Authentication Bypass

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, massively exploited for cryptocurrency mining and botnet recruitment from 2017 onward.

DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.4%.

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.

It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.

It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.0%.

SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.

NETGEAR WNR2000v3 devices before 1.1.2.14, WNR2000v4 devices before 1.0.0.66, and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 37.5%.

VMware Workstation Pro/Player contains an insecure library loading vulnerability via ALSA sound driver configuration files. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 11.6%.

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.7%.

Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens. Rated high severity (CVSS 7.5), this vulnerability is no authentication required. Public exploit code available and EPSS exploitation probability 47.6%.

An issue was discovered in dnaTools dnaLIMS 4-2015s13. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 83.7%.

VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.1%.

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted remote attackers to execute arbitrary. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 87.1%.

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 73.0%.

The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.3%.

Remote unauthenticated code execution in SAP NetWeaver Application Server Java (pre-7.3) through the Invoker Servlet allows attackers to bypass authentication and execute arbitrary code. Confirmed actively exploited (CISA KEV) from 2013 through 2016 in 'Detour' attacks targeting SAP business applications. CVSS 10.0 with EPSS 16.90% (95th percentile) indicates both maximum theoretical severity and sustained real-world exploitation. This remains a critical priority for organizations running legacy SAP NetWeaver Java instances despite the vulnerability's age.

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.

HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.7%.

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.2%.

Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.9%.

The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.5%.

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 85.3%.

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 93.7%.

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability.". Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 37.0%.

pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 53.5%.

Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka IME for Japanese) is installed, allow remote. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 50.8%.

BMC Track-It!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.

Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 26.2%.

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 81.8%.

The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Microsoft Internet Explorer 10 and 11 allows local users to bypass the Protected Mode protection mechanism, and consequently gain privileges, by leveraging the ability to execute sandboxed code, aka. Rated medium severity (CVSS 6.2). Public exploit code available and EPSS exploitation probability 24.2%.

administrator/components/com_media/helpers/media.php in the media manager in Joomla!. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 52.1%.

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthenticated attackers to execute arbitrary code and escape security restrictions. Affects Oracle JRE 5.0 through Update 45, 6 through Update 45, 7 through Update 21, and OpenJDK 7. Confirmed actively exploited (CISA KEV) with 93.22% EPSS probability and publicly available exploit code. Oracle released patches in June 2013 CPU addressing the vulnerability through image channel verification corrections.

Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.

monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 42.2%.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.

The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 72.9%.

BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.3%.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.6%.

Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 75.9%.

The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.0.20, 6.1.0 through 6.1.12, 6.2.0 through 6.2.5, and 6.3.0 through 6.3.2 on UNIX and Linux, when old-style password. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 25.7%.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName methods, enabling complete sandbox escape for untrusted applets. Massively exploited by exploit kits in 2012.

F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.4%.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.

Alpine Linux package incus-feature contains an unspecified vulnerability addressed in version 7.3.0-r0. The vulnerability originates from the Incus container and virtual machine manager ecosystem, packaged for Alpine Linux. No vulnerability type, attack vector, impact class, or affected version range has been disclosed beyond the fix version, making independent risk assessment severely limited at this time.

Incus (incus-feature package) on Alpine Linux received a security fix in version 7.3.0-r0. The nature, severity, and impact of the underlying vulnerability are not disclosed in the available intelligence - only the package name and fixed version are confirmed. No CVSS score, CWE classification, or vulnerability description has been published. No public exploit has been identified at time of analysis.

Cross-namespace lease revocation in OpenBao allows an authenticated user in one namespace to revoke or renew leases belonging to a different namespace via legacy, undocumented API endpoints that bypass ACL enforcement. Affected versions are OpenBao <= 2.5.3 in deployments where the namespace feature is active for multi-tenancy. An authenticated attacker who obtains a cross-namespace lease ID can revoke the victim tenant's dynamic credentials, causing targeted availability disruption. No public exploit exists and EPSS is very low at 0.05%, but the impact directly undermines multi-tenant isolation guarantees in affected clusters.

Incus on Alpine Linux received a security fix in package version 7.2.0-r0 addressing a vulnerability in an unspecified feature component ('incus-feature'). The Alpine Linux vendor advisory confirms the fix but provides no description of the vulnerability class, attack vector, or impact. Without CVSS, CWE, or a detailed description, the nature and severity of this issue cannot be independently characterized from available data.

Incus on Alpine Linux contains a fixed vulnerability addressed in package version 7.2.0-r0. The nature, impact, and attack surface of this vulnerability are not described in available intelligence - the sole data point is an Alpine Linux vendor advisory confirming a fix in the incus-feature package. Without a CVE description, CVSS vector, or CWE classification, the specific weakness class, exploitability, and impact cannot be characterised. Security teams should treat this as an uncharacterised patch requiring upgrade to the fixed version.

