N A
Monthly
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
Server-Side Request Forgery in usememos/memos through v0.30.0 allows authenticated users to redirect server-side HTTP requests to arbitrary internal network addresses by configuring a malicious webhook target URL. The CVSS S:C (Scope Changed) rating reflects that exploitation breaks the application boundary, enabling access to internal infrastructure such as cloud metadata endpoints, internal APIs, or RFC1918-addressed services. A publicly available proof-of-concept exists via GitHub gist; however, EPSS remains low at 0.22% (13th percentile), indicating limited observed exploitation in the wild at time of analysis despite the high CVSS score of 8.5.
SSO-based account takeover in usememos Memos v0.27.1 lets a remote, unauthenticated attacker impersonate any user by exploiting the ssoCredentials path of the SignIn handler (server/router/api/v1/auth_service.go), which matches a federated identity solely on an attacker-controllable identifier (e.g. email or username) instead of the identity provider's stable subject claim. Any deployment that has an OIDC/OAuth SSO provider enabled is affected, and a successful attack yields full control of the targeted account, including potentially administrative accounts. The flaw carries CVSS 9.8 and CWE-287; there is no public exploit identified as weaponized at time of analysis, though a referenced GitHub gist appears to be a researcher write-up, and EPSS is low at 0.22%.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
Remote unauthenticated denial of service in Systerel S2OPC Toolkit 1.7.3 is exploitable via the OPC UA AddNodes service, triggering a classic buffer overflow (CWE-120) in address_space_bs.c and sopc_node_mgt_helper_internal.c that crashes the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is reachable from the network without credentials or user interaction, making it trivially automatable against exposed OPC UA endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis, though the impact is particularly acute in OT/ICS environments where S2OPC is deployed, as availability loss in industrial control infrastructure can translate to physical process disruption.
Denial of service in Systerel S2OPC 1.7.3 allows remote unauthenticated attackers to crash or render unavailable an OPC UA server by sending crafted requests that trigger uncontrolled resource consumption in the event monitored-item queue resize handling. Affected source code is confirmed across subscription_core.c and monitored_item_notification_queue_bs.c. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.
Denial-of-service via buffer overflow in open62541 v1.5.5 allows a remote, unauthenticated attacker to crash an OPC UA server by sending a crafted Service_Call request with malformed input arguments. The flaw resides in the method-call service handler (ua_services_method.c), where input arguments are validated against runtime-resolved InputArguments metadata without proper bounds enforcement. No active exploitation or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful availability risk for any OPC UA server deployment based on this library version.
Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.
Heap-based buffer overflow in Systerel S2OPC Toolkit 1.7.3 enables remote denial of service by sending a crafted OPC UA PublishResponse containing malformed EventNotificationList data to the Alarm/Conditions client wrapper. The affected code paths - libs2opc_client_alarm_conditions.c, state_machine.c, and sopc_event_manager.c - process incoming subscription notification data without adequate bounds checking, allowing a malicious or compromised OPC UA server to crash any connected S2OPC client. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.5/High rating and unauthenticated network vector make this a meaningful risk in OPC UA-enabled industrial environments.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows unauthenticated remote attackers to crash or exhaust resources on OPC UA servers by sending crafted NodeManagement type-instantiation requests. The flaw resides in the server-side node management service logic and is exploitable over the network with no privileges or user interaction under the default access control configuration. No CISA KEV listing exists as of analysis, but the SSVC framework classifies the attack as automatable with a proof-of-concept present; the EPSS score of 0.25% (16th percentile) indicates limited observed exploitation in the wild despite that automation potential.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Server-side use-after-free in open62541 1.5.5 allows a remote attacker to crash an OPC UA server process, causing denial of service. The flaw arises in the local MonitoredItem subscription path where UA_Subscription_localPublish continues dereferencing a UA_Notification object after a callback has already freed it by calling UA_Server_deleteMonitoredItem on the active item. No public exploit or CISA KEV listing has been identified; impact is limited to availability with no confidentiality or integrity exposure.
Out-of-bounds read in S2OPC Toolkit 1.7.3's RepublishResponse message handler enables unauthenticated remote attackers to crash the OPC UA service via a crafted network message, resulting in denial of service. The vulnerable code paths span the subscription publish service layer (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c) and the common encoder module (sopc_encoder.c). No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates low-barrier remote exploitation requiring no authentication against reachable OPC UA endpoints.
Hardcoded RTSP credentials in Zosi C519M IP camera firmware V4.2.8.823C01450BA expose live video feeds to any network-reachable attacker. The built-in credentials embedded in the RTSP authentication mechanism cannot be changed by the device owner, making every affected unit permanently vulnerable to unauthorized stream access. A public proof-of-concept exists on GitHub, and CISA's SSVC framework rates the attack as automatable with no exploitation preconditions beyond network reachability - no public exploit identified as actively exploited in CISA KEV at time of analysis.
Stack-based buffer overflow in Systerel S2OPC 1.7.3 enables remote denial of service against OPC UA client applications. A malicious or compromised OPC UA server can send a crafted DeleteMonitoredItemsResponse message that triggers an overflow in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems within the client_wrapper state machine, crashing the client process. No public exploit or active exploitation has been identified at time of analysis, though source code references confirm the vulnerable code path exists in the published repository.
Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.
Heap use-after-free in open62541's GDS PushManagement certificate update workflow enables remote unauthenticated denial of service against OPC UA servers built with the UA_ENABLE_GDS_PUSHMANAGEMENT compile-time flag. The vulnerability is remotely exploitable with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N per CVSS), crashing the affected server process. SSVC intelligence confirms a proof-of-concept exists and the attack is automatable, though EPSS at 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains limited or targeted as of time of analysis.
Cross-site scripting in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a network-accessible, unauthenticated attacker to inject malicious JavaScript into user-controlled fields (Role Name, First Name, Last Name, Username) that is subsequently rendered to authenticated users - most likely administrators reviewing account data. Exploitation yields client-side arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is recorded in CISA KEV, and EPSS indicates a 0.19% probability of near-term exploitation; however, a public researcher writeup exists on GitHub (FahadAljuaid), meaningfully raising practical risk.
