N A
Monthly
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Cross-site scripting in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a network-accessible, unauthenticated attacker to inject malicious JavaScript into user-controlled fields (Role Name, First Name, Last Name, Username) that is subsequently rendered to authenticated users - most likely administrators reviewing account data. Exploitation yields client-side arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is recorded in CISA KEV, and EPSS indicates a 0.19% probability of near-term exploitation; however, a public researcher writeup exists on GitHub (FahadAljuaid), meaningfully raising practical risk.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the `email_templates_key` parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
sqlite 3.41 has a use-after-free vulnerability in the memory buffer processing logic. Remote attackers can exploit this flaw via specially crafted input to cause arbitrary code execution, sensitive information leakage, or service denial.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQLite 3.41 is vulnerable to use after free in the jsonArrayLengthFunc function.
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memory information leakage.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL Injection in kishan0725 Hospital Management System 4.0 exposes patient medical history records to unauthenticated remote attackers via the `viewid` parameter of the `view-medhistory.php` endpoint. The CVSS vector confirms no authentication, complexity, or user interaction is required, and the SSVC framework independently verifies a proof-of-concept exists and the attack is fully automatable. Despite a low EPSS score of 0.14%, the sensitivity of medical record data and zero-barrier exploitation make any internet-exposed instance a meaningful risk; no public exploit identified at time of analysis as confirmed active exploitation (KEV not listed).
Unauthorized disclosure of employee compensation data affects Infor Global HR v11.24.10.01.33, where the Employee Compensation View function fails to verify that the requesting user owns the record being retrieved. By altering an identifier in a crafted GET request, an attacker can enumerate and read the salary and compensation details of arbitrary employees. There is no public exploit identified at time of analysis, though a third-party technical writeup describing the issue is referenced.
SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.
Cross-site scripting in nice-select2 before 2.4.1 allows attackers to inject arbitrary scripts via malicious <select> element content that is rendered unsanitized into the DOM. Vulnerable if the application reflects user-controlled data into a <select> element that is transformed by nice-select2. User interaction required; no public exploit or active exploitation known.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Denial of service in OpenSBI 1.3 allows remote, unauthenticated attackers to crash the system via crafted requests to the SBI PMU extension's counter configuration function (SBI function #2). The flaw, classified as uncontrolled resource consumption (CWE-400), can be triggered without user interaction and is rated high severity (CVSS 7.5). While no active exploitation is confirmed (not in CISA KEV) and EPSS remains very low (0.14%), a proof-of-concept crash is publicly available, making it a concern for RISC-V platforms in multi-tenant or exposed firmware environments.
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Incorrect NSEC owner computation in the mod-onlinesign module of Knot DNS can cause overly broad authenticated denial intervals, allowing downstream validating resolvers that use aggressive negative caching to synthesize negative answers for legitimate names, resulting in resolver-side denial of service. This issue affects versions before 3.4.10 and 3.5.x before 3.5.4, and is exploitable by a low-privileged authenticated user. No active exploitation or public proof-of-concept code is currently known.
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
Mark-of-the-Web bypass in BandiZip 7.37 allows remote attackers to craft archives that, when extracted, fail to propagate zone identifiers to extracted files, letting malicious executables run without security warnings. A public proof-of-concept is available; the EPSS exploitation probability is low (0.39%).
Denial of service in Unistal Protegent 360 v2.0.0.4 allows a local low-privileged attacker to crash the system by exploiting uncontrolled resource consumption via the sub_13828 function. A proof of concept is publicly available, but no active exploitation has been reported, and EPSS score indicates a low likelihood of widespread attacks.
Remote code execution in CoffeeZip v4.8.0.0 allows attackers to achieve full system compromise via a crafted archive file. The flaw requires user interaction, with no authentication needed, and has a CVSS score of 8.8 but low EPSS (0.22%) and no evidence of active exploitation.
Remote code execution in OneCommander v3.96.0.0 allows attackers to execute arbitrary code via the main executable component when a user interacts with malicious content. The vulnerability (CWE-693) has a high CVSS score but low EPSS exploitation probability and no known active exploitation. A public GitHub reference exists, suggesting disclosure of technical details, though exploit availability is unconfirmed.
Remote code execution in Franco Corbelli ZPAQFRANZ v.61.3 and earlier allows an attacker to bypass the Mark-of-the-Web (MotW) protection mechanism, potentially leading to arbitrary code execution with the user's privileges. The vulnerability requires user interaction, such as extracting a malicious ZPAQ archive, and no credentials are needed. Exploitation has not been confirmed in the wild, and EPSS estimates a low 0.35% probability, though public proof-of-concept details may exist.