Keycloak's Admin REST API allows authenticated administrators with delegated privileges over a realm to read or modify sensitive client configurations in the master realm by abusing a per-request in-memory cache that resolves clients by unique identifier without verifying realm ownership. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, requires the attacker to hold privileged delegated administration rights and to know or reference a target client's unique ID, and is assessed as a moderate-priority authorization issue rather than a high-CVSS critical defect. No public exploit code was identified at time of analysis, and successful exploitation could expose client credentials or redirect administrative login attempts to malicious sites.

Missing authorization checks in the Keycloak Authorization Services policy evaluation endpoint allow an authenticated delegated administrator with limited viewing privileges to read the full profile and role information of any user in the realm, including email addresses and assigned security roles. This moderate-severity information-disclosure issue affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis.

Authentication bypass in the Tencent BrowserSkill local WebSocket daemon (bsk-cli, through v0.3.0) allows any installed browser extension that presents a syntactically valid 32-character Chrome extension ID to register as a client and intercept or manipulate the page content, DOM, and screenshots returned to the AI agent. The root cause is a missing origin allowlist (CWE-346) rather than a memory-safety bug, so exploitation is limited to hosts where a hostile extension can be loaded into the browser and the daemon is running - reflected in the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N with high integrity impact (I:H) and low confidentiality/availability impact, and in the supplied CVSS 4.0 score of 6.9. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the overall risk is best characterized as a moderate, locally-scoped integrity risk rather than a widespread emergency.

Hard-coded default superuser credentials in aiyiyi121 SxDevOps 1.0/1.1 let unauthenticated remote attackers log in to the management/API interface as a superuser, because the shipped password (Admin@123456, published in the project's own README) is generated by ensure_default_superuser in rbac/services.py and is never forced to be changed. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC/VI/VA:L) confirms no authentication or user interaction is required and that the attack is network-reachable; our own assessment rates the true impact higher (C/I/A:H) since a superuser session yields full control of managed hosts and tasks, limited only by whether the operator changed the default after initialization. The vendor has published a fix commit and states a corrected version was released; no public exploit code was identified at time of analysis, but exploitation requires no tooling beyond the documented credential, and there is no CISA KEV listing for this issue. EPSS data was not provided.

SxDevOps 1.0 and 1.1 seed demo and administrator accounts with a hard-coded default password ('Admin@123456') that is also documented in the project README, letting an unauthenticated remote attacker who can reach the login interface sign in with full administrative privileges. The flaw is only exploitable on deployments that were initialized with the demo accounts and where the password was never rotated or the accounts disabled before exposing the service; instances that set SXDEVOPS_DEMO_PASSWORD/SXDEVOPS_ADMIN_INITIAL_PASSWORD or applied the vendor fix are not affected. No public exploit code was identified at time of analysis, and the vendor has published a fixing commit (2b4bf8585c3e731e7a8af30801ea46680bc783f9).

Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. No special configuration is required, no credentials or user interaction are needed, and there is no indication of confirmed active exploitation in CISA KEV at the time of analysis; EPSS data was not provided.

The certificate validation route in Nginx Proxy Manager through 2.15.1 (internalCertificate.validate in backend/internal/certificate.js) is reachable without authentication, letting any remote caller submit arbitrary certificate material to the backend. Publicly available exploit code exists, but the project has not responded to the early issue report, so no fixed release is confirmed; the practical impact is constrained because the endpoint parses and echoes back only the certificate the caller supplied rather than returning stored data, leaving malformed-input handling in the OpenSSL parsing path as the main residual concern. As our independent assessment notes, this is a moderate-priority issue and the raw 6.9 CVSS 4.0 score somewhat overstates the real-world risk.

Unauthenticated username enumeration in Dromara UJCMS through version 12.3.1 allows remote attackers to query the UserController username-existence endpoint and determine whether a given account name is registered on the target site, leaking account information without any credentials, user interaction, or special configuration. The independent assessment rates this as a low-impact confidentiality leak (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), whose practical value lies in feeding follow-on password-guessing or credential-stuffing campaigns against confirmed accounts rather than in direct compromise. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); the vendor was notified via a GitHub issue but has not responded, so no fixed release is available.

Missing OAuth token validation in Pixelfed up to 0.12.11 allows an authenticated user without a valid OAuth token to reach the /api/v1 instancePeers endpoint and enumerate federated peer instances, a low-sensitivity information exposure tracked as CWE-306. Publicly available exploit code exists, and the vendor has released a patch (v0.12.10, commit 68dca5097305fa0065d029587b2233524636025a) with a GitHub issue and PR. The independent assessment treats this as low priority: the CVSS vector requires PR:L (authenticated) access, the exposed peer list is often publicly available anyway, and there is no user-data confidentiality, integrity-write, or availability impact beyond peer enumeration.

