PHP
Monthly
WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Password-recovery brute force in MacCMS v10 (through 2026.1000.4056) lets unauthenticated remote attackers take over member accounts: the six-digit reset code is never rate-limited, so anyone who knows a victim member's registered email address or phone number can request a code and repeatedly submit guesses to findpass_reset until the correct value is found, then overwrite the member's password. Because no attempt cap, lockout, or backoff is enforced, a 1,000,000-value code space becomes brute-forceable within the code's validity window, though the attacker must already know the target identifier and the impact is confined to member (non-administrator) accounts. Assessed as high severity (published CVSS 4.0 base 9.1; independent 3.1 assessment AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); there is no CISA KEV entry and no dedicated exploit tooling confirmed, although a public technical writeup documents the brute-force technique.
Authenticated Dolibarr users with privileges to write extrafields, export configurations, or blocked log entries can trigger PHP object injection in versions before 23.0.4, potentially leading to code execution or file manipulation if a suitable gadget chain exists. The flaw resides in jsonOrUnserialize() and requires the stored payload to be non-JSON so that unserialize() runs without class restrictions; exploitation is high-complexity and no public exploit has been identified. Upgrading to 23.0.4 or later is the only complete fix.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat.
Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat.
Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack.
Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface.
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code execution by storing crafted serialized object data in background MassAction or Export parameters that the application later unserializes without any allowed-class restriction. The deserialization sinks are reachable over the network (AV:N) with no user interaction (UI:N), and an attacker with admin credentials can instantiate arbitrary PHP objects and execute code, provided a usable gadget chain is reachable in the deployed codebase or its dependencies. Publicly available exploit code exists, and the vendor released a fix in version 9.3.7; the practical limiting factor is the administrator-privilege prerequisite (PR:H), which tempers real-world urgency even though the flaw is rated 9.1.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-folder or upload-only link token - plus any configured share password - to re-upload a file using the exact name of an existing file and silently replace its contents while the original uploader metadata is preserved. The same missing replacement check affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the target file, so the outcome is a high-integrity, no-confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, 8.2). Exploitation requires that an administrator has actually created and shared an upload-capable link and that the attacker knows or guesses the target filename; impact is confined to overwriting existing files, with no data disclosure and no code execution path. No public exploit code was identified at time of analysis, and the vendor-released fix is FileRise 3.18.0.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
Session hijacking in WeGIA prior to 3.8.6 lets an unauthenticated remote attacker fix a victim's PHP session identifier and later reuse it as the victim's authenticated session. The auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID value into a Set-Cookie response and sets the cookie Domain attribute to DB_HOST, so the same handler also leaks the internal database hostname to any visitor. Exploitation is conditional on victim interaction: the victim must log in while carrying the attacker-chosen identifier, and no public exploit code was identified at time of analysis; upgrading to 3.8.6 removes the flaw.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
PHP object injection in ILIAS LMS affects installations before 9.24, 10.12, and 11.5, allowing an authenticated user who holds the Test creation or Test import permission to deserialize attacker-controlled objects by importing a crafted Test results archive. By embedding a malicious 'tst_sequence' (sequence) attribute in the archive XML, the attacker reaches an unrestricted unserialize() call and can leverage the bundled Guzzle or Monolog libraries as POP gadget chains to write PHP files and achieve remote code execution on the server. The primary limiting factor is the required authenticated account and import-level permission rather than any anonymous exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated PHP object injection in e107 CMS before 2.3.7 lets a remote attacker who can reach install.php execute arbitrary PHP functions with the web server's privileges, resulting in full server compromise (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw arises because the installer decodes the attacker-controlled previous_steps POST parameter and feeds it to unserialize() without restricting allowed classes, and because install.php remains reachable after a normal installation. No public exploit code was identified at time of analysis and CISA KEV does not list this issue, but the advisory documents a complete, directly usable gadget chain (GuzzleHttp\Psr\7\PumpStream → paths.hash → site_path callable coercion) that makes reliable exploitation realistic for any deployment that left the installer endpoint exposed; sites that deleted or access-restricted install.php after setup are the main mitigating factor.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
Unauthenticated information disclosure in the FOG imaging/cloning suite (all versions prior to 1.5.10.1870) allows a remote requester to retrieve the configured default Active Directory domain-join password by dispatching the management adInfo() endpoint through node=ipxe, which was reachable without an authenticated session and returns the credential in the domainpass JSON field. Exploitation requires only network reachability to the FOG web interface plus the operator-side condition that a FOG_AD_DEFAULT_PASSWORD value has been configured for automatic AD domain joins; if no default AD password is set, the endpoint discloses nothing sensitive. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the disclosure of a reusable domain-join credential carries high confidentiality impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.
Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Unauthenticated remote attackers can obtain another client's PHP session identifier from FrankenPHP worker mode before 1.12.5 when the session extension is loaded as a shared module rather than statically compiled in. Because frankenphp_reset_session_state() is compiled out under that build configuration, PS(id) persists across request boundaries on the same worker thread, so a later session_start() may keep a stale identifier instead of adopting the new request's cookie, and under concurrent requests session_id() can return a different user's identifier - enabling information disclosure, session hijacking, and intermittent logouts, with integrity and availability also impacted (CVSS 7.7, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, CWE-362). Exposure is conditional: official static binaries and Docker images that link the session extension statically are not affected, non-worker (classic) mode is not implicated, and the leak is intermittent and timing-dependent; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in Leantime prior to 3.10.0 allows an authenticated low-privilege user to create a full administrator account, or to install, enable, disable and remove plugins, by calling methods exposed through the application's JSON-RPC dispatcher. Any user holding a valid ordinary browser session can trigger this by sending the required X-Requested-With: XMLHttpRequest header and invoking leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role, because PermissionEnforcer::enforce treats API service methods that lack a RequiresPermission attribute as public; exposure widens significantly on installations where open or self-service registration is enabled, since obtaining the prerequisite low-privilege session becomes trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity and availability once the privilege boundary is crossed, and the vendor has shipped a fix in version 3.10.0.
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.
Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
Remote code execution in Adminer before 6.1.1 allows authenticated users with SQLite access to bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark. An attacker can then attach a database file at a PHP-served path and create a table named with PHP code, which executes as the web server user. No public exploit identified at time of analysis; exploitation requires valid credentials, SQLite usage, and a web-accessible writable PHP-executing path.
Authenticated role administrators in Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 can add users to roles belonging to a different organization on the same instance, escaping their own tenant's authorization boundary and gaining privileged membership that lets them sign in to the target organization and modify its user profiles. The flaw is a missing cross-organization ownership check on the role UUID submitted to members_assignment.php (CWE-639), rated CVSS 4.0 8.5 and assessed independently as CVSS 3.1 8.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Exploitation is gated on the attacker already holding role-administrator rights and on the deployment hosting more than one organization, so single-org installations and anonymous or low-privilege users cannot reach the vulnerable path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. This is a genuine but conditional priority, bounded to insiders or compromised administrator accounts.
Authenticated content editors on Grav CMS sites running the Git Sync plugin versions 1.0.2 through 3.4.12 can execute arbitrary OS commands as the web-server account when the plugin's gravuser or gravfull author mode is enabled, by planting shell substitution payloads in their username, full name, or email profile fields that are later interpolated into a git commit --author call and reach PHP exec(). The vulnerability is rated 8.7 (CVSS 4.0) and maps to CWE-78; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires authenticated, low-privileged editor access but no victim interaction, with the additional gating condition that author mode must be explicitly turned on and must not be left at its default posture. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is a credible, prioritizable bug rather than a drop-everything emergency - though any site with untrusted or broadly provisioned editor accounts and author mode enabled should treat it as an immediate command-execution risk.
Remote code execution affects Craft CMS 5.10.2 up to but not including 5.10.14, where the Twig sandbox fails to block PHP callables passed to the 'has some' and 'has every' operators inside sandboxed system-message templates. Exploitation requires an authenticated control-panel account that has been granted the System Messages permission - a permission that can be delegated to non-admin users - after which the attacker can invoke two-argument functions such as passthru or system and execute code with the privileges of the web server user. Per current intelligence there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the permission gate is the main limiter, so deployments that reserve System Messages for trusted administrators face materially lower practical risk than multi-user or agency installations that delegate that permission broadly.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user holding the 'Messages' permission submit unsandboxed Twig templates that the application compiles and executes as raw PHP, enabling arbitrary function calls, sensitive file reads, and potential filesystem writes that can compromise both the application and its underlying host. Exploitation requires valid back-office credentials plus the 'Messages' privilege (CVSS vector PR:L), so there is no anonymous or mass-exploitation path; EPSS is low at 0.19% (8th percentile) and no public exploit code or CISA KEV entry has been identified, though the flaw is remotely triggerable and rated 8.8 for its high confidentiality, integrity, and availability impact once the privilege prerequisite is met. The vendor has shipped a fix in thelia/twig-engine-module 1.0.9.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a PHP string-escaping failure to write and execute arbitrary PHP code on the server, achieving remote code execution with web-server privileges. The attack requires a back-office account holding UPDATE-level permission on the admin.configuration.language resource (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assessed 8.8), so it is not reachable by unauthenticated or low-privilege users despite the network attack vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.47% (39th percentile), making this a high-impact but moderate real-world priority.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
WP Booking System through 2.1.0.3 can disclose stored booking-notification email bodies to an authenticated Subscriber-level user because the plugin fails to verify authorization before returning log data keyed by booking_id and email_log_id. The exposed content includes customer PII such as names, email addresses, phone numbers, messages, and booking dates, but the flaw is read-only and does not permit data modification or code execution. The published vector claims PR:N, while the independent assessment corrects this to PR:L (a low-privilege account is required, trivial on sites with open registration); no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).
