N A
Monthly
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the pppoeServiceName parameter submitted to /cgi-bin/cstecgi.cgi. A public proof-of-concept repository exists (SSVC exploitation=poc; GitHub reference confirmed) and the attack is classified as automatable with no privileges or user interaction required per the CVSS vector. No vendor-released patch has been identified at time of analysis, and the provided CVSS impact metrics (C:L/I:L/A:N) appear significantly understated relative to what arbitrary OS command execution on an embedded router realistically yields.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 enables remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `pppoeMtu` parameter of the `/cgi-bin/cstecgi.cgi` web management endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies this as automatable with poc-level exploitation status. No public exploit identified at time of analysis meets the KEV threshold; EPSS sits at just 0.04% (12th percentile), suggesting limited real-world exploitation activity despite POC availability.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 exposes the device to unauthenticated remote OS command execution through the web management CGI interface. The `provider` parameter passed to `/cgi-bin/cstecgi.cgi` is not sanitized before being used in a system command, allowing any network-reachable attacker to run arbitrary commands on the router. A proof-of-concept is publicly available on GitHub (confirmed by SSVC classification), and SSVC rates the attack as automatable with partial technical impact; EPSS at 0.04% (12th percentile) suggests exploitation remains limited in scale, likely reflecting the narrow deployment footprint of this budget SOHO router model.
Unauthenticated remote command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-exposed attackers to execute arbitrary OS commands by injecting shell metacharacters into the stun-port parameter of /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N/AC:L/UI:N) confirms no credentials or user interaction are required, and the SSVC assessment independently classifies the attack as automatable with a publicly available proof-of-concept - though EPSS at 0.04% (12th percentile) indicates minimal observed exploitation activity to date and no CISA KEV listing has been recorded. The vendor-assigned impact metrics (C:L/I:L/A:N) appear inconsistent with the expected consequence of OS-level command execution on router firmware, which typically yields full device compromise.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device to arbitrary OS command execution via the stun-user parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS vector assigns no privileges required and no user interaction, making this remotely exploitable from the network, and the SSVC framework independently classifies it as automatable with a publicly available proof-of-concept on GitHub. Notably, the provided CVSS impact ratings of C:L/I:L/A:N appear to significantly understate the realistic consequence of arbitrary command execution on embedded router firmware - no public exploit activity is confirmed and EPSS sits at the 12th percentile, suggesting limited real-world exploitation so far.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device's CGI management interface to arbitrary OS command execution via the password parameter at /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms exploitation requires no credentials and no user interaction, making it scriptable against any Internet-exposed device. A public proof-of-concept exists on GitHub, and SSVC classifies the vulnerability as automatable with a PoC - though the EPSS score of 0.04% (12th percentile) suggests exploitation has not yet reached widespread real-world activity, likely reflecting the niche deployment footprint of this SOHO router model.
Server-Side Request Forgery (SSRF) in ntfy (ntfy.sh) before v2.22.0 allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources by exploiting an unanchored regex pattern in the web push endpoint allow-list. Despite the CVE description attributing the vulnerability to the 'parseActions' function with an RCE classification, the confirmed fix in v2.22.0 - tightening the web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching - indicates the real impact is SSRF, not arbitrary code execution. No active exploitation has been confirmed (not in CISA KEV), though a public proof-of-concept gist exists from the reporter.
SQL injection in JizhiCMS v2.5.4 lets attackers inject arbitrary SQL through the product editing module, exploiting unsanitized input handled by CWE-89. The flaw carries a 9.8 CVSS with total technical impact (SSVC), and publicly available exploit code exists via a shared gist, though EPSS remains very low (0.01%) and it is not on CISA KEV. Because the product editing module is a backend/administrative function, real-world abuse likely presupposes access to that interface despite the network-facing CVSS scoring.
Replay-based keyless entry bypass in Yadea T5 electric bicycles (2024 and later model years) lets a nearby attacker clone the RF signal from the key fob and take full control of the vehicle. Because the fob uses the EV1527 fixed-code protocol with no rolling codes or challenge-response, a single captured transmission can be rebroadcast to unlock and operate the bike. Publicly available exploit code exists (two GitHub repositories), though EPSS is very low (0.03%) and it is not listed in CISA KEV.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying a crafted value to the `interval` parameter of the `/cgi-bin/cstecgi.cgi` endpoint. The SSVC assessment confirms publicly available proof-of-concept exploit code exists and the attack is automatable, meaning scripted mass exploitation is feasible against any internet-exposed instance. No KEV listing is present and EPSS sits at a low 0.04%, likely reflecting the niche market footprint of the device rather than low exploitability.
Unauthenticated remote command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows attackers to execute arbitrary OS commands by passing a malicious payload through the `week` parameter of the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is hosted on GitHub (confirmed by SSVC exploitation status: poc), and the attack is rated automatable by SSVC, meaning mass scanning and exploitation is feasible without manual intervention. Despite these conditions, EPSS sits at 0.04% (12th percentile), indicating minimal observed exploitation in the wild at time of analysis - likely reflecting the niche deployment footprint of this budget consumer router.
Unauthenticated remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-facing attackers to execute arbitrary OS commands on the router by supplying shell metacharacters in the recHour parameter of the /cgi-bin/cstecgi.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, and SSVC flags this as automatable with no authentication barrier, making mass exploitation of exposed devices feasible. No vendor patch has been identified at time of analysis; no CISA KEV listing exists, but the combination of unauthenticated network access and available POC represents a credible near-term risk.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 permits remote attackers to execute arbitrary OS commands by supplying a malicious payload in the `mode` parameter to the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies the attack as automatable with no authentication required per the provided CVSS vector, making mass exploitation feasible despite a low EPSS score of 0.04%. No vendor patch has been identified at time of analysis, leaving devices with internet-exposed management interfaces without a vendor-supplied fix.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by supplying shell metacharacters in the 'hour' parameter of the /cgi-bin/cstecgi.cgi management endpoint. A public proof-of-concept is confirmed on GitHub and SSVC classifies exploitation as automatable, meaning scripted mass-scanning is feasible against any exposed management interface. No vendor-released patch has been identified; the provided CVSS impact scoring of C:L/I:L/A:N appears inconsistent with the actual capability of arbitrary command execution on embedded firmware, warranting independent re-evaluation.
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 exposes the router's CGI management interface to unauthenticated remote attackers who can execute arbitrary OS commands by injecting shell metacharacters into the dhcpMtu parameter of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available on GitHub, and SSVC assessment marks exploitation as automatable with partial technical impact. No vendor-released patch has been identified at time of analysis, leaving affected devices persistently vulnerable.
Remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated network-adjacent or remote attackers to execute arbitrary OS commands by submitting shell metacharacters in the `ttlWay` parameter to the `/cgi-bin/cstecgi.cgi` management endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation with no authentication requirement, and SSVC classifies the attack as automatable. A public proof-of-concept is available on GitHub; however, EPSS at 0.04% (12th percentile) indicates limited observed exploitation in the wild at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting (XSS) in Silverpeas Core before version 6.4.6 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers via malicious input to the AdvancedSearch functionality. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with partial technical impact. Publicly available exploit code exists, and CISA SSVC assessment confirms proof-of-concept availability, though this vulnerability is not yet confirmed in active widespread exploitation.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Reflected cross-site scripting (XSS) in Dovestones ADPhonebook versions below 4.0.1.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the search parameter of the /ADPhonebook?Department=HR endpoint. User input is reflected without proper encoding. Publicly available exploit code exists, though CISA KEV status is not confirmed, and CVSS 6.1 with UI:R indicates user interaction is required for successful exploitation.
SQL injection in Genesys Latitude v25.1.0.420 allows an authenticated attacker to run arbitrary SQL queries against the backend database, enabling full read/write access to stored data. The flaw stems from user-supplied input being concatenated directly into SQL statements (CWE-89). Publicly available exploit code exists per the referenced okunsec research, but the EPSS score is negligible (0.01%, 2nd percentile) and it is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
Cross-site request forgery (CSRF) in Dovestones AD Self Update versions before 4.0.0.5 allows unauthenticated attackers to modify authenticated user account information by crafting malicious requests that exploit missing CSRF token validation. The vulnerability affects state-changing endpoints that accept both POST and GET requests without proper anti-CSRF protections, enabling account takeover when a victim visits a malicious page while logged in. Publicly available exploit code exists.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Z-BlogPHP 1.7.5 allows authenticated remote attackers with administrative privileges to upload arbitrary files via the App::UnPack function in the ZBA File Handler component (/zb_users/plugin/AppCentre/app_upload.php), bypassing file upload restrictions and potentially enabling remote code execution. Public exploit code exists, and the vendor has not responded to early disclosure attempts.