Remote code execution in NCH ExpressZip v11.29 allows attackers to execute arbitrary code by convincing a user to open a crafted archive file. The vulnerability is a protection mechanism failure (CWE-693) with no authentication required and user interaction needed. No active exploitation or public exploit is confirmed at this time.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-50329 from multiple intelligence sources. The output must be a single JSON object with specific fields. We must use all data provided: description, CVSS, EPSS, tags, SSVC, CPE, references, etc. And follow precision rules. Let's review the input data: - CVE ID: CVE-2025-50329 - Description: "An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe." - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-693 (Protection Mechanism Failure) - EPSS: 0.36% (percentile 28%) - low - Tags: RCE, N A (maybe "N/A"?) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* - this is weird, maybe placeholder. - Affected versions EUVD: ["n/a n/a"] - References: - https://www.powerarchiver.com/ (vendor site) - https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md (a GitHub reference, likely a PoC/advisory) - https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450 (commit diff) - Source code evidence from GitHub: shows a diff in CVE-2025-50329.md. The diff shows a fix: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - the original line had a trailing space? Actually the diff shows a line change on line 15+4: the original had a space at end? It's unclear. But the important part is the description in the diff context: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - suggests the vulnerability is related to Mark-of-the-Web handling during extraction, leading to code execution? The commit just removed a trailing space, but the file content itself might have more info. We can view the GitHub file to see the full description. But we only have this diff snippet. We'll infer from the CVE description and tags. Additional info: The CVE description mentions "escalate privileges and execute arbitrary code via the powerarc.exe". No explicit mention of authentication, but CVSS says PR:N so unauthenticated. No mention of KEV, so no active exploitation. No POC tag? Tags include "RCE, N A" - maybe "N A" means "not applicable"? Possibly "no auth"? Not sure. The GitHub repo "Public-references" could contain a proof-of-concept or at least a reference. Given that there's a GitHub reference, likely a public PoC exists. The SSVC says exploitation=none, but automatable=yes, which could mean it's easy to automate. EPSS is 0.36% (low) suggests low likelihood of exploitation in the wild right now. However, the CVSS is critical 9.8, so there is a tension: high CVSS, low EPSS. No KEV listing. We need to construct the JSON. Let's break down each field: product_name: "Power Archiver" (from ConeXware, Inc Power Archiver version 22.00.11 and before). So simply "Power Archiver". summary: Must be original synthesis, not copying description. Start with impact verb and product. So: "Remote code execution in Power Archiver 22.00.11 and earlier allows unauthenticated attackers to escalate privileges and execute arbitrary code via the powerarc.exe executable." Mention EPSS low, no KEV, PoC possibly available? The references suggest a GitHub advisory with details, so likely PoC. Should mention "publicly available exploit code exists" if we infer that. But precision rule: "If POC=YES but no KEV: 'publicly available exploit code exists'". We don't have explicit POC=YES, but the GitHub reference likely is a PoC repo. The commit message doesn't reveal exploit code, just a diff of the markdown file. But the file itself might contain PoC. Since it's from a repository named "Public-references" and the CVE ID is in the title, it's reasonable that the public reference includes exploit details. However, we must be careful: we only have the diff snippet, which just shows a change to the markdown file. The full file might describe the vulnerability and maybe a PoC. But we can't be certain there's a functional exploit. The SSVC says "Exploitation: none", meaning no evidence of exploitation. So I'll assume no active exploitation, but there might be a public technical write-up with possibly PoC details. The precision rule for "publicly available exploit code exists" would be if POC=YES. The input doesn't explicitly say POC=YES. I'll instead say "A technical write-up is publicly available; no exploit code has been confirmed" or something. But the instruction says: "If POC=YES but no KEV: 'publicly available exploit code exists'". Since POC flag isn't given, I'll use "no public exploit identified at time of analysis" as per rule: "If neither: 'no public exploit identified at time of analysis'". That would be conservative. However, the GitHub reference might be a PoC; the file name "CVE-2025-50329.md" could contain steps to reproduce. But the diff only shows a line about Mark-of-the-Web extraction. It's not a functional exploit. So I'll stick with "no public exploit identified at time of analysis". But we can note the existence of a technical write-up. The summary can mention "A proof-of-concept may be available" but the precision rule forbids speculation. I'll avoid claiming exploit code exists. So summary: "Remote code execution in Power Archiver 22.00.11 and earlier allows remote attackers to escalate privileges and execute arbitrary code. The flaw is reachable over the network without authentication. EPSS predicts low exploitation probability, but the vulnerability is easily automatable and has total technical impact." I'll incorporate that. technical_context: Underlying technology: Power Archiver is a file compression utility. The vulnerability likely stems from improper handling of Mark-of-the-Web when extracting archive files, leading to a protection mechanism failure (CWE-693) that allows arbitrary code execution. The CPE string is cpe:2.3:a:n/a:n/a, which seems generic, so we'll note that specific product CPE is missing but the affected product is Power Archiver versions up to 22.00.11. The exact root cause: When extracting files from archives that bear Mark-of-the-Web, PowerArchiver fails to apply proper security restrictions, allowing unsigned code to execute with elevated privileges. The attack vector is through the powerarc.exe executable. Since it's a remote attack (AV:N), the method likely involves sending a malicious archive to a user or a server that processes archives with PowerArchiver, leading to code execution. So educational: Mark-of-the-Web is a Windows mechanism that flags files downloaded from the internet; bypassing it can lead to arbitrary code execution. risk_assessment: Use all signals. CVSS 9.8: network, low complexity, no privileges, no user interaction, scope unchanged, high impact. EPSS 0.36% (28th percentile) suggests low likelihood of exploitation in the wild currently. No KEV listing, so not actively exploited. SSVC: exploitation none, automatable yes, technical impact total. The low EPSS despite high CVSS indicates that while theoretically critical, real-world exploitation is not widespread, perhaps due to limited deployment footprint or other factors. The SSVC automatable=yes with exploitation=none suggests that it could be exploited automatically if motivated attackers target it. The missing CPE data (n/a) indicates no precise product matching, which may affect vulnerability scanners' ability to detect it. POC status unknown. The risk assessment should contrast CVSS with EPSS and mention that it's a critical-severity but not actively exploited, so prioritize based on asset exposure. I'll state that the vulnerability is severe but currently low-risk due to no known exploitation; organizations should still patch. affected_products: Write paragraph listing product, version, and advisory. From description: "ConeXware, Inc Power Archiver v.22.00.11 and before". So version 22.00.11 and earlier. The CVE references include vendor site powerarchiver.com and a GitHub advisory. I'll link to the GitHub advisory as the reference. So: "Power Archiver by ConeXware, Inc, version 22.00.11 and all prior versions are affected. The vendor advisory or confirmation is available at the GitHub reference: https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md. The CPE identifier is reportedly cpe:2.3:a:n/a:n/a, which does not precisely identify the product, but the vendor's website is https://www.powerarchiver.com." That should work. remediation: Start with primary fix: upgrade to a version later than 22.00.11, but the specific fixed version is not provided in the data. I'll check references: no mention of a patch version. The vendor site may have updates, but not given. So I'll state "Vendor-released patch: exact fix version not confirmed in the