Unauthenticated attackers can take over accounts on Course Tencent Cloud versions 2.0.1 and earlier by brute-forcing 6-digit SMS/email verification codes that are never invalidated or attempt-limited. Exploitation requires knowledge of the victim's registered phone number or email address and rotation of source IPs to bypass per-IP rate limiting, as the codes have no per-account attempt counter. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Password-recovery brute force in MacCMS v10 (through 2026.1000.4056) lets unauthenticated remote attackers take over member accounts: the six-digit reset code is never rate-limited, so anyone who knows a victim member's registered email address or phone number can request a code and repeatedly submit guesses to findpass_reset until the correct value is found, then overwrite the member's password. Because no attempt cap, lockout, or backoff is enforced, a 1,000,000-value code space becomes brute-forceable within the code's validity window, though the attacker must already know the target identifier and the impact is confined to member (non-administrator) accounts. Assessed as high severity (published CVSS 4.0 base 9.1; independent 3.1 assessment AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact); there is no CISA KEV entry and no dedicated exploit tooling confirmed, although a public technical writeup documents the brute-force technique.
Authenticated Dolibarr users with privileges to write extrafields, export configurations, or blocked log entries can trigger PHP object injection in versions before 23.0.4, potentially leading to code execution or file manipulation if a suitable gadget chain exists. The flaw resides in jsonOrUnserialize() and requires the stored payload to be non-JSON so that unserialize() runs without class restrictions; exploitation is high-complexity and no public exploit has been identified. Upgrading to 23.0.4 or later is the only complete fix.
Local file disclosure in SimplePie through 1.9.0 lets a malicious or compromised feed server read files on the host running the PHP application: by replying to a feed request with an HTTP Location redirect - or by planting an autodiscovery <link> - that points at a file:// path, the library follows the reference and reads the target file into the parsed feed. Exploitation requires no privileges (PR:N) but does require the attacker to control the feed server's responses or inject a feed URL into the application (AC:H, AT:P), and disclosure is bounded to files readable by the web-server process. Vendor fix is available via upstream PR 991, public exploit code exists (a PoC targeting pfSense's RSS widget has been published), and no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat.
Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat.
Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack.
Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface.
Stored cross-site scripting in GYM One (all releases prior to 1.4.1) lets an attacker who can write to a user record's firstname, lastname, or email profile fields inject persistent JavaScript that executes in an administrator's browser whenever the administrator opens the user-management page at /admin/users/. Because the injected payload is rendered in the administrator's session, it can read or act on administrator-session data and perform privileged actions with the victim's rights until the poisoned record is removed; the CVSS 3.1 vector scores 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting the required low-privilege write access and the administrator's page visit as a user-interaction prerequisite, with scope change since the low-privileged author gains the administrator's privileges. The issue is fixed in version 1.4.1 per the vendor advisory and release tag, and no public exploit code was identified at time of analysis.
Unbounded response-header buffering in ReactPHP's HTTP client (react/http) versions 1.0.0 through 1.11.0 allows a malicious or compromised remote server to exhaust the PHP memory_limit of an application that uses React\Http\Browser to fetch attacker-influenced URLs. Because CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H rates this 7.5, the impact is availability-only (event-loop or worker process crash), with no confidentiality or integrity effect; there is no public exploit identified at time of analysis and the issue is not in CISA KEV. The vendor-released patch is version 1.11.1, which enforces a 65536-byte response-header cap and raises an OverflowException when exceeded.
Lychee photo-management instances running versions prior to 7.6.1 expose POST /api/v2/Album::unlock with no throttle, attempt counter, backoff, CAPTCHA, or lockout, letting remote unauthenticated attackers (CVSS PR:N, no user interaction) automate password guessing against password-protected albums. Successful recovery of an album password grants access to that album's otherwise private photo collection, so the realistic impact is concentrated on albums secured with weak or common passwords, since high-entropy passwords resist brute-forcing even with unlimited attempts. The fix is available in Lychee 7.6.1, which adds rate-limiting middleware to the unlock route; no public exploit is identified at time of analysis, and exploitation is bounded by the need to know or obtain a valid album identifier and by the strength of the album password.