Arbitrary code injection in Vim 9.2.0389 and earlier exposes OpenVMS deployments to local code execution through a flaw in the platform-specific `vms_fixfilename()` function in `os_vms.c`. A local attacker can craft a malicious filename that bypasses sanitization controls in this VMS-only code path, causing Vim to execute injected code. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though a researcher's technical write-up is publicly accessible via GitHub Gist; the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability in practice.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Arbitrary code execution affects Vim v9.2.0389 and earlier through a memory management flaw in the OpenVMS-specific vms_fixfilename() function in vim/src/os_vms.c. A local attacker on an OpenVMS system can trigger this CWE-401 condition to achieve full code execution with high confidentiality, integrity, and availability impact. No public exploit confirmed at time of analysis, and the extremely low EPSS score (0.15%, 4th percentile) combined with the platform-specific attack surface indicates minimal real-world exploitation risk.
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows remote unauthenticated attackers to crash OPC UA servers by sending crafted subscription-lifecycle requests. The affected request types - CreateSubscription, CreateMonitoredItems (Sampling mode), Publish, TransferSubscriptions, and DeleteSubscriptions - are core to OPC UA data exchange, meaning the vulnerability sits on a heavily-used protocol surface in industrial and IoT deployments. A POC exists per SSVC classification, the attack is rated automatable, and availability impact is rated High by NVD; however, EPSS stands at only 0.25% (16th percentile), indicating limited observed exploitation interest at this time.
Arbitrary code execution in NASA's core Flight System (cFS) v7.0.1 is possible through the Executive Services (ES) dynamic application start path, where improper access control lets an attacker plant a malicious shared object on target storage that is then loaded and run as a flight application. SSVC records a proof-of-concept exploit (publicly available exploit code exists) and rates technical impact as total with automatable exploitation, though EPSS is very low at 0.15% (5th percentile). The published NVD vector is CVSS 9.1 (AV:N), but the described mechanism - dropping a shared object onto storage - implies local write access is a genuine prerequisite.
Out-of-bounds read in open62541 1.5.5 allows a malicious OPC UA server to crash connecting clients via a crafted namespace array response. The flaw resides in the client-side connection handler responseReadNamespacesArray() in src/client/ua_client_connect.c, triggered during the namespace discovery phase of the OPC UA session establishment. With a CVSS availability impact of High and no privileges required on the attacker side, the practical effect is a remotely-induced denial of service against any open62541-based OPC UA client that connects to an attacker-controlled server. No public exploit identified at time of analysis.
Denial of service in open62541 v1.5.5 and earlier allows a remote unauthenticated attacker to crash an affected client via a malformed or malicious response processed by the UA_Client_getRemoteDataTypes function. open62541 is an open-source C implementation of the OPC UA industrial communication protocol, making this vulnerability relevant to ICS, SCADA, and industrial IoT deployments. No public exploit code has been explicitly confirmed, but a GitHub issue (open62541/open62541#8140) documents the flaw, and no actively exploited status (KEV) has been assigned at time of analysis.
Denial of service in NASA Core Flight System (cFS) v7.0.1 results from insufficient replay protection in the CFDP (CCSDS File Delivery Protocol) receive path, enabling unauthenticated network attackers to crash or disrupt the flight software stack by sending replayed final CFDP PDUs. SSVC classifies this as automatable with a proof-of-concept available, though the EPSS score of 0.14% (4th percentile) reflects the narrow operational footprint of aerospace flight software. No CISA KEV listing confirms active exploitation at time of analysis.
Remote denial of service in NASA Core Flight System (cFS) v7.0.1 allows unauthenticated network attackers to crash the Software Bus Network (SBN) application by sending a crafted peer subscription packet that triggers a parser boundary flaw. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector confirms no authentication or user interaction is required, making this trivially reachable against any exposed SBN interface. Despite the high CVSS score of 7.5, the EPSS score of 0.16% at the 5th percentile and absence of a CISA KEV listing or public exploit code suggest no public exploitation activity at time of analysis.
Forced processor reset in NASA Core Flight System (cFS) v7.0.1 is achievable by supplying a crafted entry to the HS.AppMon_Tbl, exploited through the HS_MonitorApplications() function in the Health and Safety application module. The vulnerability targets embedded real-time flight software used in spacecraft, where an unplanned processor reset can have mission-critical consequences. A proof-of-concept exists per SSVC data, exploitation is rated automatable, and the EPSS score of 0.14% (4th percentile) suggests no widespread opportunistic scanning - consistent with narrow, targeted exploitation in aerospace operational contexts. No active CISA KEV listing has been confirmed.
Unauthenticated remote attackers can manipulate the CCSDS File Delivery Protocol (CFDP) metadata handler in NASA Core Flight System v7.0.1, specifically the CF_CFDP_RecvMd() function, to control the destination path where received file content is stored on the target system, resulting in high-impact information disclosure. A publicly available proof-of-concept exists per SSVC classification, making this exploitable without authentication or user interaction against any network-reachable cFS instance with the CF application enabled. Despite the availability of exploit code and network-accessible attack vector, the EPSS score of 0.14% (4th percentile) reflects the extremely limited real-world deployment footprint of this aerospace-domain platform.
Uncontrolled resource consumption in NASA's fprime framework v4.2.2 exposes the Ref::SignalGen component to remote denial-of-service attacks via unsanitized user-supplied parameters. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated, low-complexity network exploitation - however, this risk must be contextualized: fprime is a niche aerospace embedded software framework, and a POC exists per SSVC data, though EPSS of 0.14% (4th percentile) signals negligible real-world exploitation interest. No public exploit has been confirmed as actively exploited, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect access control in NASA Core Flight System (cFS) v7.0.1 permits unauthenticated remote attackers to manipulate the telemetry subscription table by sending arbitrary TO_LAB (Telemetry Output Lab) add and remove subscription commands. Low-index subscriptions can be silently removed and new data streams injected, threatening the integrity of telemetry routing on ground-connected flight software deployments. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation activity, though the complete absence of authentication on a command interface is a structurally severe design flaw.