advisory; update to the latest version of Power Archiver beyond 22.00.11 as provided by ConeXware." If no patch, suggest workarounds: Disable automatic extraction of archives from the internet, ensure Mark-of-the-Web protections are enforced, or avoid opening untrusted archives. Since the vulnerability involves Mark-of-the-Web bypass, ensuring Windows security settings are enabled and not using PowerArchiver for untrusted archives could mitigate. Actionable: "Until a patched version is applied, users should avoid extracting archives from untrusted sources with PowerArchiver, and ensure that the 'Unblock' option is not used for files flagged with Mark-of-the-Web." Or use alternative extraction tools. I'll write: "Upgrade to the latest version of Power Archiver (beyond 22.00.11) as soon as a fix is available. In the interim, disable automatic extraction when downloading archives, avoid opening archives from untrusted sources with PowerArchiver, and consider using Windows built-in extraction tools that enforce Mark-of-the-Web properly. Monitor the vendor's website for an official advisory." I can cite the GitHub advisory as a reference for details. But the GitHub reference is not an official advisory, it's a public reference. The vendor website powerarchiver.com is the official source. I'll say: "No official patch version specified; refer to the vendor's website (https://www.powerarchiver.com) for updated versions." I'll note that the GitHub reference contains technical details. So remediation paragraph: "Upgrade Power Archiver to a patched version beyond 22.00.11 once released by ConeXware. As no fixed version number is confirmed in the vulnerability disclosure, consult the vendor's website for the latest update. For immediate mitigation, cease using Power Archiver to extract files from untrusted archives, particularly those bearing the Mark-of-the-Web, and rely on Windows' built-in extraction tools or other archivers that enforce security markings. Alternatively, block PowerArchiver's network access if feasible, but note this may impair legitimate functionality." exploit_scenario: "An attacker crafts a malicious archive file containing executable content and sends it to a victim, perhaps via email or a download link. When the victim extracts the archive using a vulnerable version of PowerArchiver, the Mark-of-the-Web is ignored, allowing the executable to run with elevated privileges, leading to code execution and system compromise." That's a realistic scenario. No PoC confirmed, but the description implies. exploitation_conditions: The CVE description says "via the powerarc.exe". The diff snippet mentions "extracting files from an archive that bears Mark-of-the-Web". So the condition is: user must extract a specially crafted archive using PowerArchiver on a Windows system where Mark-of-the-Web is present. No authentication required. So specific conditions: "Victim must extract a malicious archive file using Power Archiver 22.00.11 or earlier on a Windows system where the archive carries the Mark-of-the-Web. No authentication or special configuration is required." The limiting factor: requires user interaction (UI:N, but actually the user must open the archive). Wait, CVSS says UI:N, which means no user interaction is required. That seems contradictory to the extraction process. Possibly the attack can be triggered automatically when PowerArchiver processes an archive without user interaction, e.g., as a service? The description just says "via the powerarc.exe" — maybe it's a network-accessible service
Remote code execution in ZipGenius 6.3.2.3116 and earlier allows attackers to trick users into opening malicious ZIP files, leading to arbitrary code execution with user privileges. No active exploitation or CISA KEV listing exists; EPSS indicates low exploitation probability, but the CVSS base score of 8.8 reflects potential total system compromise.
Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.
Stored cross-site scripting in Mettle SendPortal 3.0.1 and earlier enables persistent JavaScript injection through the content parameter of the /templates endpoint, with payloads executing in every browser that subsequently renders the poisoned template. A public proof-of-concept is hosted on GitHub Gist, providing low-effort reproduction for threat actors. Despite CISA SSVC assessing current exploitation as none, the scoped impact (S:C) means a single injected template can cascade across all users who view it, making this a meaningful session-hijacking or credential-harvesting vector for organizations relying on SendPortal for email campaign management.
Remote code execution affects safishamsi GRAPHIFY versions 0.3.2 through 0.4.29 via a DNS rebinding attack targeting its URL-fetching subsystem. The functions validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary are exploitable when a maliciously controlled hostname performs DNS rebinding to bypass the URL validation layer, allowing an attacker to pivot into internal network resources and ultimately achieve code execution. A public proof-of-concept repository exists; no KEV listing is present at time of analysis, though the PoC lowers the bar for exploitation.
Directory traversal in FileThingie v.2.5.7 allows a remote, low-privileged attacker to read arbitrary files outside the application's intended directory boundary via a crafted HTTP request. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation with high confidentiality impact and no write or availability consequences. No confirmed active exploitation (CISA KEV) is recorded, but a public vulnerability research repository referencing this CVE exists, suggesting proof-of-concept material may be available.
Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Unauthenticated remote access to the project upload endpoint in Gerapy up to 0.9.13 is possible because the `@permission_classes([IsAuthenticated])` decorator was commented out in `gerapy/server/core/views.py`, permitting any network-reachable attacker to submit arbitrary zip archives without credentials. Source code review of patch commit bd4891c6 (PR #319) reveals that the same unpatched endpoint also contained a Zip Slip (path traversal) flaw in the archive extraction logic, meaning the combined exposure allows unauthenticated arbitrary file writes to any path the Gerapy process can reach. A public proof-of-concept has been disclosed via GitHub issue #317; this CVE is not currently listed in the CISA KEV catalog.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Cross-site scripting in Proxmox Virtual Environment (PVE) 8.x and 9.x allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in the browser of an authenticated PVE user who interacts with a crafted payload. The CVSS scope change (S:C) confirms the injected script executes outside the originating component's security context, enabling session hijacking, credential theft, or unauthorized management actions against the hypervisor web UI. SSVC classifies exploitation status as none with no automation possible, and no active exploitation or public exploit code has been identified at time of analysis.
NoSQL injection in AhnLab EPP (Endpoint Protection Platform) Management v1.0.14.32-6249 allows an authenticated attacker to manipulate backend NoSQL queries through the eventlog/agentEvent/list endpoint, as the CVSS:3.1 vector (PR:L) indicates a low-privilege authenticated session is required. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H), enabling extraction or tampering of security event-log data across the managed endpoint fleet. A public GitHub repository named for this CVE suggests exploit/PoC material may exist; it is not listed in CISA KEV and no EPSS score was provided.
Incorrect access control in the Proxmox Virtual Environment qemu-server component exposes hashed passwords to authenticated low-privilege users via the cloudinit/dump API endpoint. Affects PVE 8.x before 8.4.8 and 9.x before 9.1.8. An attacker with minimal PVE credentials can retrieve cloud-init password hashes for VMs, enabling offline cracking and potential lateral movement into guest systems. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Output-handling discrepancy in the OpenRISC OR1200 soft-core CPU (commit 83ac6b) causes the CPU output port to differ between the RTL source and the synthesized netlist, producing unexpected hardware behavior. The flaw was surfaced by the academic SynFuzz hardware-fuzzing research (arXiv 2504.18812) rather than in-the-wild attacks, affects the open-source mor1kx/OR1200 core used mainly in research and FPGA/SoC prototyping, and has no public exploit identified at time of analysis. Assigned CVSS 9.1 (NVD/MITRE) but with a very low EPSS of 0.17% (6th percentile), reflecting a research-grade correctness finding rather than a mass-exploitation threat.