Denial of service in Symfony's ExpressionLanguage component lets a remote, unauthenticated attacker crash the PHP process by submitting a single expression built from tens of thousands of nested unary operators, array/hash literals, binary operators, property accesses or ternaries. The parser places no bound on the depth of the node tree it builds, and when that tree is destroyed PHP's recursive free overflows the native stack; the crash occurs while the tree is being freed, so it happens even if the expression itself would never be evaluated. Symfony applications that lint user-supplied expressions - most directly through the #[Assert\ExpressionSyntax] validator, which forwards the validated value to ExpressionLanguage::lint(), or any code calling parse()/lint() on untrusted input - are affected in versions up to 5.4.53, 6.4.47, 7.4.20 and 8.1.8. Impact is availability-only (CVSS:4.0 base 8.7 per NVD; our independent CVSS:3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), there is no data exposure or code execution, no public exploit code has been identified at time of analysis, and vendor patches are available.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Unbounded recursion in the Symfony YAML inline lexer lets a single document made of deeply nested inline collections (for example [[[[...]]]] or {{{...'}) exhaust the PHP call stack, crashing the worker process or ending the request with a fatal error in symfony/yaml prior to 5.4.54, 6.4.45, 7.4.18, and 8.1.6. The highest-exposure path is fully unauthenticated: a controller using #[MapRequestPayload] with the Yaml component installed and no acceptFormat restriction will accept a YAML content-type request that reaches Parser::lexInlineStructure() directly, and any application that parses untrusted YAML is affected. Impact is availability-only per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), exploitation is bounded by whether attacker-controlled input ever reaches the parser and by PHP version and stack settings. Vendor-released fixes exist for all maintained branches and no public exploit identified at time of analysis.
Unauthenticated remote denial of service in Symfony's HttpFoundation component (v4.1.0-BETA1 up to 5.4.54, v6.0.0-BETA1 up to 6.4.46, v7.0.0-BETA1 up to 7.4.19, and v8.0.0-BETA1 up to 8.1.7) allows any attacker who can send an HTTP request to burn roughly a second of CPU per request by placing a run of whitespace before a separator in the Cache-Control header. The flaw is automatically reachable because HeaderBag invokes HeaderUtils::split() on Cache-Control every time a Request object is constructed, so no authentication, plugin, or special configuration is required; a single crafted request costs about 813 ms on PHP 8.5 (17 spaces in an 8 KB header), doubling with each additional space, so sustained denial of service requires a stream of such requests rather than one packet. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but vendor patches are released and the reachability is trivial, making this a practical denial-of-service risk rather than a theoretical one.
PHP object deserialization in EspoCRM versions prior to 9.3.7 lets an authenticated administrator achieve remote code execution by storing crafted serialized object data in background MassAction or Export parameters that the application later unserializes without any allowed-class restriction. The deserialization sinks are reachable over the network (AV:N) with no user interaction (UI:N), and an attacker with admin credentials can instantiate arbitrary PHP objects and execute code, provided a usable gadget chain is reachable in the deployed codebase or its dependencies. Publicly available exploit code exists, and the vendor released a fix in version 9.3.7; the practical limiting factor is the administrator-privilege prerequisite (PR:H), which tempers real-world urgency even though the flaw is rated 9.1.
SQL injection in the WebCTI service shipped with Slican IPx telephone exchanges allows an authenticated, low-privilege attacker to read and modify data through the /webcti/admin_json.php endpoint. All IPx deployments running WebCTI on firmware earlier than 6.62.0100 are affected; exploitation requires a valid WebCTI subscriber/operator account (PR:L in the CVSS 4.0 vector) and network reachability to the endpoint, but no user interaction and no elevated privileges. CERT-PL and the vendor score the flaw at CVSS 4.0 base 8.7 (High) with high confidentiality and integrity impact and limited availability impact; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Remote code execution in ThemeHigh's Email Customizer for WooCommerce (Pro) through version 3.9.5 allows any authenticated user with subscriber-level access or higher to write attacker-controlled PHP into executable files inside the WordPress uploads directory through the plugin's send_test_mail() function, leading to full site compromise. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8) makes clear that the low-privilege account requirement is the main gate; exposure is greatest on WooCommerce stores that permit open customer/subscriber self-registration rather than manual account approval. Code execution also depends on the server permitting PHP to run from the uploads path, so sites that already harden that directory are materially less exposed, and no public exploit code has been identified at time of analysis.
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-folder or upload-only link token - plus any configured share password - to re-upload a file using the exact name of an existing file and silently replace its contents while the original uploader metadata is preserved. The same missing replacement check affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the target file, so the outcome is a high-integrity, no-confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, 8.2). Exploitation requires that an administrator has actually created and shared an upload-capable link and that the attacker knows or guesses the target filename; impact is confined to overwriting existing files, with no data disclosure and no code execution path. No public exploit code was identified at time of analysis, and the vendor-released fix is FileRise 3.18.0.
