. Exploitation is local, not remote: an attacker must already hold low-privileged access to the host and the version must predate 14.10, and success yields only keystore disclosure (confidentiality low, no integrity or availability impact) rather than code execution or privilege escalation. EPSS is negligible (0.03%, 8th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor has released a fix, so this is a low-priority information-disclosure issue.
Hardcoded cryptographic key in Flock Safety DetectionProcessing app for ANPR. PoC available.
Arbitrary code execution in QOS.CH logback-core through 1.5.18 allows attackers with write access to a logback configuration file (or the ability to set environment variables) to execute Java code via the conditional configuration feature when the Janino library and Spring Framework are also on the classpath. No public exploit identified at time of analysis and EPSS is low (0.06%), but the issue is tagged as RCE in widely deployed Java logging infrastructure and a vendor patch is available.
Knowage is an open source analytics and business intelligence suite. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in fcba_zzm ics-park Smart Park Management System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would. Rated low severity (CVSS 3.4), this vulnerability is low attack complexity. No vendor patch available.
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session when that victim visits a crafted URL or interacts with a manipulated page. Exploitation requires two independent gates: a valid low-privileged AEM account (PR:L) and successful social engineering of the victim (UI:R), and the impact stays confined to the victim's browser context with no availability loss and no server-side code execution. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is 0.25% (15th percentile), consistent with a genuine but low-priority issue rather than an urgent one.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including the AEM Cloud Service and 6.5 LTS builds - allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who browses to the affected page. Exploitation requires a valid author-level account plus a victim who visits the poisoned page, so this is a low-to-medium priority issue rather than an immediate remote-compromise risk; there is no public exploit identified at time of analysis and the EPSS score is only 0.25% (15th percentile), indicating very low predicted exploitation activity. Impact is limited to script execution in the victim's session (C:L/I:L) with no server-side code execution or availability loss.
Improper access control in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows a local, low-privileged authenticated user - if they can persuade a legitimate user to interact with a crafted element - to bypass security checks and perform limited unauthorized writes, potentially causing denial of service. With CVSS 5.6, EPSS 0.13% (2nd percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this is a genuinely low-priority issue whose realistic exploitation is constrained by the need for local access, existing credentials, and user interaction.
Arbitrary file system read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier results from an Improper Restriction of XML External Entity Reference (CWE-611) flaw in ColdFusion's XML parsing, which lets an attacker coerce the parser into resolving crafted external entities and disclose sensitive files from the server's file system. Exploitation is doubly gated per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N: the attacker must already hold high (administrative-level) privileges and a legitimate user must interact by submitting or processing attacker-influenced XML, and the scope change (S:C) means the resulting read can reach resources beyond the directly vulnerable component. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.49% (40th percentile), and Adobe has published a fix in security bulletin APSB25-105.
Arbitrary code execution in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier can occur when a high-privileged attacker supplies maliciously crafted serialized data and induces user interaction to trigger deserialization. The flaw is network-reachable and, if exploited, can change scope and fully compromise confidentiality, integrity, and availability, but it requires an authenticated high-privilege (PR:H) account plus a user action (UI:R), so it is not remotely unauthenticated. No public exploit identified at time of analysis; no CISA KEV status is provided, EPSS is 9.54% (95th percentile), and Adobe has published advisory APSB25-105 for patching.
Remote code execution in Ladybug (wearefrank/ladybug) versions prior to 3.0-20251107.114628 allows network attackers with low-level privileges to execute arbitrary code by uploading crafted gzip-compressed XML payloads to the /iaf/ladybug/api/report/{storage} or /iaf/ladybug/api/report/upload endpoints, which are then unsafely deserialized. This is a CWE-502 deserialization of untrusted data issue with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though EPSS indicates a low probability of exploitation (0.33%, 24th percentile). No user interaction is required, and the vendor has released a patch in version 3.0-20251107.114628.