Root-level OS command injection in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 lets attackers inject shell metacharacters into a parameter that is passed unsanitized to a system command, yielding arbitrary command execution as root. OpenMediaVault is a Debian-based network-attached-storage (NAS) management platform, and the -md plugin manages Linux mdadm software RAID arrays. Publicly available exploit code exists (a proof-of-concept gist is referenced), though there is no public exploit identified in CISA KEV; EPSS is modest at 0.62% (46th percentile).
Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.
Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.
Integer overflow in the Svc::FileDownlink::SendPartial component of NASA's fprime embedded flight software framework v4.2.2 allows unauthenticated remote attackers to crash the service via crafted input, resulting in a Denial of Service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special privileges are required, and a potential proof-of-concept is referenced at a public GitHub issue tracker. Despite the high CVSS score, EPSS sits at just 0.14% (4th percentile), and there is no CISA KEV listing, reflecting the niche aerospace deployment context of this framework.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.
OS command injection in the Serverless-Devs CLI (@serverless-devs/s versions 3.1.11 and earlier) lets an attacker execute arbitrary commands on a developer's machine when they run 's init' with a crafted, attacker-influenced argument. The tool passes unsanitized input into child_process.spawn() with shell:true, and the single guard check - requiring the value to end in '.git' - is trivially satisfied by an attacker while still smuggling shell metacharacters. Publicly available exploit code exists (a proof-of-concept gist), SSVC rates technical impact as total and automatable, but EPSS remains low at 0.48% and it is not in CISA KEV.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
Denial of Service in NASA core Flight System (cFS) v7.0.1 is achievable by any network-adjacent attacker who can reach the SBN UDP interface, requiring no authentication or special privileges. Sending a single crafted SBN frame is sufficient to trigger the fault, consistent with CWE-20 (Improper Input Validation) in the Software Bus Network application's UDP packet handler. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.14% (4th percentile), reflecting the niche aerospace deployment footprint rather than low technical severity.
Path traversal in the DS_SetDestPathCmd() function of NASA Core Flight System (cFS) v7.0.1 enables remote unauthenticated attackers to bypass access controls and read sensitive system components by supplying a crafted destination path string. The DS (Data Storage) application fails to properly sanitize or restrict path values passed via command, violating the intended access control boundary between storage destinations and protected system components. A proof-of-concept exists per SSVC data, and exploitation is assessed as automatable, though real-world risk is tempered by the specialized aerospace deployment context and a very low EPSS score of 0.14% (4th percentile).
Privilege escalation in FeehiCMS v.2.1.1 exploits insufficient session expiration (CWE-613) across the session management module, authentication logic, and logout handler, allowing a network-based attacker to reuse captured session tokens even after legitimate user logout to gain elevated access. The CVSS 3.1 score of 7.4 (High) reflects high confidentiality and integrity impact under high attack complexity, with no authentication required on the attacker's side. A public proof-of-concept write-up exists on GitHub; however, EPSS sits at 0.20% (10th percentile) and no CISA KEV listing exists, suggesting limited observed exploitation despite available exploit documentation.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
Command injection in Cudy's OpenWRT-based router firmware allows remote attackers to execute arbitrary commands as root through the system.setclock interface, affecting multiple TR- and WR-series models (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, WR6500 v2.3.15). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with total system compromise, and CISA's SSVC framework rates it Automatable with Total technical impact. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is modest at 1.21% (65th percentile).
Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.
Command injection in Cudy TR1200 (firmware v2.4.15) and TR3000 (firmware v2.4.21) routers via the system.setclock interface enables an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability stems from unsanitized input passed directly to a system command, yielding full device compromise - confidentiality, integrity, and availability all rated high. No public exploit or active exploitation (CISA KEV) has been identified; EPSS of 1.21% at the 65th percentile reflects moderate relative risk among disclosed CVEs but low absolute exploitation probability.
Root-level command injection in Cudy TR- and WR-series routers lets attackers run arbitrary OS commands through the ipsec_conn interface, which fails to sanitize user-supplied input before passing it to a shell context. Affected models span TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16), and WR6500 (v2.3.15). No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is modest at 1.21% (65th percentile), so this is a high-severity design flaw without evidence of widespread exploitation yet.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
Authentication bypass in libiec61850 v1.6's GOOSE receiver (parseGoosePayload() in goose_receiver.c) lets an attacker on the substation network replay a captured GOOSE frame to be accepted as authentic, defeating the intended message authentication. The library implements IEC 61850 protocols used in electrical-grid protection and automation, so spoofed GOOSE traffic can drive false relay/breaker actions. Publicly available exploit code exists (PoC repo and SSVC-rated PoC), but there is no CISA KEV listing and EPSS is low at 0.26%, indicating no confirmed widespread exploitation.
Remote code execution is claimed in Hugo Leisink's Hiawatha web server version 12.1 and earlier, reachable by an unauthenticated attacker sending a single crafted HTTP request (CVSS 9.8, CWE-94). Notably, the primary referenced research (fenrisk.com/hiawatha-http-smuggling) and the cited RFCs on chunked/message parsing indicate the underlying defect is HTTP request smuggling rather than classic code injection, so the RCE framing should be treated cautiously. Publicly available exploit code exists (SSVC 'poc'); this is not listed in CISA KEV, and EPSS is low at 0.36% (29th percentile).