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid username and password for a TOTP-enabled account to authenticate to the WebDAV endpoint without supplying the second factor, then operate within that account's WebDAV file permissions. The weakness is conditionally gated: the opt-in WebDAV service must have been enabled by an administrator, the targeted account must have TOTP configured, and the attacker must already know the account's primary credentials, which the CVSS vector reflects as authenticated access (PR:L); the normal browser login path was never affected. Rated CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with high confidentiality and integrity impact and no availability impact; no public exploit code or active exploitation was identified at time of analysis. The issue is fixed in FileRise 3.16.0.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows remote attackers to execute arbitrary SQL against the underlying database by sending crafted POST data to the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint. Because the endpoint uses extract($_REQUEST) and interpolates user-supplied values directly into a raw INSERT statement, an attacker can read, modify, or delete billing, member, employee, permission, and credential data, or drop database tables, without authentication or user interaction. The vendor fixed the flaw in 3.8.6 with prepared statements and input validation; no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in WeGIA prior to 3.8.6 lets any remote attacker who can reach the application read, alter, or destroy its MySQL database through the billing endpoint web/html/socio/sistema/cadastro_cobranca.php. Because that endpoint is reachable without credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) and passes the valor, valor_pago, id_pessoa, id_socio and id_sociotipo parameters straight into UPDATE, INSERT and SELECT statements, an attacker can exfiltrate billing records and credential data or truncate tables to cause application-wide data loss. No public exploit code was identified at time of analysis and there is no CISA KEV entry indicating active exploitation, but the low attack complexity and lack of authentication make prompt upgrading to 3.8.6 the priority action.
Session hijacking in WeGIA prior to 3.8.6 lets an unauthenticated remote attacker fix a victim's PHP session identifier and later reuse it as the victim's authenticated session. The auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID value into a Set-Cookie response and sets the cookie Domain attribute to DB_HOST, so the same handler also leaks the internal database hostname to any visitor. Exploitation is conditional on victim interaction: the victim must log in while carrying the attacker-chosen identifier, and no public exploit code was identified at time of analysis; upgrading to 3.8.6 removes the flaw.
Authenticated SQL injection in WeGIA versions prior to 3.8.6 allows a user with access to the Material & Patrimônio module to inject arbitrary SQL through the id_produto parameter of web/html/matPat/restaurar_produto_desocultar.php, enabling extraction of sensitive database records and modification of institutional and inventory data. The flaw is rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires a valid low-privileged account plus module-level authorization, so anonymous visitors cannot trigger it. No public exploit identified at time of analysis; the vulnerable code path ships by default in affected releases and a vendor fix (3.8.6) is available.
Unauthenticated SQL injection in WeGIA versions prior to 3.8.6 allows any remote attacker to read and modify the underlying database by sending a single POST request to web/html/socio/sistema/cadastro_cobranca.php. The codigo parameter is folded into the WHERE codigo= clause of an UPDATE statement without parameter binding, and supplying a quoted string defeats MariaDB's implicit numeric conversion on the VARCHAR column, permitting arbitrary SQL execution without a session. Exposed records include user credential hashes and billing entries in the cobrancas table; the issue is rated CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis.
PHP object injection in ILIAS LMS affects installations before 9.24, 10.12, and 11.5, allowing an authenticated user who holds the Test creation or Test import permission to deserialize attacker-controlled objects by importing a crafted Test results archive. By embedding a malicious 'tst_sequence' (sequence) attribute in the archive XML, the attacker reaches an unrestricted unserialize() call and can leverage the bundled Guzzle or Monolog libraries as POP gadget chains to write PHP files and achieve remote code execution on the server. The primary limiting factor is the required authenticated account and import-level permission rather than any anonymous exposure; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing).