Local attackers with a low-privileged account on a host running Robocode 1.9.3.6 can exploit an insecure temporary file creation flaw in the battle recording component (RecordManager) to overwrite arbitrary files or potentially achieve code execution via a race condition. The vulnerability requires winning a timing race against the application's File.createTempFile followed by delete and createNewFile calls while a battle recording is being written, and exploitation is limited to local scenarios where the victim is actively running Robocode. No public exploit code or active exploitation has been identified at time of analysis, and the independent assessment rates the practical risk lower than the headline CVSS 4.0 score of 9.3 due to the local-only attack vector and non-deterministic race window.
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Path traversal in oci-helper version 3.2.4 and earlier allows authenticated attackers with low privileges to manipulate the
Unauthenticated remote attackers can read sensitive files inside the XWiki webapp/ directory in instances deployed with the XWiki Jetty package (XJetty), exposing credential-bearing configuration files such as WEB-INF/xwiki.cfg, WEB-INF/xwiki.properties, and WEB-INF/hibernate.cfg.xml via direct HTTP requests. The flaw affects XWiki 16.7.0 through 16.10.10, 17.0.0-rc1 through 17.4.3, and 17.5.0 through 17.6.x; deployments that run XWiki as a WAR on an independently configured servlet container (for example Tomcat) are not affected. A vendor-released patch is available (16.10.11, 17.4.4, 17.7.0) and publicly available exploit code exists, though this is not confirmed actively exploited (no CISA KEV listing) and EPSS sits at 1.77% (82nd percentile). Despite the 'Authentication Bypass' tag, this is a pure information-disclosure issue with no write, integrity, or code-execution impact.
We are tasked with analyzing CVE-2025-13811 and producing a JSON object with the specified fields. We must synthesize multiple intelligence sources. Here's the data we have: - CVE ID: CVE-2025-13811 - Description: Affects jsnjfz WebStack-Guns 1.0, file PageFactory.java, argument 'sort' leads to SQL injection. Remote attack possible, exploit publicly disclosed, vendor contacted but no response. - CVSS Score: 2.1 (but there is a CVSS v4.0 vector, note: CVSS v4.0 vector doesn't map to a 2.1 score; maybe it's a typo or they provided a vector with base score? CVSS v4.0 vector provided but with all base metrics set to X? Wait, the vector is: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That includes AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The base score for that would be: using CVSS 4.0 calculator, AV:N (network), AC:L (low attack complexity), AT:N (no attack requirements), PR:L (low privileges required), UI:N (no user interaction), VC:L (low impact on confidentiality), VI:L (low impact on integrity), VA:L (low impact on availability), SC:N, SI:N, SA:N. The base score would be 2.3? Actually, let's compute: Base Score = likelihood subscore + impact subscore. Likelihood subscore: [8.1 - (0.0+0.0+0.0+0.2+0.0)] = 7.9? I need to recall CVSS 4.0 formula. Simpler: use the fact that the given score is 2.1, but that might be the CVSS v2 or v3 score. Actually, they provided "CVSS Score: 2.1" but also a CVSS v4.0 vector. It might be that the CVSS v4.0 vector's base score is 2.3, but they approximated as 2.1? Either way, the vector indicates network attack vector with low privileges, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit maturity: P (proof-of-concept). So we'll use this for our assessment. - EPSS Score: 0.04% (percentile 12%) very low probability of exploitation. - POC/Exploit: Publicly available. Tags: SQLi, Java. - KEV: Not mentioned, so NO. - Patch: Not available, vendor unresponsive. - CPE: cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:* - References include GitHub POC, VulDB entries. We need to construct a JSON with the required fields. Each field is a string (paragraph). Let's go through each field: 1. "product_name": "1-3 words ONLY. The specific product or service name affected. Pick primary one: 'WebStack-Guns'" (since jsnjfz is the organization). "WebStack-Guns" is the product name. So product_name: "WebStack-Guns" 2. "summary": 2-3 sentence plain-language summary. Must not copy description. Start with impact verb and product. Exploitation conditions: it's an SQL injection in PageFactory.java 'sort' argument. The vector indicates low privileges required, network exploitation. Exploit available publicly. Vendor unresponsive. EPSS low. So summary: "SQL injection in WebStack-Guns 1.0 allows remote authenticated attackers to manipulate database queries via the 'sort' parameter in PageFactory.java. Exploit code is publicly available, but the vulnerability has low EPSS score and limited real-world impact due to low privilege requirements and low C/I/A impacts. Vendor has not responded to disclosure." 