Path traversal in LogicalDOC Enterprise up to v9.1.1 allows any authenticated user to read arbitrary files outside designated directories via the OnlyOfficeEditor servlet's fileExt parameter. Exploitation requires only a low-privilege account, no special configuration, and results in high confidentiality impact - potentially exposing system credentials, configuration files, or other sensitive data. A public vulnerability disclosure exists on GitHub (netero1010), indicating exploit techniques are accessible to the public; EPSS is low (0.33%) suggesting limited observed exploitation to date.
SQL injection in LogicalDOC Enterprise (versions up to and including 9.1.1) lets an authenticated user tamper with backend database queries through the ComparisonServlet component, which fails to properly sanitize user-supplied input. Because it is a blind injection, an attacker infers data through boolean/time-based inference rather than direct output, and the CVSS 8.8 vector (PR:L) indicates any low-privileged authenticated account can achieve high confidentiality, integrity, and availability impact. A public technical disclosure (netero1010) documents the flaw, but it is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), so widespread automated exploitation is not currently indicated.
Privilege-free process termination in OPSWAT AppRemover Driver (ardrv.sys v2017.10.02.1551 and earlier) allows any locally authenticated user to kill arbitrary processes - including endpoint security tools - by sending crafted requests to IOCTL handler 0x2420031 without any privilege validation. A public proof-of-concept is available on GitHub (redteamfortress/CVE-2026-36425), making this immediately reproducible by insider threats or post-compromise attackers seeking to disable defenses. No active exploitation has been confirmed in CISA KEV, but the defense-evasion potential elevates operational priority in environments running OPSWAT's OESIS Framework.
Denial of service in BusyBox's AWK interpreter (editors/awk.c, commit 371fe9) lets an attacker crash the awk process by feeding it a crafted AWK script that overflows the stack inside the recursive evaluate() function. The impact is limited to availability (process crash) with no data exposure or code execution claimed; no public exploit identified at time of analysis and EPSS is very low (0.16%, 6th percentile). BusyBox is extremely widespread in embedded Linux, IoT firmware, and container base images, but exploitation requires the attacker to supply the script that awk executes, which materially narrows real-world reach.
Denial of service in BusyBox 1.38.0 lets attackers crash the bundled ash shell by supplying crafted input that triggers a heap-based buffer overflow (CWE-122) in the ifsbreakup() field-splitting routine of shell/ash.c. Only availability is impacted - there is no public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile), indicating little observed exploitation interest so far. The NVD-assigned CVSS of 7.5 rests on a network attack vector that is not clearly supported by the description, which points to input being fed to a local shell.
Remote command execution in Open Source GPT Researcher v3.3.7 lets attackers run arbitrary OS commands on a victim's machine when the user interacts with a crafted HTML page, exploiting a command injection (CWE-77) weakness. The flaw was reported by MITRE and detailed in ox.security research covering RCE across the AI/MCP ecosystem; no public exploit is identified in CISA KEV, and EPSS probability is low (0.21%). Because GPT Researcher autonomously fetches and processes web content, a malicious page encountered during a research run can drive execution on the host.
Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).
Missing SSH host key verification in Dulwich's paramiko vendor module exposes SSH connections to man-in-the-middle interception. The contrib/paramiko_vendor.py module used paramiko's MissingHostKeyPolicy, which silently accepts any server host key without checking it against known_hosts, allowing a network-positioned attacker to impersonate a legitimate SSH Git server. No public exploit has been identified at time of analysis and EPSS sits at 0.14% (4th percentile), but the attack is conceptually straightforward for any attacker with network access between client and server.
Reflected Cross-Site Scripting in xxl-job-admin v.3.0.0 allows a remote unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by tricking an authenticated user into clicking a crafted HTTP GET request containing an unsanitized malicious script payload. The vulnerability carries a CVSS 3.1 score of 6.1 with Scope Changed, indicating the injected script can affect browser-level resources beyond the immediate application context, enabling session hijacking, credential theft, or redirection against admin-level users. No public exploit identified at time of analysis in CISA KEV, though a public PoC repository exists and the EPSS score sits at the 31st percentile, indicating modest but non-trivial exploitation interest.
Denial of service in BusyBox 1.38.0 stems from a heap-based buffer overflow in the evalcommand() routine of the ash shell interpreter (shell/ash.c), where crafted input corrupts heap memory and crashes the process. No public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile), indicating no observed exploitation activity. Impact is limited to availability - no confidentiality or integrity loss is claimed per the CVSS vector.
Prototype pollution in Tamagui's updateConfig function allows authenticated remote attackers to inject arbitrary properties into the JavaScript Object prototype, affecting all versions through 2.3.0. The flaw in code/core/web/src/config.ts permitted passing '__proto__' as the key argument to updateConfig, causing Object.assign to merge attacker-controlled values directly onto Object.prototype. No public exploitation (KEV) is confirmed, but proof-of-concept exploit code exists per SSVC assessment; EPSS at 0.34% (26th percentile) reflects limited observed exploitation interest at time of analysis.
Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a connecting client by returning a malformed Server_NamespaceArray during session establishment, causing denial of service. The flaw is client-side only - server deployments are unaffected - and exploitation requires the attacker to control or impersonate a server the vulnerable client connects to, making practical exploitation high-complexity. A proof-of-concept exists as a GitHub issue report; no public exploit is confirmed as weaponized and the vulnerability is not listed in CISA KEV.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Cross-site request forgery in RackTables through version 0.22.0 enables remote attackers to perform unauthorized state-changing actions against authenticated users' sessions by enticing them to visit attacker-controlled pages. The project maintainer has publicly confirmed the complete absence of any CSRF protection across the entire codebase and has explicitly declined to commit to a timely fix, making this a persistent, unfixed exposure. A public POC exists on GitHub; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited integrity-only impact and mandatory user interaction requirement.
Cross-site scripting in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a network-accessible, unauthenticated attacker to inject malicious JavaScript into user-controlled fields (Role Name, First Name, Last Name, Username) that is subsequently rendered to authenticated users - most likely administrators reviewing account data. Exploitation yields client-side arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is recorded in CISA KEV, and EPSS indicates a 0.19% probability of near-term exploitation; however, a public researcher writeup exists on GitHub (FahadAljuaid), meaningfully raising practical risk.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.
Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the `email_templates_key` parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
sqlite 3.41 has a use-after-free vulnerability in the memory buffer processing logic. Remote attackers can exploit this flaw via specially crafted input to cause arbitrary code execution, sensitive information leakage, or service denial.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQLite 3.41 is vulnerable to use after free in the jsonArrayLengthFunc function.