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
Authentication bypass in Outstatic CMS versions 2.1.9 and earlier lets an unauthenticated remote attacker forge valid administrative session tokens because the application ships a hardcoded JWT signing secret that is used whenever the OST_TOKEN_SECRET environment variable is left unset. Since the fallback secret is published in the project's public source repository, any attacker can self-sign a JWT granting arbitrary identity and full admin permissions with no credentials. There is no public exploit identified at time of analysis, but the technique is trivial and requires only the publicly-visible secret.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
Root-level command injection in the net.set_wan interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) allows attackers to execute arbitrary OS commands as root by supplying crafted input to WAN configuration parameters. The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying full network-reachable compromise with no privileges required. No public exploit code and no CISA KEV listing were identified at time of analysis, so there is no public exploit identified at this time; the vendor has published security advisory cudy-sa-26-7-jezzy-4.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQLite 3.41 is vulnerable to use after free in the jsonArrayLengthFunc function.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memory information leakage.
sqlite 3.41 has a use-after-free vulnerability in the memory buffer processing logic. Remote attackers can exploit this flaw via specially crafted input to cause arbitrary code execution, sensitive information leakage, or service denial.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
Arbitrary file disclosure in Jinher OA C6 allows unauthenticated remote attackers to read sensitive server files through an XML External Entity flaw in the HrmAttendance sp_manager_getUserlist.aspx GetXmlHttp endpoint, which parses attacker-supplied XML without disabling external entity resolution. Because the attack is unauthenticated (PR:N) and network-reachable (AV:N), a crafted XML payload triggers an out-of-band request that exfiltrates file contents. A public proof-of-concept exists in a GitHub repository, though it is not listed in CISA KEV and EPSS remains low (0.25%), indicating publicly available exploit code but no confirmed active exploitation.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.
Boot-stage integrity bypass in CPSD CryptoPro Secure Disk for BitLocker before v7.7.4 allows an attacker who can present a LUKS-encrypted volume during the pre-boot phase to cause bootxsa.efi to skip all CryptoPro file integrity checks, enabling execution of tampered EFI boot components. Publicly disclosed at Black Hat USA 2026 with an accompanying whitepaper, substantially raising the bar for exploit development. No CISA KEV listing and EPSS at the 1st percentile indicate no observed mass exploitation, but the research-quality disclosure significantly reduces attacker effort for targeted campaigns against affected endpoints.
Protection-mechanism bypass in CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 lets unsigned code run from temporary filesystems because the product fails to enforce its Integrity Measurement Architecture (IMA) policy across those locations. An attacker able to stage a binary in a tmpfs-style path can execute code that the integrity policy was meant to block, undermining the pre-boot/disk-encryption trust model. The flaw was disclosed in Black Hat USA 2026 research ('The Cost of Obscurity', Burch); no public exploit is identified at time of analysis, EPSS is low (0.17%, 6th percentile), and it is not in CISA KEV.
Server-Side Request Forgery in usememos/memos through v0.30.0 allows authenticated users to redirect server-side HTTP requests to arbitrary internal network addresses by configuring a malicious webhook target URL. The CVSS S:C (Scope Changed) rating reflects that exploitation breaks the application boundary, enabling access to internal infrastructure such as cloud metadata endpoints, internal APIs, or RFC1918-addressed services. A publicly available proof-of-concept exists via GitHub gist; however, EPSS remains low at 0.22% (13th percentile), indicating limited observed exploitation in the wild at time of analysis despite the high CVSS score of 8.5.
SSO-based account takeover in usememos Memos v0.27.1 lets a remote, unauthenticated attacker impersonate any user by exploiting the ssoCredentials path of the SignIn handler (server/router/api/v1/auth_service.go), which matches a federated identity solely on an attacker-controllable identifier (e.g. email or username) instead of the identity provider's stable subject claim. Any deployment that has an OIDC/OAuth SSO provider enabled is affected, and a successful attack yields full control of the targeted account, including potentially administrative accounts. The flaw carries CVSS 9.8 and CWE-287; there is no public exploit identified as weaponized at time of analysis, though a referenced GitHub gist appears to be a researcher write-up, and EPSS is low at 0.22%.
Resource exhaustion in the sol MQTT broker (commit 373d848, 2024-12-12) allows unauthenticated remote attackers to cause a denial of service by flooding the service with malformed or duplicate CONNECT packets. The broker's session teardown logic is incomplete: failed or repeated CONNECT attempts silently drop the connection without releasing internal state, leaving memory and file descriptors allocated indefinitely. With no authentication required and the attack confirmed automatable per SSVC, a sustained flood of crafted CONNECT packets can exhaust system resources and trigger the Linux OOM killer. No public exploit code was formally released as a tool, but a POC is referenced in the linked GitHub advisory; the vulnerability has not been added to the CISA KEV catalog.
Remote unauthenticated denial of service in Systerel S2OPC Toolkit 1.7.3 is exploitable via the OPC UA AddNodes service, triggering a classic buffer overflow (CWE-120) in address_space_bs.c and sopc_node_mgt_helper_internal.c that crashes the server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is reachable from the network without credentials or user interaction, making it trivially automatable against exposed OPC UA endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis, though the impact is particularly acute in OT/ICS environments where S2OPC is deployed, as availability loss in industrial control infrastructure can translate to physical process disruption.
Denial of service in Systerel S2OPC 1.7.3 allows remote unauthenticated attackers to crash or render unavailable an OPC UA server by sending crafted requests that trigger uncontrolled resource consumption in the event monitored-item queue resize handling. Affected source code is confirmed across subscription_core.c and monitored_item_notification_queue_bs.c. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Denial-of-service (NULL pointer dereference) in the open62541 OPC UA server v1.5.5 lets remote attackers crash the server by sending an AddReferencesRequest whose target uses an empty targetServerUri combined with a non-zero targetNodeId.serverIndex; the server's AddReferences handler fails to validate this non-local ExpandedNodeId case, leaving the target node pointer NULL while execution continues and dereferences it. Publicly available exploit code exists (SSVC exploitation: poc); it is not listed in CISA KEV and EPSS is low at 0.27% (19th percentile). Note that although the input CVSS is scored 9.8 with full C/I/A impact, the underlying flaw class (CWE-476) is consistent with a crash/DoS rather than confidentiality or code-execution impact.