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scripts through the View Endpoint in server.py, affecting user integrity with publicly available exploit code. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting its severity despite network accessibility. ComfyUI's vendor has not responded to early disclosure attempts, and the exploit has been published on GitHub, making this a low-CVSS but publicly weaponized vulnerability affecting an AI image generation framework.
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows authenticated attackers to inject malicious scripts that execute in other users' browsers. Affected versions range from 0.1 through 0.13.0. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact, but publicly available exploit code exists and the vendor has not responded to disclosure.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify application state via crafted requests to the create_origin_only_middleware function in server.py. The vulnerability requires user interaction (clicking a malicious link or visiting an attacker-controlled site) but has low integrity impact and is publicly exploitable with proof-of-concept code available. The vendor has not responded to early disclosure notification.
Buffalo Link Station version 1.85-0.01 allows privilege escalation through username and role enumeration via parameter manipulation at the /nasapi endpoint. Authenticated or guest-level users can identify valid usernames and their associated privilege roles by modifying request parameters, enabling targeted privilege escalation attacks. While CVSS indicates a network vector, actual exploitation requires prior authentication or guest access, limiting immediate exposure but creating a stepping stone for further attacks.
OpenXiangShan NEMU fails to properly enforce Smstateen permission controls, allowing authenticated local users to access IMSIC (Incoming Message Signal Interrupt Controller) state through stopei/vstopei CSRs despite mstateen0.IMSIC being cleared. This privilege escalation enables cross-context information disclosure of interrupt state and potential disruption of interrupt handling mechanisms in lower-privileged execution contexts.
Stored cross-site scripting (XSS) in Apartment Visitors Management System v1.1 allows authenticated attackers to inject malicious JavaScript via the visname parameter in visitors-form.php, which executes when other users view the injected data in manage-newvisitors.php or visitor-detail.php. The vulnerability requires user interaction (victim visiting affected pages) and valid authentication but can escalate privileges, steal session tokens, or perform actions on behalf of administrative users viewing visitor records.
Stack-use-after-return memory corruption in Arduino_Core_STM32 (stm32duino) allows local low-privileged actors to trigger undefined behavior via dangling pointer dereference in interrupt service routines on devices running firmware built with versions prior to 1.7.0. The pwm_start() function stores a stack-allocated TIM_HandleTypeDef pointer in a global HAL timer registry; once the function returns and the stack frame is reclaimed, any timer ISR that fires will dereference a now-invalid pointer, corrupting memory. A researcher disclosure repository (CVE-2026-26399-Disclosure) is publicly referenced, suggesting exploit details exist, though EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm no broad active exploitation at time of analysis.
Server-side request forgery in PHPEMS 11.0 allows authenticated remote attackers to manipulate the uploadfile parameter in the Instant Exam Creation Handler component, enabling SSRF attacks that can access internal resources or perform unauthorized requests from the server. The vulnerability affects the temppage function in /app/exam/controller/exams.master.php and has public exploit code available, though exploitation requires valid user credentials (PR:L).
EyouCMS versions up to 1.7.1 allow high-privileged attackers to upload arbitrary files via manipulation of the filename parameter in the edit_adminlogo function, leading to information disclosure and potential code execution. The vulnerability requires authenticated admin access and is publicly exploitable with proof-of-concept code available on GitHub; the vendor has not responded to disclosure attempts.
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
Stored cross-site scripting (XSS) in Classroom Bookings up to version 2.17.0 allows authenticated users to inject malicious scripts via the displayname parameter in the User Display Name Handler component, resulting in arbitrary script execution in other users' browsers. The vulnerability requires user interaction (victim must view the affected page) and authenticated access, limiting immediate risk, but publicly available exploit code and vendor confirmation of the issue increase real-world threat. Upgrading to version 2.17.1 resolves the vulnerability.
STProcessMonitor 11.11.4.0 driver in Safetica Application suite allows local privileged users to send crafted IOCTL requests (0xB822200C) that terminate processes protected by third-party security implementations due to insufficient caller validation in the kernel-mode driver handler. This enables denial of service attacks against critical services without requiring user interaction. Publicly available exploit code exists, and the vulnerability is tracked in CISA's LOLDrivers database as a legitimate-but-abused Windows driver.
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
Cross-site scripting (XSS) in goldmark HTML renderer before version 1.7.17 allows unauthenticated remote attackers to execute arbitrary JavaScript by encoding dangerous URL schemes (such as javascript:) using HTML5 named character references, bypassing the renderer's prefix-based protocol validation due to improper ordering of entity resolution. Applications using affected versions can be exploited via crafted markdown containing malicious links that render unsafe protocols in user contexts, with a CVSS score of 6.1 indicating moderate real-world impact driven by the requirement for user interaction (UI:R) and change of scope across trust boundaries.
Denial of service in Nordic Semiconductor IronSide SE for n
Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 at /scheduler/admin/user/manage_user.php allows high-privilege authenticated attackers to read sensitive data via crafted SQL queries. CVSS score of 2.7 reflects the requirement for high administrative privileges (PR:H), limiting real-world impact. SSVC framework confirms no known active exploitation, non-automatable attack, and partial technical impact (confidentiality only). This is a low-severity vulnerability constrained by authentication requirements despite the presence of a SQL injection flaw.
Type-confusion (CWE-843) in Transloadit's Uppy file-uploader library at version 0.25.6 can lead to memory corruption and information disclosure when a resource is accessed using an incompatible type. Published details are minimal, but the assigned CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) asserts remote, unauthenticated impact with total loss of confidentiality, integrity, and availability. There is no public exploit identified and no CISA KEV listing; a referenced GitHub gist may contain a proof-of-concept but its contents are unverified, and the 0.02% EPSS score plus SSVC 'exploitation: none' indicate no observed exploitation to date.
Improper authorization in Snipe-IT v8.4.0 allows authenticated attackers holding the users.edit permission to overwrite sensitive authentication and account-state fields on arbitrary non-admin user accounts via a crafted PUT request to /api/v1/users/{id}. A publicly available proof-of-concept exists (SSVC: poc), enabling low-complexity account manipulation or effective takeover of regular user accounts without requiring admin privileges. The vulnerability is not confirmed in CISA KEV, and with an EPSS of 0.03% (8th percentile) widespread automated exploitation appears unlikely at this time, though the POC lowers the barrier to targeted misuse.
Reflected cross-site scripting (XSS) in manikandan580 School-management-system 1.0 allows unauthenticated remote attackers to inject malicious scripts via the pagedes POST parameter in /studentms/admin/contact-us.php, affecting users with browser cookies or session tokens. Publicly available exploit code exists, and the vulnerability impacts confidentiality and integrity with moderate scope. CVSS score of 6.1 reflects the requirement for user interaction to trigger the malicious payload.
Time-based blind SQL injection in manikandan580 School Management System 1.0 allows unauthenticated remote attackers to extract sensitive database contents and potentially execute arbitrary SQL commands through the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php. The CVSS 9.8 critical score reflects network-based exploitation requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the specific vulnerable parameter and injection type are documented in public security advisories.
Reflected cross-site scripting (XSS) in School Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email POST parameter in the contact-us.php admin interface. A victim must click a crafted link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to malicious sites. Public proof-of-concept code exists; however, real-world exploitation probability remains low (EPSS 0.02%) due to reliance on user interaction and limited automaton.
SQL injection in manikandan580's School Management System version 1.0 lets a remote attacker inject malicious SQL through a crafted HTTP request to a vulnerable endpoint, manipulating query logic to read sensitive database contents such as credentials and student/staff records. The advisory and CVSS PR:N indicate the flaw is reachable without authentication, and publicly available exploit code exists (proof-of-concept published), though EPSS remains very low at 0.03% and it is not listed in CISA KEV. SSVC rates technical impact as total and the attack as automatable, making it an attractive target for opportunistic scanning despite its niche footprint.