Keycloak's OpenID Connect token refresh path can issue fresh access tokens on behalf of an OIDC client that an administrator has already disabled, because the server restores requested audiences from stored client IDs without re-checking whether that audience client is still enabled. An attacker who already possesses a valid, unexpired refresh token for the affected client can therefore keep obtaining usable access tokens after the client is turned off, but only against resource servers that validate the JWT locally (offline signature/claim checks) rather than calling Keycloak for introspection or userinfo. Scoring is low at CVSS 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), no public exploit code was identified at time of analysis, and exploitation requires both a live refresh token and a client that was disabled after that token was issued.

Authentication bypass in the OpenPanel tracking API allows unauthenticated remote attackers to inject forged revenue metrics and evade bot-detection filters by supplying arbitrary dummy secrets-only a public client ID, intentionally exposed in the client-side tracking snippet, is required. Affected versions extend through commit bad75bddc74d12d36cfb843f4531d3b830a8d994; the flaw is a moderate-severity integrity issue (CVSS 3.1 I:L) with no public exploit identified at time of analysis.

The TikTok for Business WordPress plugin (all versions up to and including 1.4.1) fails to verify authorization on its TikTok OAuth token-exchange handler, allowing an unauthenticated remote request to overwrite the merchant's stored TikTok integration access token in the wp_options table and effectively hijack the site's TikTok Business account and product catalog link. Exploitation is heavily constrained: the request must carry a valid TikTok OAuth auth_code issued specifically for that merchant's registered TikTok app, and the plugin only persists the new token after TikTok's API returns message='OK', so forged or arbitrary codes fail. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and the vendor has committed a fix to the plugin's code repository; the impact is integrity-only (C:N/I:L/A:N), which keeps real-world risk low despite the unauthenticated network vector.

Unauthenticated information disclosure in the Bread WordPress plugin (versions up to and including 2.9.12) lets any remote visitor read the plugin's entire configuration export, including the PDF protection password stored in plaintext, by simply requesting the /?export-meeting-list=1 endpoint. The flaw is trivially reachable: the download_settings function is registered on the plugins_loaded hook and explicitly permits execution on non-admin public pages, so no authentication, authorization, or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U, base 5.3 MEDIUM). Impact is bounded to disclosure of the stored protection_password rather than site credentials or code execution, and no public exploit code has been identified at time of analysis; the practical risk depends on how sensitive the protected PDF meeting lists and their shared password are in a given deployment.

Unauthenticated remote attackers can reach administrator-oriented REST API routes in the Mailchimp for WooCommerce WordPress plugin before 6.1.1 because the permission callback does not verify the requesting user's capability, allowing a persistent state change (CWE-862). Publicly available exploit code exists. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, so the impact is limited to low integrity with no confidentiality or availability effect, but the unauthenticated nature and available exploit code make this a real, actionable priority driven more by exploitability signals than by raw severity.

Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.

Authenticated users who hold the Hydra Booking 'host' role on a WordPress site can modify other hosts' profile data and reassign ownership of another host's record to themselves, because the plugin (versions 1.1.0 through before 1.2.3) does not verify that the host record being modified belongs to the requester. Publicly available exploit code exists, but there is no CISA KEV entry indicating active exploitation. The issue is a horizontal privilege-abuse/IDOR flaw rated CVSS 4.7 (MEDIUM) under the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - the attacker must already possess host-level access and gains only limited, cross-host read/write capability, not administrative or site-wide control.

Unauthenticated attackers can publish arbitrary persisted query documents and claim (squat) query aliases on WordPress sites running the WPGraphQL Smart Cache plugin before 2.3.2, because the plugin neither requires authorization for the storage request nor validates the caller-supplied query identifier. WPScan reports that publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV); scoring is CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) and the independent assessment characterizes this as a moderate, integrity-focused risk. Practical impact is bounded by whether the site actually depends on persisted queries and aliases and by a first-claim race - the attacker must register an alias before the site's own frontend does - and WPGraphQL's own access controls still govern what any stored query can return, so confidentiality loss is not demonstrated.

Unauthenticated visitors to WordPress sites running the Online Scheduling and Appointment Booking System plugin (versions 28.1 through before 28.2) can read other visitors' AI booking-assistant messages and inject new messages into their in-progress conversations, because the plugin's unauthenticated conversation actions never verify that the requester owns the conversation ID being referenced. Rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) under CWE-639, the practical risk hinges on how conversation identifiers are generated: if they are sequential or guessable the flaw is broadly automatable, but if they are opaque tokens exploitation is opportunistic and low-volume, which is why the base score is only moderately elevated. Publicly available exploit code exists and the issue was reported by WPScan, though there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis. There is no availability impact and no path to site takeover described; exposure is limited to the confidentiality and integrity of other visitors' assistant conversations.

