---METADATA---
VENDOR: Diebold Nixdorf
PRODUCT: wnBios64
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A stack buffer overflow vulnerability in the Diebold Nixdorf (Wincor Nixdorf) wnBios64 component could allow for arbitrary code execution at the firmware level.

Executive Summary:
Diebold Nixdorf wnBios64 contains a high-severity stack buffer overflow that could allow an attacker to execute malicious code with high privileges, potentially compromising the entire system.

Vulnerability Details

CVE-ID: CVE-2025-70616

Affected Software: Diebold Nixdorf wnBios64

Affected Versions: See vendor advisory for affected versions

Vulnerability: A stack buffer overflow exists in the wnBios64 BIOS component. This type of vulnerability typically requires local or administrative access to the operating system to trigger the overflow in the firmware interface, allowing for code execution in a highly privileged environment.

Business Impact

A successful exploit at the BIOS level is catastrophic, as it allows attackers to bypass operating system security controls and establish persistence that survives OS reinstallation. The CVSS score of 7.8 reflects the severity of this hardware-level risk, which could lead to the total compromise of ATMs or point-of-sale systems, resulting in significant financial fraud and system downtime.

Remediation Plan

Immediate Action: Deploy the latest BIOS/firmware updates provided by Diebold Nixdorf to all affected hardware assets immediately.

Proactive Monitoring: Monitor for unauthorized firmware modification attempts or unusual system behavior during the boot process.

Compensating Controls: Ensure Secure Boot is enabled and implement strict physical security and OS-level hardening to prevent unauthorized users from accessing BIOS-related utilities.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 7, 2026, there is no public information indicating active exploitation. Firmware vulnerabilities are difficult to patch at scale but are highly prized by sophisticated attackers for their stealth and persistence.

Analyst Recommendation

This vulnerability represents a significant threat to the underlying trust of the hardware platform. It is imperative that organizations using Diebold Nixdorf systems identify affected hardware and apply firmware patches immediately to prevent deep-level system compromise.

---METADATA---
VENDOR: Molecule
PRODUCT: Boltz
AFFECTED_VERSIONS: 2; See vendor advisory for affected versions
---END_METADATA---

Description Summary:
A high-severity vulnerability has been identified in Molecule Boltz 2, potentially allowing for unauthorized system access or data manipulation.

Executive Summary:
Molecule Boltz 2 is affected by a high-severity vulnerability that could lead to a complete compromise of the application environment.

Vulnerability Details

CVE-ID: CVE-2025-70560

Affected Software: Molecule Boltz

Affected Versions: 2

Vulnerability: While the technical specifics are limited in the summary, the CVSS score of 8.4 indicates a critical flaw, likely involving an unauthenticated attacker. The vulnerability exists within the core logic of the Boltz 2 application.

Business Impact

The business impact of this vulnerability is high, as reflected by its CVSS score. Potential consequences include unauthorized access to proprietary data, loss of system integrity, and significant downtime. Organizations relying on Boltz 2 for critical operations face a high risk of service disruption.

Remediation Plan

Immediate Action: Apply the security updates for Boltz 2 provided by Molecule immediately to close the security gap.

Proactive Monitoring: Enable detailed application logging and monitor for anomalous behavior, such as unexpected file modifications or unauthorized user creations.

Compensating Controls: Restrict network access to the Boltz 2 application using firewalls and ensure that the principle of least privilege is applied to all service accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. The high severity suggests a high likelihood of exploitation if the software remains unpatched.

Analyst Recommendation

Immediate remediation is required. Administrators should prioritize the deployment of the vendor's patch to Boltz 2 instances to mitigate the risk of unauthorized access and maintain the security posture of their application stack.

Executive Summary:
A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been identified in the LatePoint plugin for WordPress. This flaw could allow an unauthenticated attacker to trick a logged-in administrator into unknowingly executing malicious actions, potentially leading to a full compromise of the affected website's settings, user data, or functionality.

Vulnerability Details

CVE-ID: CVE-2025-7052

Affected Software: WordPress Multiple Products

Affected Versions: All versions of the LatePoint plugin up to, and including, version 5.

Vulnerability: The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). This is due to a lack of sufficient security nonces or other token-based validation on state-changing requests. An attacker can craft a malicious link, form, or script and trick an authenticated administrator into clicking it or visiting a malicious page. The administrator's browser would then automatically submit the forged request to the vulnerable website, executing actions with the administrator's privileges without their consent or knowledge.