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memory information leakage.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL Injection in kishan0725 Hospital Management System 4.0 exposes patient medical history records to unauthenticated remote attackers via the `viewid` parameter of the `view-medhistory.php` endpoint. The CVSS vector confirms no authentication, complexity, or user interaction is required, and the SSVC framework independently verifies a proof-of-concept exists and the attack is fully automatable. Despite a low EPSS score of 0.14%, the sensitivity of medical record data and zero-barrier exploitation make any internet-exposed instance a meaningful risk; no public exploit identified at time of analysis as confirmed active exploitation (KEV not listed).
Unauthorized disclosure of employee compensation data affects Infor Global HR v11.24.10.01.33, where the Employee Compensation View function fails to verify that the requesting user owns the record being retrieved. By altering an identifier in a crafted GET request, an attacker can enumerate and read the salary and compensation details of arbitrary employees. There is no public exploit identified at time of analysis, though a third-party technical writeup describing the issue is referenced.
SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.
Cross-site scripting in nice-select2 before 2.4.1 allows attackers to inject arbitrary scripts via malicious <select> element content that is rendered unsanitized into the DOM. Vulnerable if the application reflects user-controlled data into a <select> element that is transformed by nice-select2. User interaction required; no public exploit or active exploitation known.
Denial of service in SQLite 3.41 due to a use-after-free in the JSON extraction function. A local unauthenticated attacker can trigger a crash by supplying a malicious JSON input, causing the host application to terminate. No active exploitation has been confirmed in the wild, but public exploit proof-of-concept may exist.
Denial of service in OpenSBI 1.3 allows remote, unauthenticated attackers to crash the system via crafted requests to the SBI PMU extension's counter configuration function (SBI function #2). The flaw, classified as uncontrolled resource consumption (CWE-400), can be triggered without user interaction and is rated high severity (CVSS 7.5). While no active exploitation is confirmed (not in CISA KEV) and EPSS remains very low (0.14%), a proof-of-concept crash is publicly available, making it a concern for RISC-V platforms in multi-tenant or exposed firmware environments.
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Incorrect NSEC owner computation in the mod-onlinesign module of Knot DNS can cause overly broad authenticated denial intervals, allowing downstream validating resolvers that use aggressive negative caching to synthesize negative answers for legitimate names, resulting in resolver-side denial of service. This issue affects versions before 3.4.10 and 3.5.x before 3.5.4, and is exploitable by a low-privileged authenticated user. No active exploitation or public proof-of-concept code is currently known.
OS command injection in oclif up to 4.23.16 allows a local attacker who can control the jitPlugins configuration to execute arbitrary shell commands through the JIT Plugin Entry Handler's unsafe use of child_process.exec. The root cause is that plugin names from the oclif.jitPlugins field in package.json are interpolated directly into shell command strings passed to exec(), enabling shell metacharacter injection. A public exploit exists (GitHub issue #2051) and a patch has been released replacing exec() with cross-spawn's argument-array-based spawn().
Mark-of-the-Web bypass in BandiZip 7.37 allows remote attackers to craft archives that, when extracted, fail to propagate zone identifiers to extracted files, letting malicious executables run without security warnings. A public proof-of-concept is available; the EPSS exploitation probability is low (0.39%).
Denial of service in Unistal Protegent 360 v2.0.0.4 allows a local low-privileged attacker to crash the system by exploiting uncontrolled resource consumption via the sub_13828 function. A proof of concept is publicly available, but no active exploitation has been reported, and EPSS score indicates a low likelihood of widespread attacks.
Remote code execution in CoffeeZip v4.8.0.0 allows attackers to achieve full system compromise via a crafted archive file. The flaw requires user interaction, with no authentication needed, and has a CVSS score of 8.8 but low EPSS (0.22%) and no evidence of active exploitation.
Remote code execution in OneCommander v3.96.0.0 allows attackers to execute arbitrary code via the main executable component when a user interacts with malicious content. The vulnerability (CWE-693) has a high CVSS score but low EPSS exploitation probability and no known active exploitation. A public GitHub reference exists, suggesting disclosure of technical details, though exploit availability is unconfirmed.
Remote code execution in Franco Corbelli ZPAQFRANZ v.61.3 and earlier allows an attacker to bypass the Mark-of-the-Web (MotW) protection mechanism, potentially leading to arbitrary code execution with the user's privileges. The vulnerability requires user interaction, such as extracting a malicious ZPAQ archive, and no credentials are needed. Exploitation has not been confirmed in the wild, and EPSS estimates a low 0.35% probability, though public proof-of-concept details may exist.