Unauthenticated PHP object injection in e107 CMS before 2.3.7 lets a remote attacker who can reach install.php execute arbitrary PHP functions with the web server's privileges, resulting in full server compromise (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The flaw arises because the installer decodes the attacker-controlled previous_steps POST parameter and feeds it to unserialize() without restricting allowed classes, and because install.php remains reachable after a normal installation. No public exploit code was identified at time of analysis and CISA KEV does not list this issue, but the advisory documents a complete, directly usable gadget chain (GuzzleHttp\Psr\7\PumpStream → paths.hash → site_path callable coercion) that makes reliable exploitation realistic for any deployment that left the installer endpoint exposed; sites that deleted or access-restricted install.php after setup are the main mitigating factor.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
Unauthenticated information disclosure in the FOG imaging/cloning suite (all versions prior to 1.5.10.1870) allows a remote requester to retrieve the configured default Active Directory domain-join password by dispatching the management adInfo() endpoint through node=ipxe, which was reachable without an authenticated session and returns the credential in the domainpass JSON field. Exploitation requires only network reachability to the FOG web interface plus the operator-side condition that a FOG_AD_DEFAULT_PASSWORD value has been configured for automatic AD domain joins; if no default AD password is set, the endpoint discloses nothing sensitive. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the disclosure of a reusable domain-join credential carries high confidentiality impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
OS command injection on Windows in Beganovich Snappdf versions 1.1.0 through 6.0.x lets remote attackers execute arbitrary operating-system commands as the PHP process by feeding cmd.exe metacharacters (such as '&') into the URL passed to setUrl(). Because the vulnerable code path is built only when the library runs on Windows, the issue is exploitable only when the integrating PHP application runs on Windows and passes attacker-influenced data into setUrl(); a fully static or trusted URL is not exploitable. The CVSS v4.0 vector (AV:N/PR:N/UI:N) indicates the injection can be triggered remotely without authentication, giving high confidentiality, integrity, and availability impact on the host, although no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.
PHP Object Injection in the Post Export Import with Media WordPress plugin (versions ≤1.17.1) allows authenticated administrators to inject arbitrary PHP objects via deserialization of untrusted input, but the flaw has no impact unless a separate plugin or theme provides a usable POP gadget chain. If such a chain exists, the attacker could delete files, retrieve sensitive data, or execute code. No public exploit code has been identified, and the issue is considered conditional and lower-priority despite the 7.2 CVSS score.
Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.
Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated SQL injection in the calendar module of Omnispace Agora Project before 26.10.0 lets a low-privileged user read arbitrary data from the backend database by tampering with the sortEvents parameter, which is concatenated unsanitized into an ORDER BY clause in app/ModCalendar/CtrlCalendar.php. Exploitation requires a valid session with access to the calendar feature (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so anonymous internet-wide attacks are not possible; the impact is confidentiality-only, with error-based payloads such as extractvalue() used to leak database version information. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in release 26.10.0.
Second-order SQL injection in Omnispace Agora Project before 26.10.0 lets an authenticated user store a malicious _idCategoryFilter value in their own server-side session, which is later concatenated without parameterization into SQL in app/Common/MdlCategory.php, granting high-impact read and write access to the underlying database. Exploitation requires a valid authenticated session (CVSS 4.0 base 8.6; assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), so unauthenticated outsiders cannot reach the sink and risk concentrates in deployments that issue accounts to numerous or low-trust users; no public exploit identified at time of analysis. The vendor has released 26.10.0, which removes the vulnerable condition.
Account takeover in Omnispace Agora Project before 26.10.0 is enabled by predictable default and temporary account passwords: Txt::defaultPassword() derives those passwords from PHP's uniqid(), which is seeded on microsecond server time rather than a cryptographically secure random source. An attacker who can observe or closely approximate the moment an account was created can reconstruct the uniqid() value, compute the generated password, and authenticate as that user before the legitimate owner first logs in and changes it. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N) describes a network-reachable, unauthenticated attack that severely compromises confidentiality and integrity but carries high attack complexity because the timing reconstruction and the pre-first-login race must both succeed; no public exploit code identified at time of analysis, and the input contains no CISA KEV listing, so active exploitation is not confirmed.
Unauthenticated remote code execution affects Omnispace Agora Project deployments running versions before 26.10.0, where attacker-controlled values are written unescaped into the PHP configuration file config.inc.php through the installer paths File::updateConfigFile() and DbInstall::dbControl(), and where an SQL injection enabled by PDO::ATTR_EMULATE_PREPARES (which permits stacked queries) lets an attacker re-trigger the installer and inject arbitrary PHP that executes on the underlying host. Exploitation requires only a reachable vulnerable instance with no credentials or user interaction (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; vendor score 9.3 under CVSS v4.0), and no public exploit code has been identified at time of analysis, so risk is concentrated in internet-facing, unpatched installations.
Arbitrary PHP code execution can be achieved against OpenCATS deployments prior to 0.10.0 through an unrestricted file upload in the Import module: an authenticated user holding Import privileges can stage a PHP file whose original, attacker-controlled name is preserved on disk in the web-accessible CATS_TEMP_DIR. Exploitation only works where that temporary directory is served by the web server with PHP execution enabled, so the practical risk is conditional rather than universal; there is no public exploit identified at time of analysis, and the issue is fixed in version 0.10.0. The vulnerability carries a CVSS score of 9.1 (assessed as CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting high impact but requiring authenticated access and a non-default server configuration.