Business Impact

This is a High severity vulnerability with a CVSS score of 8.8. Successful exploitation could have a significant negative impact on the business. An attacker could perform unauthorized actions such as modifying the plugin's configuration, deleting appointments and customer data, or potentially escalating privileges by creating a new rogue administrator account. This could lead to operational disruption, data breaches, reputational damage, and financial loss associated with remediation and customer notification.

Remediation Plan

Immediate Action: Immediately update the LatePoint WordPress plugin to the latest version provided by the vendor, which contains the necessary security patch. After updating, review all WordPress security settings to ensure they are correctly configured. If the plugin is no longer needed, it should be deactivated and uninstalled to reduce the overall attack surface.

Proactive Monitoring: Monitor web server access logs for unusual or unauthorized POST requests to the LatePoint plugin's administrative functions, especially those originating from unexpected referrers. Security teams should also set up alerts for the creation of new administrative user accounts or unexpected configuration changes within the WordPress dashboard.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block CSRF attacks. Enforce strict referrer policies and ensure administrators log out of their sessions when not in use. Restricting access to the WordPress administrative area (/wp-admin/) to trusted IP addresses can also reduce the risk of exploitation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 30, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, CSRF vulnerabilities are often straightforward to exploit once the weakness is identified. Organizations should assume that threat actors may develop and deploy exploits rapidly.

Analyst Recommendation
Given the high CVSS score of 8.8, this vulnerability poses a significant risk to affected WordPress sites. We strongly recommend that all organizations using the LatePoint plugin prioritize the immediate installation of the patched version. Although this vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high potential for impact warrants urgent attention. Proactive patching is the most effective defense against potential exploitation.

Executive Summary:
A high-severity vulnerability has been identified in the "Use-your-Drive | Google Drive plugin for WordPress," which could allow an attacker to inject malicious code into a website. If exploited, this could lead to the compromise of user and administrator accounts, theft of sensitive data, or a complete takeover of the affected website. Organizations using this plugin are urged to apply security updates immediately to mitigate the significant risk to their web presence and data security.

Vulnerability Details

CVE-ID: CVE-2025-7050

Affected Software: Google Multiple Products (Specifically: Use-your-Drive | Google Drive plugin for WordPress)

Affected Versions: All versions up to, and including, version 3.

Vulnerability: The vulnerability is a Stored Cross-Site Scripting (XSS) flaw. An attacker with permissions to upload or manage files in the Google Drive account connected to the WordPress plugin can craft a malicious file title containing executable JavaScript code. When the plugin renders this file's metadata on the WordPress site, it fails to properly sanitize the 'title' parameter, causing the malicious script to be stored on the server and executed in the browser of any user who views the page displaying the file. This allows for session hijacking, credential theft, website defacement, or redirecting users to malicious websites.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.2. Exploitation could have a significant business impact, including reputational damage resulting from a defaced website or compromised user data. An attacker could steal session cookies to impersonate logged-in users, including administrators, potentially leading to a full compromise of the WordPress site. This could result in the theft of sensitive business or customer information, unauthorized content changes, and the use of the compromised website to launch further attacks against its visitors.

Remediation Plan

Immediate Action: Immediately update the "Use-your-Drive | Google Drive plugin for WordPress" to a patched version (greater than 3) as recommended by the vendor. After patching, review web server and application logs for any signs of past exploitation attempts, such as suspicious script tags in requests or logs related to the plugin's file display functions.

Proactive Monitoring: Implement continuous monitoring of web application logs, specifically looking for patterns indicative of XSS attacks. This includes searching for HTML tags like <script>, <img>, or <iframe> and JavaScript event handlers like onerror or onload within data fields associated with the plugin. A properly configured Web Application Firewall (WAF) can be instrumental in detecting and blocking such malicious injection attempts in real-time.

Compensating Controls: If immediate patching is not feasible, consider implementing the following controls:

• Deploy a Web Application Firewall (WAF) with rules specifically designed to filter XSS payloads in parameters used by the plugin.
• Strictly limit permissions for who can upload and name files within the connected Google Drive account to only trusted administrators.
• Temporarily disable the plugin until a patch can be applied to remove the attack vector entirely.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2025, there are no known public proof-of-concept exploits or active malicious campaigns targeting this vulnerability. However, Stored XSS vulnerabilities in popular WordPress plugins are common targets for threat actors, and exploits can be developed with relative ease. Organizations should assume that this vulnerability will be targeted in the near future.

Analyst Recommendation

Given the high severity (CVSS 7.2) and the nature of the Stored XSS vulnerability, we strongly recommend that organizations identify all WordPress instances using the "Use-your-Drive | Google Drive" plugin and prioritize applying the vendor-supplied patch immediately. Although this CVE is not currently on the CISA KEV list, its potential impact on website integrity and data confidentiality is severe. Proactive patching is the most effective defense and should be completed urgently to prevent potential exploitation.