Stored or reflected cross-site scripting (XSS) in alandsilva26 hotel-management-php 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of authenticated administrators via a malicious room_id GET parameter in /public/admin/edit_room.php. Public exploit code exists (SSVC confirms poc status). The vulnerability requires user interaction (UI:R) to trigger, affecting confidentiality and integrity of admin sessions with partial technical impact.
SQL injection in Grocery Store Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the sitem_name parameter in search_products_itname.php. The vulnerability achieves maximum CVSS 9.8 due to network accessibility without authentication, enabling complete database compromise including data exfiltration, modification, and potential system takeover. EPSS data not available; no confirmed active exploitation (CISA KEV) identified at time of analysis, though publicly available exploit code exists per researcher advisory.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege administrators to read sensitive data through the /scheduler/admin/appointments/manage_appointment.php endpoint. The vulnerability requires administrative credentials and does not enable data modification or denial of service, limiting real-world impact despite network-accessible exposure. CVSS score of 2.7 reflects the high authentication barrier and confidentiality-only impact; CISA SSVC framework rates exploitation as 'none' with no automatable attack path.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege users to read sensitive database information via the /scheduler/admin/appointments/view_details.php endpoint. The vulnerability requires administrative credentials and network access but carries low real-world risk due to restrictive authentication requirements (PR:H), limited scope of impact (confidentiality only), and CVSS score of 2.7. No public exploit code or active exploitation has been identified.
SourceCodester Patient Appointment Scheduler System v1.0 suffers from SQL injection in the SystemSettings.php update_settings function, allowing authenticated high-privilege administrators to execute arbitrary SQL queries. While tagged as RCE, the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) and SSVC framework indicate limited confidentiality impact with no confirmed integrity or availability consequences; this is primarily a SQL injection vulnerability requiring administrative credentials with no public exploit code identified at time of analysis.
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/attendance_list.php endpoint, enabling unauthorized data disclosure with low confidentiality impact. The vulnerability requires administrator-level access and carries minimal real-world risk due to high privilege requirements and low exploitability (SSVC exploitation status: none), though it represents a defense-in-depth failure in an administrative function.
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to extract sensitive database information via the /wfh_attendance/admin/manage_department.php endpoint. The CVSS 2.7 score reflects low real-world risk due to the requirement for high-privilege administrative credentials and confidentiality-only impact; no public exploit code has been identified, and the vulnerability is not confirmed as actively exploited.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/manage_employee.php file. The CVSS score of 2.7 reflects limited impact (confidentiality only, no integrity or availability loss) and high authentication barriers (administrator role required). No public exploit code or active exploitation has been confirmed.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege remote attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/view_employee.php endpoint. CVSS 2.7 reflects high authentication barriers (PR:H requires admin access), no automatable exploitation per SSVC, and confidentiality impact only. No public exploit code or active exploitation confirmed at time of analysis.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/view_att.php endpoint, potentially disclosing sensitive employee attendance data. The vulnerability requires administrative credentials and carries low real-world risk despite SQL injection's severity class, as evidenced by CVSS 2.7 and SSVC designation of no exploitation likelihood with partial technical impact. No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privilege authenticated administrators to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_pricing.php endpoint, resulting in partial confidentiality impact. The CVSS score of 2.7 reflects the requirement for high administrative privileges and absence of integrity or availability impact, placing this as a low-risk vulnerability despite the SQL injection classification. No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privileged remote attackers to read sensitive data through the /storage/admin/tenants/view_details.php endpoint. With a CVSS score of 2.7 and requirement for high administrative privileges (PR:H), this vulnerability has minimal real-world impact despite the SQL injection class; however, it represents a privilege-abuse risk within already-compromised administrative contexts. No public exploit code or active exploitation has been confirmed.
SQL injection in SourceCodester Storage Unit Rental Management System v1.0 allows high-privileged authenticated attackers to read sensitive database contents via crafted input in /storage/admin/rents/manage_rent.php. The vulnerability requires administrator-level access and produces only limited information disclosure with no impact on data integrity or availability. EPSS and SSVC assessments indicate minimal real-world exploitation risk due to authentication barrier and non-automatable attack requirements.
SQL Injection in SourceCodester Storage Unit Rental Management System v1.0 allows authenticated administrative users to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_storage_unit.php endpoint. The vulnerability requires high-privilege access (PR:H) and returns only limited information (confidentiality impact only), resulting in a low CVSS score of 2.7. No public exploit code or active exploitation has been confirmed at the time of analysis.
Local File Inclusion in LibreNMS's NFSen module (nfsen.inc.php) enables authenticated low-privilege users to traverse the server filesystem and include arbitrary PHP files by manipulating the nfsen HTTP parameter with path traversal sequences. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.02% (5th percentile) and SSVC non-automatable classification indicate limited mass-exploitation potential. The vulnerability carries high confidentiality impact per CVSS - sensitive configuration files, credentials, or other PHP-readable data on the server are at risk - while integrity and availability remain unaffected.
Arbitrary code execution in OpenAI Codex CLI v0.23.0 and earlier occurs because the tool automatically loads project-local .env and .codex/config.toml (MCP configuration) files without any user confirmation when a developer runs the codex command inside a repository. An attacker who controls or poisons a repository can embed commands that execute immediately on the victim's machine when Codex is invoked there. Publicly available exploit code exists (SSVC 'poc') and Check Point Research published a technical write-up, but the flaw is not on CISA KEV and EPSS is very low (0.02%), indicating no evidence of widespread active exploitation.
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
HTML injection in Vtiger CRM 8.4.0 allows unauthenticated attackers to embed arbitrary HTML content into the Dashboard interface by manipulating the `tabid` parameter of the DashBoardTab view's `getTabContents` action. Exploitation requires luring an authenticated CRM user to a crafted URL, after which injected content renders in the victim's browser with potential for credential harvesting, session theft, or phishing overlays. No active exploitation is confirmed — CISA KEV is absent, EPSS sits at 0.02% (5th percentile), and SSVC rates technical impact as partial with exploitation status of none — indicating low real-world urgency despite the scope-changing CVSS 6.1 score.
Reflected cross-site scripting (XSS) in Vtiger CRM 8.4.0 MailManager module allows authenticated attackers to execute arbitrary JavaScript in a user's browser session via a specially crafted double URL-encoded payload in the _folder parameter. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity within the scope of the authenticated session. With an EPSS score of 0.02% (5th percentile), real-world exploitation risk is minimal despite public disclosure.
SQL injection in Sourcecodester Online Thesis Archiving System v1.0 at /otas/admin/curriculum/manage_curriculum.php allows authenticated high-privileged administrators to extract sensitive database information through unsanitized query parameters. With a CVSS score of 2.7 and EPSS of 0.01% (2nd percentile), this vulnerability presents minimal real-world risk despite valid SQL injection mechanics, as exploitation requires admin-level credentials and yields only confidentiality impact. No public exploit code or active exploitation has been confirmed.
SQL injection in Sourcecodester Online Thesis Archiving System v1.0 allows high-privilege authenticated attackers to extract sensitive information via the /otas/projects_per_department.php endpoint. The vulnerability requires admin-level credentials (PR:H per CVSS) and has minimal confidentiality impact with an EPSS score of 0.01%, indicating very low real-world exploitation probability despite public disclosure on GitHub.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privileged authenticated attackers to query the database with limited confidentiality impact via the /orms/admin/rooms/view_room.php endpoint. The CVSS score of 2.7 and EPSS percentile of 6% reflect low real-world exploitation probability; SSVC assessment confirms no known automated exploit path and only partial technical impact (information disclosure). No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL queries via the /orms/admin/reservations/view_details.php endpoint, resulting in limited information disclosure. The vulnerability requires administrative access and carries minimal real-world risk due to CVSS 2.7, EPSS 0.02% (6th percentile), and SSVC framework assessment indicating no active exploitation and non-automatable attack requirements.
Stored cross-site scripting in Snipe-IT asset management system v8.3.0-8.3.1 allows authenticated users with basic login privileges to inject malicious JavaScript via Name and Surname fields, which executes when other users view Activity Reports or modified profiles. This vulnerability requires the victim's Display Name to be unset and affects all users with sufficient permissions to access those views. Patch available in v8.3.2; EPSS score is minimal (0.01%), indicating low empirical exploitation likelihood despite network-accessible attack vector.