Remote code execution in NCH ExpressZip v11.29 allows attackers to execute arbitrary code by convincing a user to open a crafted archive file. The vulnerability is a protection mechanism failure (CWE-693) with no authentication required and user interaction needed. No active exploitation or public exploit is confirmed at this time.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-50329 from multiple intelligence sources. The output must be a single JSON object with specific fields. We must use all data provided: description, CVSS, EPSS, tags, SSVC, CPE, references, etc. And follow precision rules. Let's review the input data: - CVE ID: CVE-2025-50329 - Description: "An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe." - CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-693 (Protection Mechanism Failure) - EPSS: 0.36% (percentile 28%) - low - Tags: RCE, N A (maybe "N/A"?) - SSVC: Exploitation: none, Automatable: yes, Technical Impact: total - CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* - this is weird, maybe placeholder. - Affected versions EUVD: ["n/a n/a"] - References: - https://www.powerarchiver.com/ (vendor site) - https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md (a GitHub reference, likely a PoC/advisory) - https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450 (commit diff) - Source code evidence from GitHub: shows a diff in CVE-2025-50329.md. The diff shows a fix: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - the original line had a trailing space? Actually the diff shows a line change on line 15+4: the original had a space at end? It's unclear. But the important part is the description in the diff context: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - suggests the vulnerability is related to Mark-of-the-Web handling during extraction, leading to code execution? The commit just removed a trailing space, but the file content itself might have more info. We can view the GitHub file to see the full description. But we only have this diff snippet. We'll infer from the CVE description and tags. Additional info: The CVE description mentions "escalate privileges and execute arbitrary code via the powerarc.exe". No explicit mention of authentication, but CVSS says PR:N so unauthenticated. No mention of KEV, so no active exploitation. No POC tag? Tags include "RCE, N A" - maybe "N A" means "not applicable"? Possibly "no auth"? Not sure. The GitHub repo "Public-references" could contain a proof-of-concept or at least a reference. Given that there's a GitHub reference, likely a public PoC exists. The SSVC says exploitation=none, but automatable=yes, which could mean it's easy to automate. EPSS is 0.36% (low) suggests low likelihood of exploitation in the wild right now. However, the CVSS is critical 9.8, so there is a tension: high CVSS, low EPSS. No KEV listing. We need to construct the JSON. Let's break down each field: product_name: "Power Archiver" (from ConeXware, Inc Power Archiver version 22.00.11 and before). So simply "Power Archiver". summary: Must be original synthesis, not copying description. Start with impact verb and product. So: "Remote code execution in Power Archiver 22.00.11 and earlier allows unauthenticated attackers to escalate privileges and execute arbitrary code via the powerarc.exe executable." Mention EPSS low, no KEV, PoC possibly available? The references suggest a GitHub advisory with details, so likely PoC. Should mention "publicly available exploit code exists" if we infer that. But precision rule: "If POC=YES but no KEV: 'publicly available exploit code exists'". We don't have explicit POC=YES, but the GitHub reference likely is a PoC repo. The commit message doesn't reveal exploit code, just a diff of the markdown file. But the file itself might contain PoC. Since it's from a repository named "Public-references" and the CVE ID is in the title, it's reasonable that the public reference includes exploit details. However, we must be careful: we only have the diff snippet, which just shows a change to the markdown file. The full file might describe the vulnerability and maybe a PoC. But we can't be certain there's a functional exploit. The SSVC says "Exploitation: none", meaning no evidence of exploitation. So I'll assume no active exploitation, but there might be a public technical write-up with possibly PoC details. The precision rule for "publicly available exploit code exists" would be if POC=YES. The input doesn't explicitly say POC=YES. I'll instead say "A technical write-up is publicly available; no exploit code has been confirmed" or something. But the instruction says: "If POC=YES but no KEV: 'publicly available exploit code exists'". Since POC flag isn't given, I'll use "no public exploit identified at time of analysis" as per rule: "If neither: 'no public exploit identified at time of analysis'". That would be conservative. However, the GitHub reference might be a PoC; the file name "CVE-2025-50329.md" could contain steps to reproduce. But the diff only shows a line about Mark-of-the-Web extraction. It's not a functional exploit. So I'll stick with "no public exploit identified at time of analysis". But we can note the existence of a technical write-up. The summary can mention "A proof-of-concept may be available" but the precision rule forbids speculation. I'll avoid claiming exploit code exists. So summary: "Remote code execution in Power Archiver 22.00.11 and earlier allows remote attackers to escalate privileges and execute arbitrary code. The flaw is reachable over the network without authentication. EPSS predicts low exploitation probability, but the vulnerability is easily automatable and has total technical impact." I'll incorporate that. technical_context: Underlying technology: Power Archiver is a file compression utility. The vulnerability likely stems from improper handling of Mark-of-the-Web when extracting archive files, leading to a protection mechanism failure (CWE-693) that allows arbitrary code execution. The CPE string is cpe:2.3:a:n/a:n/a, which seems generic, so we'll note that specific product CPE is missing but the affected product is Power Archiver versions up to 22.00.11. The exact root cause: When extracting files from archives that bear Mark-of-the-Web, PowerArchiver fails to apply proper security restrictions, allowing unsigned code to execute with elevated privileges. The attack vector is through the powerarc.exe executable. Since it's a remote attack (AV:N), the method likely involves sending a malicious archive to a user or a server that processes archives with PowerArchiver, leading to code execution. So educational: Mark-of-the-Web is a Windows mechanism that flags files downloaded from the internet; bypassing it can lead to arbitrary code execution. risk_assessment: Use all signals. CVSS 9.8: network, low complexity, no privileges, no user interaction, scope unchanged, high impact. EPSS 0.36% (28th percentile) suggests low likelihood of exploitation in the wild currently. No KEV listing, so not actively exploited. SSVC: exploitation none, automatable yes, technical impact total. The low EPSS despite high CVSS indicates that while theoretically critical, real-world exploitation is not widespread, perhaps due to limited deployment footprint or other factors. The SSVC automatable=yes with exploitation=none suggests that it could be exploited automatically if motivated attackers target it. The missing CPE data (n/a) indicates no precise product matching, which may affect vulnerability scanners' ability to detect it. POC status unknown. The risk assessment should contrast CVSS with EPSS and mention that it's a critical-severity but not actively exploited, so prioritize based on asset exposure. I'll state that the vulnerability is severe but currently low-risk due to no known exploitation; organizations should still patch. affected_products: Write paragraph listing product, version, and advisory. From description: "ConeXware, Inc Power Archiver v.22.00.11 and before". So version 22.00.11 and earlier. The CVE references include vendor site powerarchiver.com and a GitHub advisory. I'll link to the GitHub advisory as the reference. So: "Power Archiver by ConeXware, Inc, version 22.00.11 and all prior versions are affected. The vendor advisory or confirmation is available at the GitHub reference: https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md. The CPE identifier is reportedly cpe:2.3:a:n/a:n/a, which does not precisely identify the product, but the vendor's website is https://www.powerarchiver.com." That should work. remediation: Start with primary fix: upgrade to a