3. "technical_context": Explain technology/library/protocol involved. CWE-74 is improper neutralization of special elements in output used by a downstream component ('Injection'). Since it's Java and SQL injection, likely uses mybatis or JDBC where user input is not parameterized. File: PageFactory.java, constant factory. So we'll mention Java-based web application, likely uses MyBatis or JDBC, argument 'sort' inadvertently concatenated into SQL. Use CPE to identify exact affected product. State that the vulnerability is an SQL injection in the sort parameter of a page factory class. 4. "risk_assessment": CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base score about 2.3. EPSS 0.04% (12%), low probability. POC available, but not in KEV. Low impact on confidentiality, integrity, availability. So real risk is low. Also note that the attack requires low privileges, which limits exploitation to authenticated users. So the risk is low. Mention that the PR:L indicates that an attacker needs some authenticated access, so it's not remote unauthenticated. The vendor hasn't responded, so no patch. Contrast the CVSS severity (Low) with the low EPSS; all signals point to low priority. Include that. 5. "affected_products": List affected products: jsnjfz WebStack-Guns version 1.0. Use CPE string. There is a vendor advisory? VulDB links may serve as advisory. So write: "jsnjfz WebStack-Guns version 1.0 is affected (cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*). The vulnerability is documented in VulDB entry 333821 and a GitHub proof-of-concept report. No official vendor advisory is available." 6. "remediation": No patch available. Suggest compensating controls: Since SQL injection in sort parameter, input validation, use parameterized queries, or deploy a Web Application Firewall to block malicious sort inputs. Also consider restricting access to the affected endpoint if possible. As no fix version, say "No vendor-released patch is available. Mitigations include validating and sanitizing the 'sort' parameter to allow only expected values, using prepared statements, or deploying a WAF rule to block SQL injection attempts. Restrict access to the affected functionality to trusted users only." 7. "exploit_scenario": Attack scenario: Given PR:L, attacker needs authenticated access with low privileges. They send a crafted request to the endpoint that processes the sort parameter, injecting SQL, potentially reading or modifying database contents. Since VC/VI/VA are low, impact is minor. Mention POC available. So: "An authenticated attacker with low privileges sends a malicious HTTP request containing a crafted sort parameter. The injected SQL is executed, leading to potential low-level data leakage or modification." 8. "exploitation_conditions": From description, the unknown code in PageFactory.java and argument sort. The CVSS vector indicates PR:L, so exploitation requires low-level authentication. So conditions: attacker must be authenticated with low privileges and the application must use the unsanitized sort argument in SQL. No other special configuration noted. So: "Exploitation requires authentication as a low-privileged user on WebStack-Guns 1.0. The vulnerable 'sort' parameter must be processed by the PageFactory class without input sanitization." 9. "attack_chain": We need steps separated by arrows. Based on description: network access -> send crafted sort param -> SQL injection -> data manipulation/disclosure. Since PR:L, need to authenticate first. So: "Authenticate to application as low-privileged user → Identify vulnerable PageFactory endpoint → Send HTTP request with malicious sort parameter → SQL injection executes → Read or modify database records (low impact)." 10. "confidence_notes": Data completeness: exploit confirmed by public POC on GitHub, vendor contacted but no response, so no official patch. CVSS vector provided by VulDB, so confidence in the vector is high? But note the CVSS v4.0 vector is from VulDB, and NVD might not have analyzed it yet. The EPSS is from FIRST. So: "Exploit publicly available via GitHub POC. CVSS v4.0 base metrics and impact confirmed by VulDB. No vendor advisory or fix. The low impact ratings (VC:L, VI:L, VA:L) suggest limited severity despite the SQL injection nature." 