Unauthenticated remote attackers can obtain another client's PHP session identifier from FrankenPHP worker mode before 1.12.5 when the session extension is loaded as a shared module rather than statically compiled in. Because frankenphp_reset_session_state() is compiled out under that build configuration, PS(id) persists across request boundaries on the same worker thread, so a later session_start() may keep a stale identifier instead of adopting the new request's cookie, and under concurrent requests session_id() can return a different user's identifier - enabling information disclosure, session hijacking, and intermittent logouts, with integrity and availability also impacted (CVSS 7.7, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L, CWE-362). Exposure is conditional: official static binaries and Docker images that link the session extension statically are not affected, non-worker (classic) mode is not implicated, and the leak is intermittent and timing-dependent; no public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in Leantime prior to 3.10.0 allows an authenticated low-privilege user to create a full administrator account, or to install, enable, disable and remove plugins, by calling methods exposed through the application's JSON-RPC dispatcher. Any user holding a valid ordinary browser session can trigger this by sending the required X-Requested-With: XMLHttpRequest header and invoking leantime.rpc.api.api.createApiKeyWithProjects with an attacker-chosen role, because PermissionEnforcer::enforce treats API service methods that lack a RequiresPermission attribute as public; exposure widens significantly on installations where open or self-service registration is enabled, since obtaining the prerequisite low-privilege session becomes trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete compromise of confidentiality, integrity and availability once the privilege boundary is crossed, and the vendor has shipped a fix in version 3.10.0.
FearlessCMS 0.1.2b and earlier lets an authenticated administrator supply an arbitrary Git repository URL to the dashboard updater (admin/updater-handler.php → perform_update → update.sh), which clones the repository and overwrites the live plugins/, admin/, and includes/ directories without validating the repository's identity, signatures, or contents. Because router.php allows existing PHP files under plugins/ to be executed by the PHP built-in development server - the project's documented run mode - the injected update content runs as arbitrary PHP under the web server account and can persist as a backdoor, yielding full compromise of confidentiality, integrity, and availability. Exploitation is gated on high-privilege (administrator) authentication and affects only versions at or below 0.1.2b; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was provided.
Stored cross-site scripting in Froxlor 2.0.0 before 2.3.14 allows an authenticated customer to inject HTML/JavaScript through a theme value set in customer_index.php; the payload only executes when an administrator later views the customer overview with the Theme column enabled. Successful exploitation can abuse the administrator's CSRF token to create administrator accounts or change server settings. No public exploit code or CISA KEV listing is identified in the available data, so this is a credible but conditional priority requiring valid customer credentials and an administrator to browse the affected view.
Privilege escalation in HTMLy 3.1.1 allows a remote attacker to elevate from a low-privileged account or session to administrative control by abusing the get_feed function in the admin.php component. The supplied CVSS 3.1 score is 9.8 with PR:N, but the independent assessment applies PR:L because CWE-269 privilege-escalation issues realistically require some existing access; no CISA KEV or confirmed active exploitation is provided, and no public exploit was identified at time of analysis. Exposure is limited to HTMLy 3.1.1 installations where the admin interface is reachable, and keeping admin.php off the public internet substantially reduces risk.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
Remote code execution in Adminer before 6.1.1 allows authenticated users with SQLite access to bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark. An attacker can then attach a database file at a PHP-served path and create a table named with PHP code, which executes as the web server user. No public exploit identified at time of analysis; exploitation requires valid credentials, SQLite usage, and a web-accessible writable PHP-executing path.
Authenticated role administrators in Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 can add users to roles belonging to a different organization on the same instance, escaping their own tenant's authorization boundary and gaining privileged membership that lets them sign in to the target organization and modify its user profiles. The flaw is a missing cross-organization ownership check on the role UUID submitted to members_assignment.php (CWE-639), rated CVSS 4.0 8.5 and assessed independently as CVSS 3.1 8.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Exploitation is gated on the attacker already holding role-administrator rights and on the deployment hosting more than one organization, so single-org installations and anonymous or low-privilege users cannot reach the vulnerable path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. This is a genuine but conditional priority, bounded to insiders or compromised administrator accounts.
Authenticated content editors on Grav CMS sites running the Git Sync plugin versions 1.0.2 through 3.4.12 can execute arbitrary OS commands as the web-server account when the plugin's gravuser or gravfull author mode is enabled, by planting shell substitution payloads in their username, full name, or email profile fields that are later interpolated into a git commit --author call and reach PHP exec(). The vulnerability is rated 8.7 (CVSS 4.0) and maps to CWE-78; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires authenticated, low-privileged editor access but no victim interaction, with the additional gating condition that author mode must be explicitly turned on and must not be left at its default posture. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so it is a credible, prioritizable bug rather than a drop-everything emergency - though any site with untrusted or broadly provisioned editor accounts and author mode enabled should treat it as an immediate command-execution risk.