Heap use-after-free in Nitro PDF Pro 14.41.1.4 for Windows allows local code execution via malicious PDF containing crafted JavaScript calling this.mailDoc(). The vulnerability stems from premature deallocation of an XID object whose freed pointer is passed to wcscmp() and other functions, where attacker-controlled strings in the freed heap region can manipulate program flow. CVSS 8.4 (AV:L/PR:N) indicates local attack vector requiring no privileges or user interaction. EPSS 0.01% suggests low immediate exploitation probability; no public exploit identified at time of analysis.
Nitro PDF Pro 14.41.1.4 for Windows crashes when processing maliciously crafted PDFs that invoke app.alert() with null arguments, causing denial of service through NULL pointer dereference in the JavaScript engine. Remote attackers can deliver weaponized PDF files requiring no authentication or user interaction beyond opening the document (AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (2nd percentile), indicating low real-world targeting despite theoretical automation potential.
Nitro PDF Pro for Windows version 14.41.1.4 crashes when processing maliciously crafted XFA (XML Forms Architecture) packets due to a NULL pointer dereference, enabling remote denial-of-service attacks without authentication. An attacker can deliver a weaponized PDF containing the crafted XFA packet, causing the application to terminate when opened. EPSS exploitation probability is very low (0.01%, 2nd percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis. Despite CVSS 7.5 (High), real-world risk is limited to availability impact only - no code execution, data theft, or privilege escalation possible.
SQL Injection in Sourcecodester Online Resort Management System v1.0 allows authenticated administrators to extract or modify database contents via the /orms/admin/rooms/manage_room.php endpoint. The vulnerability requires high-privilege administrative access and has minimal real-world impact given the CVSS score of 2.7, EPSS exploitation probability of 0.02%, and CISA SSVC determination of non-exploitable status with only partial technical impact. No active exploitation has been confirmed.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated administrators to execute arbitrary SQL queries via the /rsms/admin/clients/manage_client.php endpoint, potentially exposing sensitive data with low confidentiality impact. The vulnerability requires high-privilege administrator authentication and carries minimal real-world risk (EPSS 0.02%, SSVC indicates no exploitation activity), but represents a common code quality issue in open-source PHP applications that warrants remediation during security updates.
SQL injection in Sourcecodester Basic Library System v1.0 allows high-privilege authenticated attackers to extract limited information from the database via crafted input to /librarysystem/load_book.php. The vulnerability requires administrative credentials and has very low real-world risk (EPSS 0.02%, CVSS 2.7) with no public exploit code identified; CISA does not list it as actively exploited.
Denial of service in Parani M10 Motorcycle Intercom v2.1.3 via crafted Bluetooth RFCOMM frames allows unauthenticated attackers within wireless range to crash the device. The vulnerability exploits a buffer overflow in the RFCOMM service handler, causing high availability impact. A proof-of-concept exists but active exploitation has not been confirmed; EPSS score of 0.02% suggests limited real-world exploitation pressure despite the accessible attack vector.
Unrestricted file upload in PHPGurukul Online Course Registration v3.1 allows an authenticated user to upload a malicious PHP file through the profile picture feature on /my-profile.php, leading to remote code execution on the hosting server. The upload handler fails to validate file type or content, so a low-privileged registered account is enough to plant a web shell. Publicly available exploit code exists (SSVC 'poc') and a Medium write-up documents the technique, though EPSS remains very low (0.02%) and it is not listed in CISA KEV.
SQL injection in Sourcecodester Basic Library System v1.0 at /librarysystem/load_student.php allows high-privilege authenticated attackers to read sensitive database information. The vulnerability requires administrative-level privileges and manual user interaction is absent, but real-world risk is minimal due to extremely low EPSS score (0.02%), CVSS severity of 2.7, and CISA SSVC assessment indicating no exploitation activity, non-automatable conditions, and only partial technical impact.
SQL injection in Sourcecodester Basic Library System v1.0 allows high-privilege authenticated attackers to extract sensitive data via the /librarysystem/load_admin.php endpoint. The vulnerability requires administrative authentication, limiting exposure to compromised or malicious admin accounts. EPSS exploitation probability is minimal at 0.02% (6th percentile), and no public exploit code has been identified, making this a low-priority issue despite the SQL injection vector.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated high-privilege users to read sensitive database content via crafted input in the repairs details viewer. The vulnerability requires admin-level authentication and carries minimal real-world risk given the CVSS 2.7 score, EPSS 0.02% exploitation probability, and CISA SSVC assessment indicating no known exploitation, non-automatable attack, and only partial technical impact (confidentiality). No active exploitation has been confirmed.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 at /rsms/admin/repairs/manage_repair.php allows authenticated administrators to extract or modify limited database information. The attack requires high-level administrative privileges and produces only confidentiality impact; EPSS probability is minimal (0.02%), and CISA SSVC assessment indicates no evidence of real-world exploitation.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privilege authenticated attackers to read sensitive application data via crafted input to the /orms/admin/activities/manage_activity.php endpoint. The vulnerability requires administrator-level credentials and produces only confidentiality impact with negligible real-world exploitation risk, as indicated by 0.02% EPSS score and CISA SSVC partial technical impact assessment.
Stack overflow in tinyobjloader's experimental MTL file parser (tinyobj_loader_opt.h) allows local attackers to trigger denial of service by supplying a malformed .mtl file. The vulnerability affects the library's material file parsing logic and crashes the application via stack memory corruption, though with EPSS score of 0.01% and no confirmed active exploitation, real-world risk is minimal despite the moderate CVSS 6.2 rating.
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying shell metacharacters in the pppoeServiceName parameter submitted to /cgi-bin/cstecgi.cgi. A public proof-of-concept repository exists (SSVC exploitation=poc; GitHub reference confirmed) and the attack is classified as automatable with no privileges or user interaction required per the CVSS vector. No vendor-released patch has been identified at time of analysis, and the provided CVSS impact metrics (C:L/I:L/A:N) appear significantly understated relative to what arbitrary OS command execution on an embedded router realistically yields.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 enables remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the `pppoeMtu` parameter of the `/cgi-bin/cstecgi.cgi` web management endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies this as automatable with poc-level exploitation status. No public exploit identified at time of analysis meets the KEV threshold; EPSS sits at just 0.04% (12th percentile), suggesting limited real-world exploitation activity despite POC availability.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 exposes the device to unauthenticated remote OS command execution through the web management CGI interface. The `provider` parameter passed to `/cgi-bin/cstecgi.cgi` is not sanitized before being used in a system command, allowing any network-reachable attacker to run arbitrary commands on the router. A proof-of-concept is publicly available on GitHub (confirmed by SSVC classification), and SSVC rates the attack as automatable with partial technical impact; EPSS at 0.04% (12th percentile) suggests exploitation remains limited in scale, likely reflecting the narrow deployment footprint of this budget SOHO router model.
Unauthenticated remote command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-exposed attackers to execute arbitrary OS commands by injecting shell metacharacters into the stun-port parameter of /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N/AC:L/UI:N) confirms no credentials or user interaction are required, and the SSVC assessment independently classifies the attack as automatable with a publicly available proof-of-concept - though EPSS at 0.04% (12th percentile) indicates minimal observed exploitation activity to date and no CISA KEV listing has been recorded. The vendor-assigned impact metrics (C:L/I:L/A:N) appear inconsistent with the expected consequence of OS-level command execution on router firmware, which typically yields full device compromise.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device to arbitrary OS command execution via the stun-user parameter of the /cgi-bin/cstecgi.cgi endpoint. The CVSS vector assigns no privileges required and no user interaction, making this remotely exploitable from the network, and the SSVC framework independently classifies it as automatable with a publicly available proof-of-concept on GitHub. Notably, the provided CVSS impact ratings of C:L/I:L/A:N appear to significantly understate the realistic consequence of arbitrary command execution on embedded router firmware - no public exploit activity is confirmed and EPSS sits at the 12th percentile, suggesting limited real-world exploitation so far.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 exposes the device's CGI management interface to arbitrary OS command execution via the password parameter at /cgi-bin/cstecgi.cgi. The CVSS vector (PR:N, AV:N, AC:L, UI:N) confirms exploitation requires no credentials and no user interaction, making it scriptable against any Internet-exposed device. A public proof-of-concept exists on GitHub, and SSVC classifies the vulnerability as automatable with a PoC - though the EPSS score of 0.04% (12th percentile) suggests exploitation has not yet reached widespread real-world activity, likely reflecting the niche deployment footprint of this SOHO router model.