version later than 22.00.11, but the specific fixed version is not provided in the data. I'll check references: no mention of a patch version. The vendor site may have updates, but not given. So I'll state "Vendor-released patch: exact fix version not confirmed in the advisory; update to the latest version of Power Archiver beyond 22.00.11 as provided by ConeXware." If no patch, suggest workarounds: Disable automatic extraction of archives from the internet, ensure Mark-of-the-Web protections are enforced, or avoid opening untrusted archives. Since the vulnerability involves Mark-of-the-Web bypass, ensuring Windows security settings are enabled and not using PowerArchiver for untrusted archives could mitigate. Actionable: "Until a patched version is applied, users should avoid extracting archives from untrusted sources with PowerArchiver, and ensure that the 'Unblock' option is not used for files flagged with Mark-of-the-Web." Or use alternative extraction tools. I'll write: "Upgrade to the latest version of Power Archiver (beyond 22.00.11) as soon as a fix is available. In the interim, disable automatic extraction when downloading archives, avoid opening archives from untrusted sources with PowerArchiver, and consider using Windows built-in extraction tools that enforce Mark-of-the-Web properly. Monitor the vendor's website for an official advisory." I can cite the GitHub advisory as a reference for details. But the GitHub reference is not an official advisory, it's a public reference. The vendor website powerarchiver.com is the official source. I'll say: "No official patch version specified; refer to the vendor's website (https://www.powerarchiver.com) for updated versions." I'll note that the GitHub reference contains technical details. So remediation paragraph: "Upgrade Power Archiver to a patched version beyond 22.00.11 once released by ConeXware. As no fixed version number is confirmed in the vulnerability disclosure, consult the vendor's website for the latest update. For immediate mitigation, cease using Power Archiver to extract files from untrusted archives, particularly those bearing the Mark-of-the-Web, and rely on Windows' built-in extraction tools or other archivers that enforce security markings. Alternatively, block PowerArchiver's network access if feasible, but note this may impair legitimate functionality." exploit_scenario: "An attacker crafts a malicious archive file containing executable content and sends it to a victim, perhaps via email or a download link. When the victim extracts the archive using a vulnerable version of PowerArchiver, the Mark-of-the-Web is ignored, allowing the executable to run with elevated privileges, leading to code execution and system compromise." That's a realistic scenario. No PoC confirmed, but the description implies. exploitation_conditions: The CVE description says "via the powerarc.exe". The diff snippet mentions "extracting files from an archive that bears Mark-of-the-Web". So the condition is: user must extract a specially crafted archive using PowerArchiver on a Windows system where Mark-of-the-Web is present. No authentication required. So specific conditions: "Victim must extract a malicious archive file using Power Archiver 22.00.11 or earlier on a Windows system where the archive carries the Mark-of-the-Web. No authentication or special configuration is required." The limiting factor: requires user interaction (UI:N, but actually the user must open the archive). Wait, CVSS says UI:N, which means no user interaction is required. That seems contradictory to the extraction process. Possibly the attack can be triggered automatically when PowerArchiver processes an archive without user interaction, e.g., as a service? The description just says "via the powerarc.exe" — maybe it's a network-accessible service
Remote code execution in ZipGenius 6.3.2.3116 and earlier allows attackers to trick users into opening malicious ZIP files, leading to arbitrary code execution with user privileges. No active exploitation or CISA KEV listing exists; EPSS indicates low exploitation probability, but the CVSS base score of 8.8 reflects potential total system compromise.
Path traversal in IZArc v4.6's unrar.dll component enables arbitrary file writes outside the intended extraction directory when a victim extracts a maliciously crafted RAR archive. The vulnerability stems from insufficient path validation in the RAR extraction routine, permitting an attacker-controlled archive to place files at attacker-chosen filesystem paths with the victim user's privileges. No public exploit identified at time of analysis and EPSS sits at 0.21% (11th percentile), but SSVC rates technical impact as total, reflecting the high-C/I/A CVSS score if the attack chain completes.
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.
Stored cross-site scripting in Mettle SendPortal 3.0.1 and earlier enables persistent JavaScript injection through the content parameter of the /templates endpoint, with payloads executing in every browser that subsequently renders the poisoned template. A public proof-of-concept is hosted on GitHub Gist, providing low-effort reproduction for threat actors. Despite CISA SSVC assessing current exploitation as none, the scoped impact (S:C) means a single injected template can cascade across all users who view it, making this a meaningful session-hijacking or credential-harvesting vector for organizations relying on SendPortal for email campaign management.
Remote code execution affects safishamsi GRAPHIFY versions 0.3.2 through 0.4.29 via a DNS rebinding attack targeting its URL-fetching subsystem. The functions validate_url, safe_fetch, _build_opener, _fetch_html, and _download_binary are exploitable when a maliciously controlled hostname performs DNS rebinding to bypass the URL validation layer, allowing an attacker to pivot into internal network resources and ultimately achieve code execution. A public proof-of-concept repository exists; no KEV listing is present at time of analysis, though the PoC lowers the bar for exploitation.
Directory traversal in FileThingie v.2.5.7 allows a remote, low-privileged attacker to read arbitrary files outside the application's intended directory boundary via a crafted HTTP request. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation with high confidentiality impact and no write or availability consequences. No confirmed active exploitation (CISA KEV) is recorded, but a public vulnerability research repository referencing this CVE exists, suggesting proof-of-concept material may be available.
Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
Unauthenticated remote access to the project upload endpoint in Gerapy up to 0.9.13 is possible because the `@permission_classes([IsAuthenticated])` decorator was commented out in `gerapy/server/core/views.py`, permitting any network-reachable attacker to submit arbitrary zip archives without credentials. Source code review of patch commit bd4891c6 (PR #319) reveals that the same unpatched endpoint also contained a Zip Slip (path traversal) flaw in the archive extraction logic, meaning the combined exposure allows unauthenticated arbitrary file writes to any path the Gerapy process can reach. A public proof-of-concept has been disclosed via GitHub issue #317; this CVE is not currently listed in the CISA KEV catalog.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Cross-site scripting in Proxmox Virtual Environment (PVE) 8.x and 9.x allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in the browser of an authenticated PVE user who interacts with a crafted payload. The CVSS scope change (S:C) confirms the injected script executes outside the originating component's security context, enabling session hijacking, credential theft, or unauthorized management actions against the hypervisor web UI. SSVC classifies exploitation status as none with no automation possible, and no active exploitation or public exploit code has been identified at time of analysis.
NoSQL injection in AhnLab EPP (Endpoint Protection Platform) Management v1.0.14.32-6249 allows an authenticated attacker to manipulate backend NoSQL queries through the eventlog/agentEvent/list endpoint, as the CVSS:3.1 vector (PR:L) indicates a low-privilege authenticated session is required. Successful exploitation yields high confidentiality and integrity impact (C:H/I:H), enabling extraction or tampering of security event-log data across the managed endpoint fleet. A public GitHub repository named for this CVE suggests exploit/PoC material may exist; it is not listed in CISA KEV and no EPSS score was provided.