Remote code execution affects Craft CMS 5.10.2 up to but not including 5.10.14, where the Twig sandbox fails to block PHP callables passed to the 'has some' and 'has every' operators inside sandboxed system-message templates. Exploitation requires an authenticated control-panel account that has been granted the System Messages permission - a permission that can be delegated to non-admin users - after which the attacker can invoke two-argument functions such as passthru or system and execute code with the privileges of the web server user. Per current intelligence there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the permission gate is the main limiter, so deployments that reserve System Messages for trusted administrators face materially lower practical risk than multi-user or agency installations that delegate that permission broadly.
Remote unauthenticated attackers can crash PHP worker processes in applications using Gumlet php-image-resize before 3.0.1 by submitting small, heavily compressed image files that expand into very large bitmaps when decoded by GD, exhausting the PHP memory limit and terminating the worker. Any upload or URL-fetch feature that hands untrusted images to the ImageResize constructor is exposed; the impact is availability-only, affecting individual PHP-FPM workers rather than enabling code execution or data disclosure. Severity is rated 8.7 (CVSS 4.0) and an independent assessment concurs on a high availability impact (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited, but the attack is trivial to construct and the vendor characterizes this as a genuine availability risk rather than an emergency.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user holding the 'Messages' permission submit unsandboxed Twig templates that the application compiles and executes as raw PHP, enabling arbitrary function calls, sensitive file reads, and potential filesystem writes that can compromise both the application and its underlying host. Exploitation requires valid back-office credentials plus the 'Messages' privilege (CVSS vector PR:L), so there is no anonymous or mass-exploitation path; EPSS is low at 0.19% (8th percentile) and no public exploit code or CISA KEV entry has been identified, though the flaw is remotely triggerable and rated 8.8 for its high confidentiality, integrity, and availability impact once the privilege prerequisite is met. The vendor has shipped a fix in thelia/twig-engine-module 1.0.9.
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a PHP string-escaping failure to write and execute arbitrary PHP code on the server, achieving remote code execution with web-server privileges. The attack requires a back-office account holding UPDATE-level permission on the admin.configuration.language resource (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, assessed 8.8), so it is not reachable by unauthenticated or low-privilege users despite the network attack vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.47% (39th percentile), making this a high-impact but moderate real-world priority.
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying server by uploading a PHP file through the store banner upload feature, which validates file type solely on the client-supplied MIME type rather than inspecting file content or extension. The flaw affects Thelia v2.6.0 and carries a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity, and availability on a successful upload-to-execution chain, though the PR:H vector means the attacker must already hold high privileges and no pre-authentication path is involved. No public exploit code has been identified at time of analysis, and exploitation additionally assumes the web server executes PHP from the directory where uploaded banners are stored.
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update endpoint to upload a server-executable file such as a PHP script. The document upload endpoint correctly blocks executable file types, but the update path omits the same validation (CWE-434), so the flaw is a validation gap between two sibling features rather than a broken upload filter overall. Exploitation is access-gated: the CVSS vector (AV:N/AC:L/PR:H/UI:N) confirms network reachability but requires high-privilege Thelia admin credentials, and the server must actually execute PHP from the writable document location; impact is rated high for confidentiality, integrity, and availability, but no public exploit code or confirmed active exploitation was identified at time of analysis.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
pH7Builder (pH7 Social Dating CMS) versions before 18.6.0 leak sensitive member records - email addresses, IP addresses, phone numbers, and bank account fields - to unauthenticated remote attackers who bypass the API's access checks. The bypass works because Tool.class.php ships a hard-coded API key (private_api_key=dev772277) and the authorization logic trusts the client-supplied Host header, so an attacker sending 'Host: localhost' along with that static key and the shipped default allowed URL is treated as authorized. No public exploit code has been identified at time of analysis and there is no KEV entry, but the independent assessment scores the issue CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), a high-priority confidentiality-only exposure, with the vendor shipping 18.6.0 as the fix.
Unauthenticated remote code execution in the Anton Extensions WordPress plugin (versions ≤1.2.2) allows attackers to upload arbitrary PHP files to attacker-chosen paths, because the plugin omits capability checks, nonce verification, and file-type validation in its file upload handler. Publicly available exploit code exists according to WPScan, and exploitation requires only that the plugin be installed and active on a reachable WordPress site. The CVSS score of 9.8 reflects critical severity with no authentication required.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.