Server-Side Request Forgery (SSRF) in ntfy (ntfy.sh) before v2.22.0 allows authenticated remote attackers to make the server issue arbitrary HTTP requests to internal network resources by exploiting an unanchored regex pattern in the web push endpoint allow-list. Despite the CVE description attributing the vulnerability to the 'parseActions' function with an RCE classification, the confirmed fix in v2.22.0 - tightening the web push endpoint allow-list regex to prevent SSRF via unanchored pattern matching - indicates the real impact is SSRF, not arbitrary code execution. No active exploitation has been confirmed (not in CISA KEV), though a public proof-of-concept gist exists from the reporter.
SQL injection in JizhiCMS v2.5.4 lets attackers inject arbitrary SQL through the product editing module, exploiting unsanitized input handled by CWE-89. The flaw carries a 9.8 CVSS with total technical impact (SSVC), and publicly available exploit code exists via a shared gist, though EPSS remains very low (0.01%) and it is not on CISA KEV. Because the product editing module is a backend/administrative function, real-world abuse likely presupposes access to that interface despite the network-facing CVSS scoring.
Replay-based keyless entry bypass in Yadea T5 electric bicycles (2024 and later model years) lets a nearby attacker clone the RF signal from the key fob and take full control of the vehicle. Because the fob uses the EV1527 fixed-code protocol with no rolling codes or challenge-response, a single captured transmission can be rebroadcast to unlock and operate the bike. Publicly available exploit code exists (two GitHub repositories), though EPSS is very low (0.03%) and it is not listed in CISA KEV.
Command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows unauthenticated remote attackers to execute arbitrary OS commands by supplying a crafted value to the `interval` parameter of the `/cgi-bin/cstecgi.cgi` endpoint. The SSVC assessment confirms publicly available proof-of-concept exploit code exists and the attack is automatable, meaning scripted mass exploitation is feasible against any internet-exposed instance. No KEV listing is present and EPSS sits at a low 0.04%, likely reflecting the niche market footprint of the device rather than low exploitability.
Unauthenticated remote command injection in ToToLink A3300R router firmware v17.0.0cu.557_B20221024 allows attackers to execute arbitrary OS commands by passing a malicious payload through the `week` parameter of the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is hosted on GitHub (confirmed by SSVC exploitation status: poc), and the attack is rated automatable by SSVC, meaning mass scanning and exploitation is feasible without manual intervention. Despite these conditions, EPSS sits at 0.04% (12th percentile), indicating minimal observed exploitation in the wild at time of analysis - likely reflecting the niche deployment footprint of this budget consumer router.
Unauthenticated remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-adjacent or internet-facing attackers to execute arbitrary OS commands on the router by supplying shell metacharacters in the recHour parameter of the /cgi-bin/cstecgi.cgi endpoint. A publicly available proof-of-concept exploit exists on GitHub, and SSVC flags this as automatable with no authentication barrier, making mass exploitation of exposed devices feasible. No vendor patch has been identified at time of analysis; no CISA KEV listing exists, but the combination of unauthenticated network access and available POC represents a credible near-term risk.
Unauthenticated command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 permits remote attackers to execute arbitrary OS commands by supplying a malicious payload in the `mode` parameter to the `/cgi-bin/cstecgi.cgi` CGI endpoint. A public proof-of-concept is available on GitHub, and SSVC classifies the attack as automatable with no authentication required per the provided CVSS vector, making mass exploitation feasible despite a low EPSS score of 0.04%. No vendor patch has been identified at time of analysis, leaving devices with internet-exposed management interfaces without a vendor-supplied fix.
Command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows network-accessible attackers to execute arbitrary OS commands by supplying shell metacharacters in the 'hour' parameter of the /cgi-bin/cstecgi.cgi management endpoint. A public proof-of-concept is confirmed on GitHub and SSVC classifies exploitation as automatable, meaning scripted mass-scanning is feasible against any exposed management interface. No vendor-released patch has been identified; the provided CVSS impact scoring of C:L/I:L/A:N appears inconsistent with the actual capability of arbitrary command execution on embedded firmware, warranting independent re-evaluation.
Command injection in TOTOLINK A3300R firmware v17.0.0cu.557_B20221024 exposes the router's CGI management interface to unauthenticated remote attackers who can execute arbitrary OS commands by injecting shell metacharacters into the dhcpMtu parameter of /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is available on GitHub, and SSVC assessment marks exploitation as automatable with partial technical impact. No vendor-released patch has been identified at time of analysis, leaving affected devices persistently vulnerable.
Remote command injection in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allows unauthenticated network-adjacent or remote attackers to execute arbitrary OS commands by submitting shell metacharacters in the `ttlWay` parameter to the `/cgi-bin/cstecgi.cgi` management endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation with no authentication requirement, and SSVC classifies the attack as automatable. A public proof-of-concept is available on GitHub; however, EPSS at 0.04% (12th percentile) indicates limited observed exploitation in the wild at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting (XSS) in Silverpeas Core before version 6.4.6 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers via malicious input to the AdvancedSearch functionality. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with partial technical impact. Publicly available exploit code exists, and CISA SSVC assessment confirms proof-of-concept availability, though this vulnerability is not yet confirmed in active widespread exploitation.
Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.
Server-side request forgery in Bagisto's Downloadable Link Handler component (versions up to 2.3.15) allows authenticated remote attackers to perform arbitrary HTTP requests on behalf of the server, potentially enabling access to internal resources, metadata services, or information disclosure. The vulnerability has publicly available exploit code and affects the copy function with low-to-moderate CVSS score (5.3) but concrete real-world impact if internal services are exposed. Vendor acknowledges the issue and states fixes are coming in upcoming releases.
Reflected cross-site scripting (XSS) in Dovestones ADPhonebook versions below 4.0.1.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the search parameter of the /ADPhonebook?Department=HR endpoint. User input is reflected without proper encoding. Publicly available exploit code exists, though CISA KEV status is not confirmed, and CVSS 6.1 with UI:R indicates user interaction is required for successful exploitation.
SQL injection in Genesys Latitude v25.1.0.420 allows an authenticated attacker to run arbitrary SQL queries against the backend database, enabling full read/write access to stored data. The flaw stems from user-supplied input being concatenated directly into SQL statements (CWE-89). Publicly available exploit code exists per the referenced okunsec research, but the EPSS score is negligible (0.01%, 2nd percentile) and it is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Textpattern CMS 4.9.0 allows authenticated low-privilege users to modify articles owned by higher-privilege users by manipulating the article ID parameter in the duplicate-and-save workflow, bypassing authorization checks in the article management system. The vulnerability affects only authenticated users with existing CMS access and requires no user interaction or special network access. No public exploit code or active exploitation has been identified, though the EPSS score of 0.02% suggests minimal real-world attack probability despite the moderate CVSS 6.5 score.
Cross-site request forgery (CSRF) in Dovestones AD Self Update versions before 4.0.0.5 allows unauthenticated attackers to modify authenticated user account information by crafting malicious requests that exploit missing CSRF token validation. The vulnerability affects state-changing endpoints that accept both POST and GET requests without proper anti-CSRF protections, enabling account takeover when a victim visits a malicious page while logged in. Publicly available exploit code exists.
XiangShan open-source RISC-V processor commit edb1dfaf7d290ae99724594507dc46c2c2125384 and earlier versions fail to properly gate the Control and Status Register (CSR) write-enable path for Physical Memory Attribute (PMA) configuration, allowing local attackers with code execution privileges to write to PMA CSRs that should raise illegal-instruction exceptions per the RISC-V specification. Successful exploitation enables attackers to alter memory attribute enforcement, potentially leading to privilege escalation, information disclosure, or denial of service depending on platform security boundaries. No public exploit code or active exploitation has been confirmed at time of analysis.
Z-BlogPHP 1.7.5 allows authenticated remote attackers with administrative privileges to upload arbitrary files via the App::UnPack function in the ZBA File Handler component (/zb_users/plugin/AppCentre/app_upload.php), bypassing file upload restrictions and potentially enabling remote code execution. Public exploit code exists, and the vendor has not responded to early disclosure attempts.