Denial-of-service via buffer overflow in open62541 v1.5.5 allows a remote, unauthenticated attacker to crash an OPC UA server by sending a crafted Service_Call request with malformed input arguments. The flaw resides in the method-call service handler (ua_services_method.c), where input arguments are validated against runtime-resolved InputArguments metadata without proper bounds enforcement. No active exploitation or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful availability risk for any OPC UA server deployment based on this library version.
Heap-based buffer overflow in lib60870-C 2.4.0 affects the server-side FileSegment ASDU encoding path, where FileSegment_encode() checks only the standalone segment length via FileSegment_GetMaxDataSize() but never verifies remaining capacity in the current ASDU frame before writing object fields and segment data. In IEC 60870-5-101/104 telecontrol servers using the library's file transfer functionality, this out-of-bounds heap write can corrupt memory, enabling denial of service and potentially remote code execution. There is no public exploit identified at time of analysis, and the flaw is tracked upstream as issue #201 against the current 2.4.0 release.
Heap-based buffer overflow in Systerel S2OPC Toolkit 1.7.3 enables remote denial of service by sending a crafted OPC UA PublishResponse containing malformed EventNotificationList data to the Alarm/Conditions client wrapper. The affected code paths - libs2opc_client_alarm_conditions.c, state_machine.c, and sopc_event_manager.c - process incoming subscription notification data without adequate bounds checking, allowing a malicious or compromised OPC UA server to crash any connected S2OPC client. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.5/High rating and unauthenticated network vector make this a meaningful risk in OPC UA-enabled industrial environments.
Authentication bypass in the My Safetipin Android application version 5.2.1 stems from hardcoded credentials in the authentication module that produce predictable OTP values, letting remote attackers log in as arbitrary users and take over accounts without legitimate credentials. Any personal-safety data stored in a victim's account - location history, safety pins, and profile details - becomes exposed and modifiable. No public exploit has been identified at time of analysis, and the EPSS score of 0.27% (18th percentile) reflects low observed exploitation activity despite the maximal CVSS rating.
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows unauthenticated remote attackers to crash or exhaust resources on OPC UA servers by sending crafted NodeManagement type-instantiation requests. The flaw resides in the server-side node management service logic and is exploitable over the network with no privileges or user interaction under the default access control configuration. No CISA KEV listing exists as of analysis, but the SSVC framework classifies the attack as automatable with a proof-of-concept present; the EPSS score of 0.25% (16th percentile) indicates limited observed exploitation in the wild despite that automation potential.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Server-side use-after-free in open62541 1.5.5 allows a remote attacker to crash an OPC UA server process, causing denial of service. The flaw arises in the local MonitoredItem subscription path where UA_Subscription_localPublish continues dereferencing a UA_Notification object after a callback has already freed it by calling UA_Server_deleteMonitoredItem on the active item. No public exploit or CISA KEV listing has been identified; impact is limited to availability with no confidentiality or integrity exposure.
Out-of-bounds read in S2OPC Toolkit 1.7.3's RepublishResponse message handler enables unauthenticated remote attackers to crash the OPC UA service via a crafted network message, resulting in denial of service. The vulnerable code paths span the subscription publish service layer (msg_subscription_publish_bs.c, msg_subscription_publish_ack_bs.c) and the common encoder module (sopc_encoder.c). No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N vector indicates low-barrier remote exploitation requiring no authentication against reachable OPC UA endpoints.
Hardcoded RTSP credentials in Zosi C519M IP camera firmware V4.2.8.823C01450BA expose live video feeds to any network-reachable attacker. The built-in credentials embedded in the RTSP authentication mechanism cannot be changed by the device owner, making every affected unit permanently vulnerable to unauthorized stream access. A public proof-of-concept exists on GitHub, and CISA's SSVC framework rates the attack as automatable with no exploitation preconditions beyond network reachability - no public exploit identified as actively exploited in CISA KEV at time of analysis.
Stack-based buffer overflow in Systerel S2OPC 1.7.3 enables remote denial of service against OPC UA client applications. A malicious or compromised OPC UA server can send a crafted DeleteMonitoredItemsResponse message that triggers an overflow in LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems within the client_wrapper state machine, crashing the client process. No public exploit or active exploitation has been identified at time of analysis, though source code references confirm the vulnerable code path exists in the published repository.
Buffer overflow in open62541 1.5.5's Local Discovery Server (LDS) enables an unauthenticated remote attacker to crash the discovery service by sending a RegisterServer or RegisterServer2 request containing an abnormally large number of unique discoveryUrls, but only when the MDNSD multicast discovery backend is enabled at build time. The impact is a denial of service (A:H) with no confidentiality or integrity exposure. No active exploitation is confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis.
Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.
Heap use-after-free in open62541's GDS PushManagement certificate update workflow enables remote unauthenticated denial of service against OPC UA servers built with the UA_ENABLE_GDS_PUSHMANAGEMENT compile-time flag. The vulnerability is remotely exploitable with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N per CVSS), crashing the affected server process. SSVC intelligence confirms a proof-of-concept exists and the attack is automatable, though EPSS at 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains limited or targeted as of time of analysis.
Cross-site scripting in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a network-accessible, unauthenticated attacker to inject malicious JavaScript into user-controlled fields (Role Name, First Name, Last Name, Username) that is subsequently rendered to authenticated users - most likely administrators reviewing account data. Exploitation yields client-side arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is recorded in CISA KEV, and EPSS indicates a 0.19% probability of near-term exploitation; however, a public researcher writeup exists on GitHub (FahadAljuaid), meaningfully raising practical risk.