11. "prevalence": One word. WebStack-Guns is a niche web stack management tool. Not widely known. Likely low adoption. So "low". 12. "prevalence_basis": Short justification: "Niche web management framework, limited adoption." So: "Niche web framework with limited enterprise deployment." 13. "assessed_cvss_vector": Our own independent CVSS 3.1 vector based on description and conditions. Let's map: AV:N (network attack), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U? The description says it's a manipulation of argument sort leading to SQL injection, no mention of scope change. So S:U. C:L/I:L/A:L? The CVSS v4.0 gave VC:L/VI:L/VA:L, so low impact. In CVSS 3.1, low means partial. So C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would be base score 6.3 (medium). But the v4.0 score was low. Actually, in CVSS 4.0 low impact scores lead to low base score because impact is much lower. So in 3.1, the low impacts still give a medium score. But the description might actually allow full database access? The description doesn't specify magnitude, but the v4.0 vector gave low impacts. We'll stick with that. So the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we need to justify: It's a SQL injection with network vector, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality, integrity, availability impact. So rationale: "Requires low privileges (PR:L) and network access; low impact assumed due to limited data exposure." 14. "assessed_cvss_rationale": one sentence. "Network-exploitable with low privileges; low impact assumed from description and similar CVSS scores." Or "SQL injection with low complexity, low privileges; limited to low data impact." So: "Low attack complexity and privileges; limited confidentiality, integrity, and availability impact based on vulnerability report." 15. "assessed_cvss40_vector": We'll use the provided v4.0 vector as base, but we must ensure it's consistent with our 3.1 assessment. The v4.0 vector provided actually has AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's the base vector. That's already the vector we'd use. So we can output that. But if we need to provide our own independent one, it's the same. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now, assemble the JSON. All fields strings, no arrays. Make sure not to copy description, original synthesis. Use the terms as per rules: exploitation conditions, confidence, etc. For prevalence, we said low, basis: "Niche web framework with limited enterprise deployment." Risk assessment: must contrast CVSS score (low base score in v4.0) with EPSS (low). The v4.0 score was 2.3, but v3.1 would be 6.3, but the provided score is 2.1 (likely they computed v4.0 base). So we'll mention that the CVSS v4.0 base score is low (2.3), indicating low severity, EPSS very low, no active exploitation, no KEV. So risk is low. Patch missing but impact limited. Remediation: note that vendor did not respond so no patch, suggest parameterized queries, WAF, restrict access. Also mention that since PR:L, only authenticated users can exploit, so limiting access further reduces risk. Attack chain: I'll structure as: "Authenticate as low-privileged user → Locate vulnerable endpoint → Send crafted HTTP request with malicious sort parameter → SQL injection modifies query logic
Path traversal in WebStack-Guns 1.0 exposes arbitrary server-side files to unauthenticated remote attackers through the CAPTCHA image rendering endpoint. The `renderPicture` function in `KaptchaController.java` fails to sanitize user-supplied file path input, allowing directory traversal sequences to escape the intended image directory and read sensitive files such as configuration files, credentials, or application source. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, leaving version 1.0 permanently unpatched.
Server-side request forgery in orion-ops allows authenticated remote attackers to manipulate SSH connection parameters (host, port, credentials) to trigger outbound requests from the server, potentially reaching internal services. The vulnerability affects all versions up to commit 5925824 and has a publicly available proof-of-concept exploit. Exploitation requires low-privilege access and may impact confidentiality, integrity, and availability of internal assets.
A security vulnerability in orionsec orion-ops (CVSS 7.3). Risk factors: public PoC available.