Incorrect access control in the Proxmox Virtual Environment qemu-server component exposes hashed passwords to authenticated low-privilege users via the cloudinit/dump API endpoint. Affects PVE 8.x before 8.4.8 and 9.x before 9.1.8. An attacker with minimal PVE credentials can retrieve cloud-init password hashes for VMs, enabling offline cracking and potential lateral movement into guest systems. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Output-handling discrepancy in the OpenRISC OR1200 soft-core CPU (commit 83ac6b) causes the CPU output port to differ between the RTL source and the synthesized netlist, producing unexpected hardware behavior. The flaw was surfaced by the academic SynFuzz hardware-fuzzing research (arXiv 2504.18812) rather than in-the-wild attacks, affects the open-source mor1kx/OR1200 core used mainly in research and FPGA/SoC prototyping, and has no public exploit identified at time of analysis. Assigned CVSS 9.1 (NVD/MITRE) but with a very low EPSS of 0.17% (6th percentile), reflecting a research-grade correctness finding rather than a mass-exploitation threat.
Path traversal in LogicalDOC Enterprise up to v9.1.1 allows any authenticated user to read arbitrary files outside designated directories via the OnlyOfficeEditor servlet's fileExt parameter. Exploitation requires only a low-privilege account, no special configuration, and results in high confidentiality impact - potentially exposing system credentials, configuration files, or other sensitive data. A public vulnerability disclosure exists on GitHub (netero1010), indicating exploit techniques are accessible to the public; EPSS is low (0.33%) suggesting limited observed exploitation to date.
SQL injection in LogicalDOC Enterprise (versions up to and including 9.1.1) lets an authenticated user tamper with backend database queries through the ComparisonServlet component, which fails to properly sanitize user-supplied input. Because it is a blind injection, an attacker infers data through boolean/time-based inference rather than direct output, and the CVSS 8.8 vector (PR:L) indicates any low-privileged authenticated account can achieve high confidentiality, integrity, and availability impact. A public technical disclosure (netero1010) documents the flaw, but it is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), so widespread automated exploitation is not currently indicated.
Privilege-free process termination in OPSWAT AppRemover Driver (ardrv.sys v2017.10.02.1551 and earlier) allows any locally authenticated user to kill arbitrary processes - including endpoint security tools - by sending crafted requests to IOCTL handler 0x2420031 without any privilege validation. A public proof-of-concept is available on GitHub (redteamfortress/CVE-2026-36425), making this immediately reproducible by insider threats or post-compromise attackers seeking to disable defenses. No active exploitation has been confirmed in CISA KEV, but the defense-evasion potential elevates operational priority in environments running OPSWAT's OESIS Framework.
Denial of service in BusyBox's AWK interpreter (editors/awk.c, commit 371fe9) lets an attacker crash the awk process by feeding it a crafted AWK script that overflows the stack inside the recursive evaluate() function. The impact is limited to availability (process crash) with no data exposure or code execution claimed; no public exploit identified at time of analysis and EPSS is very low (0.16%, 6th percentile). BusyBox is extremely widespread in embedded Linux, IoT firmware, and container base images, but exploitation requires the attacker to supply the script that awk executes, which materially narrows real-world reach.
Denial of service in BusyBox 1.38.0 lets attackers crash the bundled ash shell by supplying crafted input that triggers a heap-based buffer overflow (CWE-122) in the ifsbreakup() field-splitting routine of shell/ash.c. Only availability is impacted - there is no public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile), indicating little observed exploitation interest so far. The NVD-assigned CVSS of 7.5 rests on a network attack vector that is not clearly supported by the description, which points to input being fed to a local shell.
Remote command execution in Open Source GPT Researcher v3.3.7 lets attackers run arbitrary OS commands on a victim's machine when the user interacts with a crafted HTML page, exploiting a command injection (CWE-77) weakness. The flaw was reported by MITRE and detailed in ox.security research covering RCE across the AI/MCP ecosystem; no public exploit is identified in CISA KEV, and EPSS probability is low (0.21%). Because GPT Researcher autonomously fetches and processes web content, a malicious page encountered during a research run can drive execution on the host.
Denial of service in BusyBox 1.38.0 arises from a use-after-free in the awk_sub() routine of the AWK applet (editors/awk.c), allowing an attacker who can supply a crafted AWK script to crash the busybox awk process. The flaw is a memory-corruption bug (CWE-416) with availability-only impact and no confidentiality or integrity consequences. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and its EPSS score is low (0.14%, 4th percentile).
Missing SSH host key verification in Dulwich's paramiko vendor module exposes SSH connections to man-in-the-middle interception. The contrib/paramiko_vendor.py module used paramiko's MissingHostKeyPolicy, which silently accepts any server host key without checking it against known_hosts, allowing a network-positioned attacker to impersonate a legitimate SSH Git server. No public exploit has been identified at time of analysis and EPSS sits at 0.14% (4th percentile), but the attack is conceptually straightforward for any attacker with network access between client and server.
Reflected Cross-Site Scripting in xxl-job-admin v.3.0.0 allows a remote unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by tricking an authenticated user into clicking a crafted HTTP GET request containing an unsanitized malicious script payload. The vulnerability carries a CVSS 3.1 score of 6.1 with Scope Changed, indicating the injected script can affect browser-level resources beyond the immediate application context, enabling session hijacking, credential theft, or redirection against admin-level users. No public exploit identified at time of analysis in CISA KEV, though a public PoC repository exists and the EPSS score sits at the 31st percentile, indicating modest but non-trivial exploitation interest.
Denial of service in BusyBox 1.38.0 stems from a heap-based buffer overflow in the evalcommand() routine of the ash shell interpreter (shell/ash.c), where crafted input corrupts heap memory and crashes the process. No public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile), indicating no observed exploitation activity. Impact is limited to availability - no confidentiality or integrity loss is claimed per the CVSS vector.
Prototype pollution in Tamagui's updateConfig function allows authenticated remote attackers to inject arbitrary properties into the JavaScript Object prototype, affecting all versions through 2.3.0. The flaw in code/core/web/src/config.ts permitted passing '__proto__' as the key argument to updateConfig, causing Object.assign to merge attacker-controlled values directly onto Object.prototype. No public exploitation (KEV) is confirmed, but proof-of-concept exploit code exists per SSVC assessment; EPSS at 0.34% (26th percentile) reflects limited observed exploitation interest at time of analysis.
Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.
Null pointer dereference in open62541's client library (versions up to 1.5.5) allows a remote OPC UA server to crash a connecting client by returning a malformed Server_NamespaceArray during session establishment, causing denial of service. The flaw is client-side only - server deployments are unaffected - and exploitation requires the attacker to control or impersonate a server the vulnerable client connects to, making practical exploitation high-complexity. A proof-of-concept exists as a GitHub issue report; no public exploit is confirmed as weaponized and the vulnerability is not listed in CISA KEV.