Arbitrary code injection in Vim 9.2.0389 and earlier exposes OpenVMS deployments to local code execution through a flaw in the platform-specific `vms_fixfilename()` function in `os_vms.c`. A local attacker can craft a malicious filename that bypasses sanitization controls in this VMS-only code path, causing Vim to execute injected code. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though a researcher's technical write-up is publicly accessible via GitHub Gist; the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability in practice.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Arbitrary code execution affects Vim v9.2.0389 and earlier through a memory management flaw in the OpenVMS-specific vms_fixfilename() function in vim/src/os_vms.c. A local attacker on an OpenVMS system can trigger this CWE-401 condition to achieve full code execution with high confidentiality, integrity, and availability impact. No public exploit confirmed at time of analysis, and the extremely low EPSS score (0.15%, 4th percentile) combined with the platform-specific attack surface indicates minimal real-world exploitation risk.
Uncontrolled resource consumption in open62541 v1.5.5 and earlier allows remote unauthenticated attackers to crash OPC UA servers by sending crafted subscription-lifecycle requests. The affected request types - CreateSubscription, CreateMonitoredItems (Sampling mode), Publish, TransferSubscriptions, and DeleteSubscriptions - are core to OPC UA data exchange, meaning the vulnerability sits on a heavily-used protocol surface in industrial and IoT deployments. A POC exists per SSVC classification, the attack is rated automatable, and availability impact is rated High by NVD; however, EPSS stands at only 0.25% (16th percentile), indicating limited observed exploitation interest at this time.
Arbitrary code execution in NASA's core Flight System (cFS) v7.0.1 is possible through the Executive Services (ES) dynamic application start path, where improper access control lets an attacker plant a malicious shared object on target storage that is then loaded and run as a flight application. SSVC records a proof-of-concept exploit (publicly available exploit code exists) and rates technical impact as total with automatable exploitation, though EPSS is very low at 0.15% (5th percentile). The published NVD vector is CVSS 9.1 (AV:N), but the described mechanism - dropping a shared object onto storage - implies local write access is a genuine prerequisite.
Out-of-bounds read in open62541 1.5.5 allows a malicious OPC UA server to crash connecting clients via a crafted namespace array response. The flaw resides in the client-side connection handler responseReadNamespacesArray() in src/client/ua_client_connect.c, triggered during the namespace discovery phase of the OPC UA session establishment. With a CVSS availability impact of High and no privileges required on the attacker side, the practical effect is a remotely-induced denial of service against any open62541-based OPC UA client that connects to an attacker-controlled server. No public exploit identified at time of analysis.
Denial of service in open62541 v1.5.5 and earlier allows a remote unauthenticated attacker to crash an affected client via a malformed or malicious response processed by the UA_Client_getRemoteDataTypes function. open62541 is an open-source C implementation of the OPC UA industrial communication protocol, making this vulnerability relevant to ICS, SCADA, and industrial IoT deployments. No public exploit code has been explicitly confirmed, but a GitHub issue (open62541/open62541#8140) documents the flaw, and no actively exploited status (KEV) has been assigned at time of analysis.
Denial of service in NASA Core Flight System (cFS) v7.0.1 results from insufficient replay protection in the CFDP (CCSDS File Delivery Protocol) receive path, enabling unauthenticated network attackers to crash or disrupt the flight software stack by sending replayed final CFDP PDUs. SSVC classifies this as automatable with a proof-of-concept available, though the EPSS score of 0.14% (4th percentile) reflects the narrow operational footprint of aerospace flight software. No CISA KEV listing confirms active exploitation at time of analysis.
Remote denial of service in NASA Core Flight System (cFS) v7.0.1 allows unauthenticated network attackers to crash the Software Bus Network (SBN) application by sending a crafted peer subscription packet that triggers a parser boundary flaw. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U vector confirms no authentication or user interaction is required, making this trivially reachable against any exposed SBN interface. Despite the high CVSS score of 7.5, the EPSS score of 0.16% at the 5th percentile and absence of a CISA KEV listing or public exploit code suggest no public exploitation activity at time of analysis.
Forced processor reset in NASA Core Flight System (cFS) v7.0.1 is achievable by supplying a crafted entry to the HS.AppMon_Tbl, exploited through the HS_MonitorApplications() function in the Health and Safety application module. The vulnerability targets embedded real-time flight software used in spacecraft, where an unplanned processor reset can have mission-critical consequences. A proof-of-concept exists per SSVC data, exploitation is rated automatable, and the EPSS score of 0.14% (4th percentile) suggests no widespread opportunistic scanning - consistent with narrow, targeted exploitation in aerospace operational contexts. No active CISA KEV listing has been confirmed.
Unauthenticated remote attackers can manipulate the CCSDS File Delivery Protocol (CFDP) metadata handler in NASA Core Flight System v7.0.1, specifically the CF_CFDP_RecvMd() function, to control the destination path where received file content is stored on the target system, resulting in high-impact information disclosure. A publicly available proof-of-concept exists per SSVC classification, making this exploitable without authentication or user interaction against any network-reachable cFS instance with the CF application enabled. Despite the availability of exploit code and network-accessible attack vector, the EPSS score of 0.14% (4th percentile) reflects the extremely limited real-world deployment footprint of this aerospace-domain platform.
Uncontrolled resource consumption in NASA's fprime framework v4.2.2 exposes the Ref::SignalGen component to remote denial-of-service attacks via unsanitized user-supplied parameters. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects unauthenticated, low-complexity network exploitation - however, this risk must be contextualized: fprime is a niche aerospace embedded software framework, and a POC exists per SSVC data, though EPSS of 0.14% (4th percentile) signals negligible real-world exploitation interest. No public exploit has been confirmed as actively exploited, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect access control in NASA Core Flight System (cFS) v7.0.1 permits unauthenticated remote attackers to manipulate the telemetry subscription table by sending arbitrary TO_LAB (Telemetry Output Lab) add and remove subscription commands. Low-index subscriptions can be silently removed and new data streams injected, threatening the integrity of telemetry routing on ground-connected flight software deployments. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates very low observed exploitation activity, though the complete absence of authentication on a command interface is a structurally severe design flaw.
