Tsuyoshi Saito
Monthly
Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the deserialization root cause and network-reachable, no-authentication vector make it high priority.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.
Unauthenticated remote code execution in SOY CMS arises from unsafe deserialization of attacker-controlled data (CWE-502), letting a remote attacker run arbitrary code with the privileges of the web server process. The flaw was coordinated through JPCERT/CC and JVN (JVN04485476) and carries a CVSS 4.0 base score of 9.3. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the deserialization root cause and network-reachable, no-authentication vector make it high priority.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.