A security vulnerability in orionsec orion-ops (CVSS 4.3). Risk factors: public PoC available.
A security vulnerability in nutzam NutzBoot (CVSS 7.3). Risk factors: public PoC available.
Deserialization in nutzam NutzBoot's LiteRpc-Serializer component allows remote attackers to potentially read sensitive data from affected systems. An exploit is publicly available; no active exploitation has been confirmed. The vulnerability carries an extremely low CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact, though real-world impact may be greater if deserialization gadget chains permit arbitrary code execution.
Information disclosure in NutzBoot 2.6.0-SNAPSHOT allows remote attackers with low privileges to access sensitive Ethereum wallet data via a manipulation of the EthModule.java endpoint. Public exploit code is available, but no active exploitation has been confirmed; EPSS estimates very low exploitation probability (0.04%).
A vulnerability was identified in Scada-LTS up to 2.7.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in the Keycloak LDAP User Federation provider. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Improper Control of Generation of Code ('Code Injection') vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw has been found in Dromara dataCompare up to 1.0.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in wwwlike vlife up to 2.0.1.java of the component VLifeApi. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A weakness has been identified in lsfusion platform up to 6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in lsfusion platform up to 6.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in lsfusion platform up to 6.1. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224.java. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management module, it is possible to execute any Java class with a. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dataease is an open source data visualization analysis tool. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.
Information disclosure in the Jenkins Eggplant Runner Plugin (0.0.1.301.v963cffe8ddb_8 and earlier) weakens a built-in Java runtime safeguard by clearing the `jdk.http.auth.tunneling.disabledSchemes` system property, which by default stops the JDK from answering a proxy 407 challenge with Basic credentials over an HTTP CONNECT tunnel. The practical exposure is narrow: it only matters when the Jenkins controller or agent makes outbound HTTPS connections through a proxy that uses Basic authentication, and a privileged attacker already positioned to intercept traffic between Jenkins and that proxy must be present to observe the re-enabled credential exchange - reflected in the High attack-complexity rating (CVSS 5.9, AC:H, PR:N, UI:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS is low at 0.32% (23rd percentile); this is a moderate-priority hardening issue rather than an urgent one.
Remote code execution in Shiyi Blog up to version 1.2.1 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization in the Job Handler component (SysJobController.java). The CVSS score of 2.1 reflects required authenticated access and limited scope, but the combination of public exploit availability, demonstrated deserialization flaw, and network accessibility creates moderate operational risk despite the low severity rating.
Improper authorization in TIME-SEA-PLUS PayController.java alipayIsSucceed function allows authenticated remote attackers to disclose sensitive information related to order status handling. The vulnerability affects versions up to commit fb299162f18498dd9cf17da906886d80a077d53b, with publicly available exploit code disclosed but low real-world exploitation probability (EPSS 0.03%). Attack requires valid user credentials and network access but does not enable privilege escalation or data modification.
Tibbo AggreGate Network Manager versions below 6.40.05 expose Java system properties, server path details, and version information to unauthenticated remote attackers through the /cwmp/happyaxis.jsp diagnostic endpoint, requiring no credentials or user interaction (CVSS 4.0 6.9, CVSS 3.1 C:L). The EPSS score is 0.37% (29th percentile) and no public exploit identified at time of analysis; this CWE-497 information disclosure is reconnaissance-only and does not by itself grant access, modify data, or disrupt service, though internet-exposed instances remain the highest risk.
Integrity-only data modification in Oracle Database Server's Java VM component (versions 19.3-19.28, 21.3-21.19, and 23.4-23.9) allows unauthenticated, network-positioned attackers to create, delete, or modify critical data or all Java VM accessible data via Oracle Net, though high attack complexity (AC:H) makes exploitation difficult and no public exploit is identified at time of analysis. Oracle's October 2025 Critical Patch Update addresses this moderate-severity (CVSS 5.9) vulnerability, which has a low EPSS score (0.23%, 13th percentile) and is not listed in CISA KEV.