Root-level OS command injection in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 lets attackers inject shell metacharacters into a parameter that is passed unsanitized to a system command, yielding arbitrary command execution as root. OpenMediaVault is a Debian-based network-attached-storage (NAS) management platform, and the -md plugin manages Linux mdadm software RAID arrays. Publicly available exploit code exists (a proof-of-concept gist is referenced), though there is no public exploit identified in CISA KEV; EPSS is modest at 0.62% (46th percentile).
Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.
Predictable API key generation in osTicket 1.18.3 lets remote attackers reconstruct valid staff API keys by exploiting weak MD5-based construction seeded with the request timestamp and client IP address (CWE-331). Because the key is derived from low-entropy, guessable inputs, an attacker who approximates the key creation window can brute-force the key space and gain API access without credentials. Rated CVSS 9.8 by the reporter; no public exploit is identified at time of analysis, though a technical disclosure write-up exists, and CISA SSVC lists exploitation as none but marks the flaw automatable with total technical impact.
Integer overflow in the Svc::FileDownlink::SendPartial component of NASA's fprime embedded flight software framework v4.2.2 allows unauthenticated remote attackers to crash the service via crafted input, resulting in a Denial of Service. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special privileges are required, and a potential proof-of-concept is referenced at a public GitHub issue tracker. Despite the high CVSS score, EPSS sits at just 0.14% (4th percentile), and there is no CISA KEV listing, reflecting the niche aerospace deployment context of this framework.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
Stack-based buffer overflow in OreSat Firmware v1.0 allows an attacker with physical access to the UART3 serial interface to crash the firmware by sending a crafted `edl fw_flash` command with an oversized filename argument. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms impact is strictly limited to availability - no confidentiality or integrity compromise is indicated. No public exploit code exists and no active exploitation has been identified; an EPSS score of 0.14% at the 4th percentile corroborates negligible automated exploitation probability.
SQL injection in Z-BlogPHP 1.7.5 enables authenticated low-privilege attackers to execute arbitrary SQL commands against the underlying database via the unsanitized `id` parameter in the CommentBat feature. Successful exploitation yields high-severity confidentiality and integrity impact - including extraction of password hashes, user data, and arbitrary record manipulation - with no availability impact indicated. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at the 5th percentile, suggesting limited real-world exploitation activity despite the high CVSS score.
OS command injection in the Serverless-Devs CLI (@serverless-devs/s versions 3.1.11 and earlier) lets an attacker execute arbitrary commands on a developer's machine when they run 's init' with a crafted, attacker-influenced argument. The tool passes unsanitized input into child_process.spawn() with shell:true, and the single guard check - requiring the value to end in '.git' - is trivially satisfied by an attacker while still smuggling shell metacharacters. Publicly available exploit code exists (a proof-of-concept gist), SSVC rates technical impact as total and automatable, but EPSS remains low at 0.48% and it is not in CISA KEV.
SQL injection in FastAdmin v1.6.1.20250430 lets remote attackers inject arbitrary SQL through the application/common/controller/Backend.php component, with the vendor advisory characterizing the impact as extending to arbitrary code execution. The flaw is tagged RCE/SQLi/PHP and carries a CVSS 9.8 rating with total technical impact per CISA's SSVC framework, though publicly available exploit code exists rather than confirmed active exploitation. EPSS is low (0.14%, 4th percentile), suggesting exploitation is not yet widespread despite the critical severity.
Denial of Service in NASA core Flight System (cFS) v7.0.1 is achievable by any network-adjacent attacker who can reach the SBN UDP interface, requiring no authentication or special privileges. Sending a single crafted SBN frame is sufficient to trigger the fault, consistent with CWE-20 (Improper Input Validation) in the Software Bus Network application's UDP packet handler. No public exploit code and no CISA KEV listing have been identified; EPSS stands at 0.14% (4th percentile), reflecting the niche aerospace deployment footprint rather than low technical severity.
Path traversal in the DS_SetDestPathCmd() function of NASA Core Flight System (cFS) v7.0.1 enables remote unauthenticated attackers to bypass access controls and read sensitive system components by supplying a crafted destination path string. The DS (Data Storage) application fails to properly sanitize or restrict path values passed via command, violating the intended access control boundary between storage destinations and protected system components. A proof-of-concept exists per SSVC data, and exploitation is assessed as automatable, though real-world risk is tempered by the specialized aerospace deployment context and a very low EPSS score of 0.14% (4th percentile).
Privilege escalation in FeehiCMS v.2.1.1 exploits insufficient session expiration (CWE-613) across the session management module, authentication logic, and logout handler, allowing a network-based attacker to reuse captured session tokens even after legitimate user logout to gain elevated access. The CVSS 3.1 score of 7.4 (High) reflects high confidentiality and integrity impact under high attack complexity, with no authentication required on the attacker's side. A public proof-of-concept write-up exists on GitHub; however, EPSS sits at 0.20% (10th percentile) and no CISA KEV listing exists, suggesting limited observed exploitation despite available exploit documentation.
Cross-site request forgery in the PrestaShop totadministrativemandate module (versions prior to 1.8.1) enables unauthorized order confirmation by exploiting a payment validation controller with no CSRF token. An attacker who induces an authenticated store administrator to follow a crafted link can silently trigger order-status changes - confirming awaiting-payment orders without receipt of funds. No public exploit code or active exploitation has been identified; the 0.14% EPSS score (4th percentile) reflects negligible observed exploitation activity.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
Command injection in Cudy's OpenWRT-based router firmware allows remote attackers to execute arbitrary commands as root through the system.setclock interface, affecting multiple TR- and WR-series models (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, WR6500 v2.3.15). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with total system compromise, and CISA's SSVC framework rates it Automatable with Total technical impact. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is modest at 1.21% (65th percentile).
Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.
Command injection in Cudy TR1200 (firmware v2.4.15) and TR3000 (firmware v2.4.21) routers via the system.setclock interface enables an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability stems from unsanitized input passed directly to a system command, yielding full device compromise - confidentiality, integrity, and availability all rated high. No public exploit or active exploitation (CISA KEV) has been identified; EPSS of 1.21% at the 65th percentile reflects moderate relative risk among disclosed CVEs but low absolute exploitation probability.