Cross-site scripting (XSS) in ComfyUI up to version 0.13.0 allows authenticated remote attackers to inject malicious scripts through the View Endpoint in server.py, affecting user integrity with publicly available exploit code. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting its severity despite network accessibility. ComfyUI's vendor has not responded to early disclosure attempts, and the exploit has been published on GitHub, making this a low-CVSS but publicly weaponized vulnerability affecting an AI image generation framework.
Stored cross-site scripting (XSS) in ComfyUI's userdata endpoint (getuserdata function in app/user_manager.py) allows authenticated attackers to inject malicious scripts that execute in other users' browsers. Affected versions range from 0.1 through 0.13.0. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact, but publicly available exploit code exists and the vendor has not responded to disclosure.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files on the server by manipulating the Name argument in the LoadImage Node's folder_paths.get_annotated_filepath function. The vulnerability has publicly available exploit code and affects the image loading functionality, enabling attackers with valid credentials to access sensitive files outside intended directories.
Path traversal in ComfyUI up to version 0.13.0 allows authenticated remote attackers to read arbitrary files via manipulation of the get_model_preview function in the Model Preview Endpoint. An attacker with valid credentials can traverse the file system to access sensitive configuration files, model weights, or other data outside intended directories. Public exploit code is available, and the vendor has not provided a patched version despite early disclosure notification.
Cross-site request forgery (CSRF) in ComfyUI up to version 0.13.0 allows unauthenticated remote attackers to modify application state via crafted requests to the create_origin_only_middleware function in server.py. The vulnerability requires user interaction (clicking a malicious link or visiting an attacker-controlled site) but has low integrity impact and is publicly exploitable with proof-of-concept code available. The vendor has not responded to early disclosure notification.
Buffalo Link Station version 1.85-0.01 allows privilege escalation through username and role enumeration via parameter manipulation at the /nasapi endpoint. Authenticated or guest-level users can identify valid usernames and their associated privilege roles by modifying request parameters, enabling targeted privilege escalation attacks. While CVSS indicates a network vector, actual exploitation requires prior authentication or guest access, limiting immediate exposure but creating a stepping stone for further attacks.
OpenXiangShan NEMU fails to properly enforce Smstateen permission controls, allowing authenticated local users to access IMSIC (Incoming Message Signal Interrupt Controller) state through stopei/vstopei CSRs despite mstateen0.IMSIC being cleared. This privilege escalation enables cross-context information disclosure of interrupt state and potential disruption of interrupt handling mechanisms in lower-privileged execution contexts.
Stored cross-site scripting (XSS) in Apartment Visitors Management System v1.1 allows authenticated attackers to inject malicious JavaScript via the visname parameter in visitors-form.php, which executes when other users view the injected data in manage-newvisitors.php or visitor-detail.php. The vulnerability requires user interaction (victim visiting affected pages) and valid authentication but can escalate privileges, steal session tokens, or perform actions on behalf of administrative users viewing visitor records.
Stack-use-after-return memory corruption in Arduino_Core_STM32 (stm32duino) allows local low-privileged actors to trigger undefined behavior via dangling pointer dereference in interrupt service routines on devices running firmware built with versions prior to 1.7.0. The pwm_start() function stores a stack-allocated TIM_HandleTypeDef pointer in a global HAL timer registry; once the function returns and the stack frame is reclaimed, any timer ISR that fires will dereference a now-invalid pointer, corrupting memory. A researcher disclosure repository (CVE-2026-26399-Disclosure) is publicly referenced, suggesting exploit details exist, though EPSS at 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm no broad active exploitation at time of analysis.
Server-side request forgery in PHPEMS 11.0 allows authenticated remote attackers to manipulate the uploadfile parameter in the Instant Exam Creation Handler component, enabling SSRF attacks that can access internal resources or perform unauthorized requests from the server. The vulnerability affects the temppage function in /app/exam/controller/exams.master.php and has public exploit code available, though exploitation requires valid user credentials (PR:L).
EyouCMS versions up to 1.7.1 allow high-privileged attackers to upload arbitrary files via manipulation of the filename parameter in the edit_adminlogo function, leading to information disclosure and potential code execution. The vulnerability requires authenticated admin access and is publicly exploitable with proof-of-concept code available on GitHub; the vendor has not responded to disclosure attempts.
Heap-based buffer overflow in libvips up to version 8.18.2 via the deprecated im_minpos_vec function in libvips/deprecated/vips7compat.c allows authenticated local attackers to trigger memory corruption through manipulation of the argument n, with publicly available exploit code confirmed and vendor commitment to remove the deprecated code in libvips 8.19.
Stored cross-site scripting (XSS) in Classroom Bookings up to version 2.17.0 allows authenticated users to inject malicious scripts via the displayname parameter in the User Display Name Handler component, resulting in arbitrary script execution in other users' browsers. The vulnerability requires user interaction (victim must view the affected page) and authenticated access, limiting immediate risk, but publicly available exploit code and vendor confirmation of the issue increase real-world threat. Upgrading to version 2.17.1 resolves the vulnerability.
STProcessMonitor 11.11.4.0 driver in Safetica Application suite allows local privileged users to send crafted IOCTL requests (0xB822200C) that terminate processes protected by third-party security implementations due to insufficient caller validation in the kernel-mode driver handler. This enables denial of service attacks against critical services without requiring user interaction. Publicly available exploit code exists, and the vulnerability is tracked in CISA's LOLDrivers database as a legitimate-but-abused Windows driver.
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
Cross-site scripting (XSS) in goldmark HTML renderer before version 1.7.17 allows unauthenticated remote attackers to execute arbitrary JavaScript by encoding dangerous URL schemes (such as javascript:) using HTML5 named character references, bypassing the renderer's prefix-based protocol validation due to improper ordering of entity resolution. Applications using affected versions can be exploited via crafted markdown containing malicious links that render unsafe protocols in user contexts, with a CVSS score of 6.1 indicating moderate real-world impact driven by the requirement for user interaction (UI:R) and change of scope across trust boundaries.
Denial of service in Nordic Semiconductor IronSide SE for n
Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 at /scheduler/admin/user/manage_user.php allows high-privilege authenticated attackers to read sensitive data via crafted SQL queries. CVSS score of 2.7 reflects the requirement for high administrative privileges (PR:H), limiting real-world impact. SSVC framework confirms no known active exploitation, non-automatable attack, and partial technical impact (confidentiality only). This is a low-severity vulnerability constrained by authentication requirements despite the presence of a SQL injection flaw.
Type-confusion (CWE-843) in Transloadit's Uppy file-uploader library at version 0.25.6 can lead to memory corruption and information disclosure when a resource is accessed using an incompatible type. Published details are minimal, but the assigned CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) asserts remote, unauthenticated impact with total loss of confidentiality, integrity, and availability. There is no public exploit identified and no CISA KEV listing; a referenced GitHub gist may contain a proof-of-concept but its contents are unverified, and the 0.02% EPSS score plus SSVC 'exploitation: none' indicate no observed exploitation to date.
Improper authorization in Snipe-IT v8.4.0 allows authenticated attackers holding the users.edit permission to overwrite sensitive authentication and account-state fields on arbitrary non-admin user accounts via a crafted PUT request to /api/v1/users/{id}. A publicly available proof-of-concept exists (SSVC: poc), enabling low-complexity account manipulation or effective takeover of regular user accounts without requiring admin privileges. The vulnerability is not confirmed in CISA KEV, and with an EPSS of 0.03% (8th percentile) widespread automated exploitation appears unlikely at this time, though the POC lowers the barrier to targeted misuse.
Reflected cross-site scripting (XSS) in manikandan580 School-management-system 1.0 allows unauthenticated remote attackers to inject malicious scripts via the pagedes POST parameter in /studentms/admin/contact-us.php, affecting users with browser cookies or session tokens. Publicly available exploit code exists, and the vulnerability impacts confidentiality and integrity with moderate scope. CVSS score of 6.1 reflects the requirement for user interaction to trigger the malicious payload.
Time-based blind SQL injection in manikandan580 School Management System 1.0 allows unauthenticated remote attackers to extract sensitive database contents and potentially execute arbitrary SQL commands through the fromdate POST parameter in /studentms/admin/between-date-reprtsdetails.php. The CVSS 9.8 critical score reflects network-based exploitation requiring no privileges or user interaction, with complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though the specific vulnerable parameter and injection type are documented in public security advisories.