Unauthorized read of a limited subset of runtime data is possible in Oracle GraalVM for JDK 17.0.16 and 21.0.8 through the Compiler component, reachable by an unauthenticated attacker with network access (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 3.7). The weakness is rated high attack complexity because the attacker must satisfy undisclosed, difficult-to-control preconditions, which is why Oracle labels it difficult to exploit; there is no integrity or availability impact. No public exploit code has been identified, EPSS is 0.26% (17th percentile), and there is no CISA KEV listing, so this is a low-priority item limited to deployments actually running the two affected GraalVM for JDK versions in a network-reachable configuration.
Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows remote unauthenticated attackers to alter sensitive data through APIs and multiple protocols via difficult-to-exploit integrity bypass. Affected versions include Java SE 21.0.8 and 25, GraalVM for JDK 21.0.8, and GraalVM Enterprise Edition 21.3.15. The vulnerability carries a low EPSS score (0.03%, 10th percentile) and no active exploitation has been identified, indicating limited real-world priority despite network accessibility.
Unauthorized data access in Oracle Java SE JAXP component allows remote unauthenticated attackers to exfiltrate sensitive information from multiple Java platforms including Oracle Java SE (8u461 through 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). Exploitation requires no authentication, low complexity, and can occur through web services supplying malicious data to JAXP APIs or via sandboxed Java Web Start/applet deployments loading untrusted code. Oracle released patches in October 2025 Critical Patch Update with EPSS data unavailable at time of analysis. CVSS 7.5 reflects pure confidentiality impact with network attack vector.
Improper access control in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to create, delete, or modify critical data when APIs in the Security component are exposed via web services or similar mechanisms. The vulnerability affects Java 8u461 through 25 and carries a CVSS 5.9 with high integrity impact, though exploitation is difficult (AC:H) and no public exploit or active KEV status has been confirmed.
Apache Syncope's pluggable extension mechanism lets a user holding administrator rights supply custom interface implementations as Groovy classes that are compiled and reloaded at runtime by the Syncope Core, and because that code was not isolated, a malicious administrator can inject Groovy code that executes remotely on the Core instance with the full privileges of the Syncope process, affecting confidentiality, integrity, and availability. The flaw is reachable only by an authenticated administrator (CVSS 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) - unauthenticated or low-privileged users cannot trigger it - and it affects Apache Syncope 3.0.x before 3.0.14 and 4.0.x before 4.0.2. No public exploit code or confirmed active exploitation has been identified at time of analysis; the practical risk is best characterized as access-gated insider or compromised-admin abuse rather than a mass-exploitation threat.
Spring Framework versions 5.3.0 through 6.2.11 are vulnerable to a CSRF bypass in STOMP over WebSocket support, allowing an unauthenticated attacker to send unauthorized messages by tricking a victim into visiting a malicious page. This moderate-severity issue (CVSS 4.3) requires user interaction and only affects applications using Spring's STOMP/WebSocket messaging; confidentiality and availability are not impacted. No public exploit identified at time of analysis, and the EPSS score is low (0.31%, 22nd percentile).
Spring Cloud Gateway Server Webflux can expose environment variables and system properties when an untrusted third party can create a route using SpEL against an enabled, reachable, and unsecured gateway actuator endpoint. This is an information-disclosure issue, not remote code execution, and Spring Cloud Gateway Server WebMVC is not affected. Exploitation requires non-default actuator configuration such as management.endpoints.web.exposure.include=gateway together with management.endpoint.gateway.enabled=true or management.endpoint.gateway.access=unrestricted, so hardened deployments that keep the gateway actuator disabled or secured are not exposed; no public exploit identified at time of analysis, and EPSS is low at 0.48% (39th percentile).