Root-level command injection in Cudy TR- and WR-series routers lets attackers run arbitrary OS commands through the ipsec_conn interface, which fails to sanitize user-supplied input before passing it to a shell context. Affected models span TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16), and WR6500 (v2.3.15). No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is modest at 1.21% (65th percentile), so this is a high-severity design flaw without evidence of widespread exploitation yet.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
Authentication bypass in libiec61850 v1.6's GOOSE receiver (parseGoosePayload() in goose_receiver.c) lets an attacker on the substation network replay a captured GOOSE frame to be accepted as authentic, defeating the intended message authentication. The library implements IEC 61850 protocols used in electrical-grid protection and automation, so spoofed GOOSE traffic can drive false relay/breaker actions. Publicly available exploit code exists (PoC repo and SSVC-rated PoC), but there is no CISA KEV listing and EPSS is low at 0.26%, indicating no confirmed widespread exploitation.
Remote code execution is claimed in Hugo Leisink's Hiawatha web server version 12.1 and earlier, reachable by an unauthenticated attacker sending a single crafted HTTP request (CVSS 9.8, CWE-94). Notably, the primary referenced research (fenrisk.com/hiawatha-http-smuggling) and the cited RFCs on chunked/message parsing indicate the underlying defect is HTTP request smuggling rather than classic code injection, so the RCE framing should be treated cautiously. Publicly available exploit code exists (SSVC 'poc'); this is not listed in CISA KEV, and EPSS is low at 0.36% (29th percentile).
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
OS command injection in dnsmgr version 2.15 and earlier lets an attacker execute arbitrary commands through the ping function in CheckUils.php, which passes unsanitized input into a system shell call (CWE-77). SSVC rates the technical impact as total and marks exploitation as proof-of-concept, so publicly available exploit code exists, though it is not on CISA KEV and EPSS is low (0.15%). The published CVSS is 9.8, but note the description characterizes the attacker as 'local' while the CVSS vector encodes AV:N - this discrepancy affects real-world exposure and should be resolved against the target deployment.
Authentication bypass in Outstatic CMS versions 2.1.9 and earlier lets an unauthenticated remote attacker forge valid administrative session tokens because the application ships a hardcoded JWT signing secret that is used whenever the OST_TOKEN_SECRET environment variable is left unset. Since the fallback secret is published in the project's public source repository, any attacker can self-sign a JWT granting arbitrary identity and full admin permissions with no credentials. There is no public exploit identified at time of analysis, but the technique is trivial and requires only the publicly-visible secret.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
Root-level command injection in the net.set_wan interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) allows attackers to execute arbitrary OS commands as root by supplying crafted input to WAN configuration parameters. The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates this 9.8 Critical, implying full network-reachable compromise with no privileges required. No public exploit code and no CISA KEV listing were identified at time of analysis, so there is no public exploit identified at this time; the vendor has published security advisory cudy-sa-26-7-jezzy-4.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers manipulate backend database queries through the unsanitized fromDate parameter in report.php and revenue_report.php. With no public exploit identified at time of analysis and a very low EPSS score (0.14%), the flaw carries a maximal CVSS 9.8 but appears to affect a niche PHP application; authentication requirements not confirmed beyond the PR:N stated in the CVSS vector, which indicates unauthenticated access. Successful exploitation permits full read/write access to membership and financial data.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQLite 3.41 is vulnerable to use after free in the jsonArrayLengthFunc function.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memory information leakage.
sqlite 3.41 has a use-after-free vulnerability in the memory buffer processing logic. Remote attackers can exploit this flaw via specially crafted input to cause arbitrary code execution, sensitive information leakage, or service denial.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
Memory disclosure and denial of service in SQLite 3.41 arise from a use-after-free in the btree module's shared-cache lock management, where a BtLock structure is freed but never unlinked from its linked list. Applications that enable SQLite shared-cache mode can have subsequent list traversals read freed memory, leaking sensitive process memory (CVSS C:H) or crashing the process (A:H). No public exploit identified at time of analysis, and SSVC lists exploitation status as none, though the flaw is assessed as automatable.
Use-after-free memory corruption in SQLite 3.41's JSON extension (json.c, jsonCacheInsert) can be triggered when an application processes attacker-influenced JSON through SQLite's JSON1 functions, potentially leading to a crash (denial of service) or, if the freed heap object is reclaimed and controlled, memory disclosure or code execution in the host process. Because SQLite is an embedded library, real-world reach depends on whether the front-end application exposes JSON functions to untrusted input. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' - the 9.8 rating appears heavily influenced by an assumed network vector rather than demonstrated remote exploitability.
Heap-based buffer overflow in schreibfaul1's ESP32-audioI2S library version 3.4.5 lets an attacker who controls audio stream metadata corrupt heap memory through the latinToUTF8() character-encoding routine, with SSVC rating the technical impact as total (potential code execution, information disclosure, DoS or privilege escalation). The flaw is demonstrated by publicly available exploit code but is not listed in CISA KEV, so it reflects a POC-stage issue rather than confirmed active exploitation. The library is a widely-used hobbyist Arduino/ESP32 audio component, so exposure is concentrated in embedded maker and IoT projects rather than enterprise fleets.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
Arbitrary file disclosure in Jinher OA C6 allows unauthenticated remote attackers to read sensitive server files through an XML External Entity flaw in the HrmAttendance sp_manager_getUserlist.aspx GetXmlHttp endpoint, which parses attacker-supplied XML without disabling external entity resolution. Because the attack is unauthenticated (PR:N) and network-reachable (AV:N), a crafted XML payload triggers an out-of-band request that exfiltrates file contents. A public proof-of-concept exists in a GitHub repository, though it is not listed in CISA KEV and EPSS remains low (0.25%), indicating publicly available exploit code but no confirmed active exploitation.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.