Unauthenticated attackers can impersonate the Better Messages plugin's own internal AI bot accounts on WordPress sites running versions up to and including 2.15.33, gaining entry to administrator-restricted chat rooms and reading the private message history of other users. The flaw is entirely pre-authentication (CVSS vector PR:N/UI:N) and requires only that unauthenticated guest registration is enabled and that the server forwards the client-supplied X-Real-IP header to the plugin, which stores it verbatim; the plugin's is_ai_bot_user() check then prefix-matches the attacker-chosen value against 'ai-chat-bot-'. No public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the low complexity and lack of any credential requirement make the issue straightforward to abuse where restricted rooms exist. The vendor-assigned score is 5.3 (Medium, C:L/I:N); our reassessment raises confidentiality to High and adds a Low integrity impact because the same bypass allows posting into restricted rooms, netting a materially higher severity than the published vector implies.

Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.

SiYuan versions through 3.8.4 fail to enforce authorization on the getDynamicIcon endpoint, allowing authenticated attackers holding a read-only publish token to disclose metadata-such as block titles, names, aliases, and hierarchical paths-of restricted documents via a template injection triggered by type=8 requests. The flaw is rated medium severity (vendor CVSS 5.3, independent CVSS 3.1 5.3) and impacts confidentiality only; no public exploit or active exploitation has been identified at time of analysis.

HTTP request smuggling in Netty's netty-codec-http component lets unauthenticated remote attackers bypass front-end security controls by sending a crafted HTTP/1.1 chunk-size token containing whitespace after the hexadecimal digits, which Netty parses differently from other HTTP intermediaries. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), meaning no authentication or user interaction is required, but integrity and availability impact is limited; meaningful exploitation generally depends on a multi-tier topology where a proxy, load balancer, or backend parses the chunk-size token inconsistently with Netty. Red Hat ships the affected library across a broad portfolio - including AMQ Broker 7, AMQ Clients, Quarkus, Keycloak and Red Hat Single Sign-On 7, JBoss EAP 7/8, Fuse 7, Data Grid 8, Camel for Spring Boot 4, Camel 4 for Quarkus 3, Apicurio Registry 3 and Debezium 3 - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV).

Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4, because the Shiro-configured anonymous routes /attachment/preview/{id} and /pic/preview/{id} resolve attachments through AttachmentService.getResource with a bare primary-key lookup and no ownership, organization, or permission check. Exploitation requires the attacker to know, guess, or observe a valid IDGenerator.nextStr file id; the ids are not sequentially predictable, which raises attack complexity, but ids leaked through shared preview links, logs, or browser history permit direct retrieval. The issue is read-only disclosure of stored files and is fixed in 1.7.4; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis. This is a genuine unauthenticated broken-access-control (IDOR) flaw but a moderate real-world priority, not a critical emergency.

Virtual host isolation bypass in IBM WebSphere Application Server and WebSphere Application Server Liberty, as bundled in IBM CICS TX Advanced 10.1, allows remote requests addressed to one configured virtual host to reach resources belonging to another virtual host on the same instance. The vendor assigns CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-284); our independent assessment keeps the same unauthenticated, low-confidentiality/low-integrity, no-availability profile but raises attack complexity to AC:H because the weakness is only meaningful when an instance is configured to serve multiple distinct virtual hosts, while a default single-virtual-host deployment offers little to bypass. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and a vendor patch is available per the IBM advisory.

IBM WebSphere Application Server 9.0 and 8.5 allow remote, unauthenticated attackers to obtain sensitive file-system information through the FileTransfer servlet due to incorrect authorization (CWE-863). Exploitation requires network access to the servlet endpoint, which is part of the administrative/deployment interface, and impact is limited to confidentiality (CVSS 5.3, C:L). No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available per IBM's advisory.

Unauthenticated network access to the SOAP/JMX administrative connector on IBM WebSphere Application Server 8.5 and 9.0 can bypass authentication, allowing an attacker to read limited information from the server (CWE-306, CVSS 5.3). The flaw is remotely reachable without credentials or user interaction (PR:N/UI:N/AC:L), but impact is confined to low confidentiality loss - no code execution, configuration change, or denial of service. A vendor patch is available per IBM's advisory; no public exploit has been identified at time of analysis, and real-world exposure is constrained by the fact that the SOAP/JMX connector is normally bound to a management interface that hardened deployments segment or firewall from untrusted networks.