Improper access control in WSO2 API Manager 2.0.0 through 3.2.1 and WSO2 API Control Plane 4.5.0 allows an authenticated low-privileged user to reach certain internal SOAP Admin Services and System REST APIs and perform unauthorized operations, including disclosure of server-level information. The issue is network-reachable with low attack complexity and confidentiality-only impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and APIs exposed through the API Manager's API Gateway data plane are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Server-side request forgery in the Remote Browser Plugin of Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate stored proxy repository credentials via crafted HTTP requests. Exploitation requires the Remote Browser Plugin to be enabled and the instance to have stored proxy repository credentials; Nexus Repository 3.x is not affected. No public exploit identified at time of analysis, and this is a genuinely high-risk issue that warrants prompt attention on affected instances.
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).
Information disclosure in kaifangqian-base's SysUserController.getAllUsers endpoint allows authenticated remote attackers to retrieve sensitive user data. The vulnerability affects the function up to commit 7b3faecda13848b3ced6c17c7423b76c5b47b8ab and requires login credentials (PR:L in CVSS 4.0), limiting exposure to authenticated users. Public exploit code exists, but the low CVSS score (2.1) and minimal EPSS percentile (8%) suggest limited real-world exploitation despite public availability.
Authorization bypass in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to manipulate the subjectId parameter in WrongBookController.java to access unauthorized resources. The vulnerability has a low CVSS score (2.1) due to limited confidentiality impact and requirement for prior authentication, but publicly available exploit code exists and the attack vector is entirely network-accessible.
Unrestricted file upload in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to upload arbitrary files via the uploadFile function in UploadController.java, potentially enabling remote code execution or system compromise. The vulnerability has publicly disclosed exploit code available. Despite a low CVSS score of 2.1 reflecting limited direct impact scope, the presence of public exploits and authentication bypass tags suggests practical exploitation risk in environments where attacker access is feasible.
Stored cross-site scripting (XSS) in westboy CicadasCMS Template Management Page allows high-privileged users to inject malicious scripts via the Save function in TemplateFileServiceImpl.java, affecting downstream users who interact with stored templates. The vulnerability requires high privileges and user interaction but carries CVSS 1.9 due to minimal integrity impact; however, publicly available exploit code exists, indicating real disclosure despite extremely low exploitation probability (EPSS 0.03%).
Absolute Secure Access deployments prior to version 14.10 ship a Warehouse component whose Java keystore file is written with overly permissive filesystem permissions, letting any local account read its contents. Exploitation is local, not remote: an attacker must already hold low-privileged access to the host and the version must predate 14.10, and success yields only keystore disclosure (confidentiality low, no integrity or availability impact) rather than code execution or privilege escalation. EPSS is negligible (0.03%, 8th percentile), there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor has released a fix, so this is a low-priority information-disclosure issue.
Hardcoded cryptographic key in Flock Safety DetectionProcessing app for ANPR. PoC available.
Arbitrary code execution in QOS.CH logback-core through 1.5.18 allows attackers with write access to a logback configuration file (or the ability to set environment variables) to execute Java code via the conditional configuration feature when the Janino library and Spring Framework are also on the classpath. No public exploit identified at time of analysis and EPSS is low (0.06%), but the issue is tagged as RCE in widely deployed Java logging infrastructure and a vendor patch is available.
Knowage is an open source analytics and business intelligence suite. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in file AssistantController.java in ThriveX Blogging Framework 2.5.9 thru 3.1.3 allowing unauthenticated attackers to gain sensitive information such as API Keys via the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Accela Automation Platform 22.2.3.0.230103 contains multiple vulnerabilities in the Test Script feature. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AddrController. Rated high severity (CVSS 8.0), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in fcba_zzm ics-park Smart Park Management System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. Rated low severity (CVSS 2.3), this vulnerability is no authentication required. No vendor patch available.
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would. Rated low severity (CVSS 3.4), this vulnerability is low attack complexity. No vendor patch available.
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. No vendor patch available.