Reflected cross-site scripting (XSS) in School Management System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email POST parameter in the contact-us.php admin interface. A victim must click a crafted link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to malicious sites. Public proof-of-concept code exists; however, real-world exploitation probability remains low (EPSS 0.02%) due to reliance on user interaction and limited automaton.
SQL injection in manikandan580's School Management System version 1.0 lets a remote attacker inject malicious SQL through a crafted HTTP request to a vulnerable endpoint, manipulating query logic to read sensitive database contents such as credentials and student/staff records. The advisory and CVSS PR:N indicate the flaw is reachable without authentication, and publicly available exploit code exists (proof-of-concept published), though EPSS remains very low at 0.03% and it is not listed in CISA KEV. SSVC rates technical impact as total and the attack as automatable, making it an attractive target for opportunistic scanning despite its niche footprint.
Stored or reflected cross-site scripting (XSS) in alandsilva26 hotel-management-php 1.0 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of authenticated administrators via a malicious room_id GET parameter in /public/admin/edit_room.php. Public exploit code exists (SSVC confirms poc status). The vulnerability requires user interaction (UI:R) to trigger, affecting confidentiality and integrity of admin sessions with partial technical impact.
SQL injection in Grocery Store Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands through the sitem_name parameter in search_products_itname.php. The vulnerability achieves maximum CVSS 9.8 due to network accessibility without authentication, enabling complete database compromise including data exfiltration, modification, and potential system takeover. EPSS data not available; no confirmed active exploitation (CISA KEV) identified at time of analysis, though publicly available exploit code exists per researcher advisory.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege administrators to read sensitive data through the /scheduler/admin/appointments/manage_appointment.php endpoint. The vulnerability requires administrative credentials and does not enable data modification or denial of service, limiting real-world impact despite network-accessible exposure. CVSS score of 2.7 reflects the high authentication barrier and confidentiality-only impact; CISA SSVC framework rates exploitation as 'none' with no automatable attack path.
SQL injection in SourceCodester Patient Appointment Scheduler System v1.0 allows authenticated high-privilege users to read sensitive database information via the /scheduler/admin/appointments/view_details.php endpoint. The vulnerability requires administrative credentials and network access but carries low real-world risk due to restrictive authentication requirements (PR:H), limited scope of impact (confidentiality only), and CVSS score of 2.7. No public exploit code or active exploitation has been identified.
SourceCodester Patient Appointment Scheduler System v1.0 suffers from SQL injection in the SystemSettings.php update_settings function, allowing authenticated high-privilege administrators to execute arbitrary SQL queries. While tagged as RCE, the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) and SSVC framework indicate limited confidentiality impact with no confirmed integrity or availability consequences; this is primarily a SQL injection vulnerability requiring administrative credentials with no public exploit code identified at time of analysis.
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/attendance_list.php endpoint, enabling unauthorized data disclosure with low confidentiality impact. The vulnerability requires administrator-level access and carries minimal real-world risk due to high privilege requirements and low exploitability (SSVC exploitation status: none), though it represents a defense-in-depth failure in an administrative function.
SQL injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to extract sensitive database information via the /wfh_attendance/admin/manage_department.php endpoint. The CVSS 2.7 score reflects low real-world risk due to the requirement for high-privilege administrative credentials and confidentiality-only impact; no public exploit code has been identified, and the vulnerability is not confirmed as actively exploited.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege authenticated attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/manage_employee.php file. The CVSS score of 2.7 reflects limited impact (confidentiality only, no integrity or availability loss) and high authentication barriers (administrator role required). No public exploit code or active exploitation has been confirmed.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privilege remote attackers to read sensitive database contents via crafted input to the /wfh_attendance/admin/view_employee.php endpoint. CVSS 2.7 reflects high authentication barriers (PR:H requires admin access), no automatable exploitation per SSVC, and confidentiality impact only. No public exploit code or active exploitation confirmed at time of analysis.
SQL Injection in SourceCodester Online Employees Work From Home Attendance System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL queries via the /wfh_attendance/admin/view_att.php endpoint, potentially disclosing sensitive employee attendance data. The vulnerability requires administrative credentials and carries low real-world risk despite SQL injection's severity class, as evidenced by CVSS 2.7 and SSVC designation of no exploitation likelihood with partial technical impact. No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privilege authenticated administrators to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_pricing.php endpoint, resulting in partial confidentiality impact. The CVSS score of 2.7 reflects the requirement for high administrative privileges and absence of integrity or availability impact, placing this as a low-risk vulnerability despite the SQL injection classification. No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Storage Unit Rental Management System v1.0 allows high-privileged remote attackers to read sensitive data through the /storage/admin/tenants/view_details.php endpoint. With a CVSS score of 2.7 and requirement for high administrative privileges (PR:H), this vulnerability has minimal real-world impact despite the SQL injection class; however, it represents a privilege-abuse risk within already-compromised administrative contexts. No public exploit code or active exploitation has been confirmed.
SQL injection in SourceCodester Storage Unit Rental Management System v1.0 allows high-privileged authenticated attackers to read sensitive database contents via crafted input in /storage/admin/rents/manage_rent.php. The vulnerability requires administrator-level access and produces only limited information disclosure with no impact on data integrity or availability. EPSS and SSVC assessments indicate minimal real-world exploitation risk due to authentication barrier and non-automatable attack requirements.
SQL Injection in SourceCodester Storage Unit Rental Management System v1.0 allows authenticated administrative users to execute arbitrary SQL queries via the /storage/admin/maintenance/manage_storage_unit.php endpoint. The vulnerability requires high-privilege access (PR:H) and returns only limited information (confidentiality impact only), resulting in a low CVSS score of 2.7. No public exploit code or active exploitation has been confirmed at the time of analysis.
Local File Inclusion in LibreNMS's NFSen module (nfsen.inc.php) enables authenticated low-privilege users to traverse the server filesystem and include arbitrary PHP files by manipulating the nfsen HTTP parameter with path traversal sequences. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.02% (5th percentile) and SSVC non-automatable classification indicate limited mass-exploitation potential. The vulnerability carries high confidentiality impact per CVSS - sensitive configuration files, credentials, or other PHP-readable data on the server are at risk - while integrity and availability remain unaffected.
Arbitrary code execution in OpenAI Codex CLI v0.23.0 and earlier occurs because the tool automatically loads project-local .env and .codex/config.toml (MCP configuration) files without any user confirmation when a developer runs the codex command inside a repository. An attacker who controls or poisons a repository can embed commands that execute immediately on the victim's machine when Codex is invoked there. Publicly available exploit code exists (SSVC 'poc') and Check Point Research published a technical write-up, but the flaw is not on CISA KEV and EPSS is very low (0.02%), indicating no evidence of widespread active exploitation.
Server-Side Request Forgery in HummerRisk up to version 1.5.0 allows a high-privileged authenticated attacker to manipulate the streamIp argument within the ServerService.addServer function of the Video File Download URL Handler (ServerService.java), causing the server to issue arbitrary HTTP requests to internal or external destinations. All versions from 1.0 through 1.5.0 are confirmed affected, the vendor did not respond to responsible disclosure, and no patch is available. A public proof-of-concept exploit exists (referenced via GitHub), though EPSS at 0.03% and SSVC classification of non-automatable indicate limited broad-exploitation risk at this time.
Cross-site scripting in DbGate's SVG Icon String Handler allows a remote authenticated attacker to inject malicious script via the applicationIcon argument in FontIcon.svelte, executing arbitrary JavaScript in a victim user's browser session. Affected versions span 7.1.0 through 7.1.4, with a confirmed fix released in v7.1.5. A public proof-of-concept exploit has been disclosed via VulDB, though EPSS at 0.03% (9th percentile) and SSVC's 'exploitation: none' designation indicate no observed active exploitation at time of analysis.
Server-side request forgery in DbGate versions 7.1.0 through 7.1.4 allows authenticated remote attackers to manipulate the `apiServerUrl1` function within the REST/GraphQL component to induce the DbGate server to make arbitrary outbound HTTP requests. A public proof-of-concept exploit is available, though EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate minimal observed real-world exploitation to date. The vendor did not respond to coordinated disclosure, leaving no vendor-released patch available at time of analysis.
HTML injection in Vtiger CRM 8.4.0 allows unauthenticated attackers to embed arbitrary HTML content into the Dashboard interface by manipulating the `tabid` parameter of the DashBoardTab view's `getTabContents` action. Exploitation requires luring an authenticated CRM user to a crafted URL, after which injected content renders in the victim's browser with potential for credential harvesting, session theft, or phishing overlays. No active exploitation is confirmed — CISA KEV is absent, EPSS sits at 0.02% (5th percentile), and SSVC rates technical impact as partial with exploitation status of none — indicating low real-world urgency despite the scope-changing CVSS 6.1 score.
Reflected cross-site scripting (XSS) in Vtiger CRM 8.4.0 MailManager module allows authenticated attackers to execute arbitrary JavaScript in a user's browser session via a specially crafted double URL-encoded payload in the _folder parameter. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity within the scope of the authenticated session. With an EPSS score of 0.02% (5th percentile), real-world exploitation risk is minimal despite public disclosure.
SQL injection in Sourcecodester Online Thesis Archiving System v1.0 at /otas/admin/curriculum/manage_curriculum.php allows authenticated high-privileged administrators to extract sensitive database information through unsanitized query parameters. With a CVSS score of 2.7 and EPSS of 0.01% (2nd percentile), this vulnerability presents minimal real-world risk despite valid SQL injection mechanics, as exploitation requires admin-level credentials and yields only confidentiality impact. No public exploit code or active exploitation has been confirmed.
SQL injection in Sourcecodester Online Thesis Archiving System v1.0 allows high-privilege authenticated attackers to extract sensitive information via the /otas/projects_per_department.php endpoint. The vulnerability requires admin-level credentials (PR:H per CVSS) and has minimal confidentiality impact with an EPSS score of 0.01%, indicating very low real-world exploitation probability despite public disclosure on GitHub.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privileged authenticated attackers to query the database with limited confidentiality impact via the /orms/admin/rooms/view_room.php endpoint. The CVSS score of 2.7 and EPSS percentile of 6% reflect low real-world exploitation probability; SSVC assessment confirms no known automated exploit path and only partial technical impact (information disclosure). No public exploit code or active exploitation has been identified.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL queries via the /orms/admin/reservations/view_details.php endpoint, resulting in limited information disclosure. The vulnerability requires administrative access and carries minimal real-world risk due to CVSS 2.7, EPSS 0.02% (6th percentile), and SSVC framework assessment indicating no active exploitation and non-automatable attack requirements.
Stored cross-site scripting in Snipe-IT asset management system v8.3.0-8.3.1 allows authenticated users with basic login privileges to inject malicious JavaScript via Name and Surname fields, which executes when other users view Activity Reports or modified profiles. This vulnerability requires the victim's Display Name to be unset and affects all users with sufficient permissions to access those views. Patch available in v8.3.2; EPSS score is minimal (0.01%), indicating low empirical exploitation likelihood despite network-accessible attack vector.
Heap use-after-free in Nitro PDF Pro 14.41.1.4 for Windows allows local code execution via malicious PDF containing crafted JavaScript calling this.mailDoc(). The vulnerability stems from premature deallocation of an XID object whose freed pointer is passed to wcscmp() and other functions, where attacker-controlled strings in the freed heap region can manipulate program flow. CVSS 8.4 (AV:L/PR:N) indicates local attack vector requiring no privileges or user interaction. EPSS 0.01% suggests low immediate exploitation probability; no public exploit identified at time of analysis.
Nitro PDF Pro 14.41.1.4 for Windows crashes when processing maliciously crafted PDFs that invoke app.alert() with null arguments, causing denial of service through NULL pointer dereference in the JavaScript engine. Remote attackers can deliver weaponized PDF files requiring no authentication or user interaction beyond opening the document (AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (2nd percentile), indicating low real-world targeting despite theoretical automation potential.
Nitro PDF Pro for Windows version 14.41.1.4 crashes when processing maliciously crafted XFA (XML Forms Architecture) packets due to a NULL pointer dereference, enabling remote denial-of-service attacks without authentication. An attacker can deliver a weaponized PDF containing the crafted XFA packet, causing the application to terminate when opened. EPSS exploitation probability is very low (0.01%, 2nd percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis. Despite CVSS 7.5 (High), real-world risk is limited to availability impact only - no code execution, data theft, or privilege escalation possible.
SQL Injection in Sourcecodester Online Resort Management System v1.0 allows authenticated administrators to extract or modify database contents via the /orms/admin/rooms/manage_room.php endpoint. The vulnerability requires high-privilege administrative access and has minimal real-world impact given the CVSS score of 2.7, EPSS exploitation probability of 0.02%, and CISA SSVC determination of non-exploitable status with only partial technical impact. No active exploitation has been confirmed.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated administrators to execute arbitrary SQL queries via the /rsms/admin/clients/manage_client.php endpoint, potentially exposing sensitive data with low confidentiality impact. The vulnerability requires high-privilege administrator authentication and carries minimal real-world risk (EPSS 0.02%, SSVC indicates no exploitation activity), but represents a common code quality issue in open-source PHP applications that warrants remediation during security updates.
SQL injection in Sourcecodester Basic Library System v1.0 allows high-privilege authenticated attackers to extract limited information from the database via crafted input to /librarysystem/load_book.php. The vulnerability requires administrative credentials and has very low real-world risk (EPSS 0.02%, CVSS 2.7) with no public exploit code identified; CISA does not list it as actively exploited.
Denial of service in Parani M10 Motorcycle Intercom v2.1.3 via crafted Bluetooth RFCOMM frames allows unauthenticated attackers within wireless range to crash the device. The vulnerability exploits a buffer overflow in the RFCOMM service handler, causing high availability impact. A proof-of-concept exists but active exploitation has not been confirmed; EPSS score of 0.02% suggests limited real-world exploitation pressure despite the accessible attack vector.
Unrestricted file upload in PHPGurukul Online Course Registration v3.1 allows an authenticated user to upload a malicious PHP file through the profile picture feature on /my-profile.php, leading to remote code execution on the hosting server. The upload handler fails to validate file type or content, so a low-privileged registered account is enough to plant a web shell. Publicly available exploit code exists (SSVC 'poc') and a Medium write-up documents the technique, though EPSS remains very low (0.02%) and it is not listed in CISA KEV.
SQL injection in Sourcecodester Basic Library System v1.0 at /librarysystem/load_student.php allows high-privilege authenticated attackers to read sensitive database information. The vulnerability requires administrative-level privileges and manual user interaction is absent, but real-world risk is minimal due to extremely low EPSS score (0.02%), CVSS severity of 2.7, and CISA SSVC assessment indicating no exploitation activity, non-automatable conditions, and only partial technical impact.
SQL injection in Sourcecodester Basic Library System v1.0 allows high-privilege authenticated attackers to extract sensitive data via the /librarysystem/load_admin.php endpoint. The vulnerability requires administrative authentication, limiting exposure to compromised or malicious admin accounts. EPSS exploitation probability is minimal at 0.02% (6th percentile), and no public exploit code has been identified, making this a low-priority issue despite the SQL injection vector.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 allows authenticated high-privilege users to read sensitive database content via crafted input in the repairs details viewer. The vulnerability requires admin-level authentication and carries minimal real-world risk given the CVSS 2.7 score, EPSS 0.02% exploitation probability, and CISA SSVC assessment indicating no known exploitation, non-automatable attack, and only partial technical impact (confidentiality). No active exploitation has been confirmed.
SQL injection in Sourcecodester Computer and Mobile Repair Shop Management System v1.0 at /rsms/admin/repairs/manage_repair.php allows authenticated administrators to extract or modify limited database information. The attack requires high-level administrative privileges and produces only confidentiality impact; EPSS probability is minimal (0.02%), and CISA SSVC assessment indicates no evidence of real-world exploitation.
SQL injection in Sourcecodester Online Resort Management System v1.0 allows high-privilege authenticated attackers to read sensitive application data via crafted input to the /orms/admin/activities/manage_activity.php endpoint. The vulnerability requires administrator-level credentials and produces only confidentiality impact with negligible real-world exploitation risk, as indicated by 0.02% EPSS score and CISA SSVC partial technical impact assessment.
Stack overflow in tinyobjloader's experimental MTL file parser (tinyobj_loader_opt.h) allows local attackers to trigger denial of service by supplying a malformed .mtl file. The vulnerability affects the library's material file parsing logic and crashes the application via stack memory corruption, though with EPSS score of 0.01% and no confirmed active exploitation, real-world risk is minimal despite the moderate CVSS 6.2 rating.