Executive Summary:
A high-severity privilege escalation vulnerability has been identified in the WPGYM - Wordpress Gym Management System plugin. This flaw could allow a low-privileged attacker, such as a subscriber, to gain unauthorized administrative access to the WordPress website. Successful exploitation would result in a complete compromise of the site, enabling the attacker to steal data, deface the site, or install malware.

Vulnerability Details

CVE-ID: CVE-2025-7049

Affected Software: WPGYM - Wordpress Gym Management System plugin for WordPress

Affected Versions: All versions up to, and including, 67

Vulnerability: The vulnerability allows for privilege escalation within the affected WordPress plugin. An authenticated attacker with low-level permissions (e.g., a subscriber account) can exploit a flaw in the plugin to elevate their privileges to that of an administrator. This typically occurs due to missing or improper authorization checks, allowing a user to access and execute administrative functions that should be restricted.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8, posing a significant risk to the organization. A successful exploit would grant an attacker full administrative control over the affected website. This could lead to severe business consequences, including the theft of sensitive customer data, website defacement causing reputational damage, distribution of malware to visitors, and potential financial losses. A compromised website could also be used as a pivot point to launch further attacks against the organization's internal network.

Remediation Plan

Immediate Action: Immediately update the WPGYM - Wordpress Gym Management System plugin to the latest version (greater than version 67). After patching, review all user accounts, especially those with administrative privileges, to ensure no unauthorized accounts have been created. If the plugin is no longer required for business operations, it should be deactivated and completely removed from the WordPress installation.

Proactive Monitoring: Monitor WordPress audit logs for any unexpected changes in user roles, particularly any escalation to an administrator role. Scrutinize logs for unusual activity from low-privileged accounts attempting to access administrative functions. System administrators should also monitor for the creation of suspicious files on the web server or unauthorized modifications to core WordPress files.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules designed to block privilege escalation attempts. Restrict access to the WordPress administrative dashboard (/wp-admin/) to trusted IP addresses only. Enforce the principle of least privilege for all user accounts and conduct regular security reviews of all installed plugins and themes.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 10, 2025, there is no known public proof-of-concept exploit code or evidence of this vulnerability being actively exploited in the wild. However, vulnerabilities of this nature in popular WordPress plugins are often quickly weaponized by threat actors once details become public. The high CVSS score indicates that the vulnerability is relatively easy to exploit.

Analyst Recommendation

Given the high severity (CVSS 8.8) of this vulnerability, we strongly recommend that all instances of the WPGYM plugin be patched immediately. The potential for a complete website compromise presents a critical risk that must be addressed with urgency. Although this CVE is not currently on the CISA KEV list, its impact warrants immediate attention. After remediation, a thorough security audit should be performed to search for any indicators of compromise, such as newly created admin accounts or suspicious files.

Executive Summary:
A high-severity vulnerability has been identified in the Cloud SAML SSO plugin for WordPress, which could allow an unauthorized user to modify critical organization settings. This flaw exists because the plugin fails to properly check user permissions before allowing changes, creating a risk of security misconfiguration, authentication bypass, or data manipulation. Organizations using this plugin should apply the recommended update immediately to prevent potential exploitation.

Vulnerability Details

CVE-ID: CVE-2025-7040

Affected Software: WordPress Cloud SAML SSO plugin

Affected Versions: All versions up to, and including, 1.

Vulnerability: The vulnerability is a missing capability check within the csso_handle_actions() function of the plugin. Specifically, when the function is called with the set_organization_settings action, it does not verify if the user initiating the request has the appropriate administrative privileges. A low-privileged authenticated attacker, such as a subscriber, can craft a malicious request to this function to modify the plugin's organizational settings, potentially altering SAML SSO configurations without authorization.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Successful exploitation could lead to significant business disruption and security compromise. An attacker could modify Single Sign-On (SSO) settings to lock out legitimate administrators, redirect users to malicious identity providers to steal credentials, or disable security features, thereby weakening the overall security posture of the WordPress site. This poses a direct risk to the confidentiality, integrity, and availability of the application and its associated user data.

Remediation Plan

Immediate Action: Immediately update the Cloud SAML SSO plugin to the latest available version, which will be a version greater than 1. If the plugin is not essential for business operations, consider deactivating and removing it to eliminate the attack surface entirely.

Proactive Monitoring: Monitor web server access logs for POST requests targeting the WordPress AJAX handler (/wp-admin/admin-ajax.php) that contain the action=set_organization_settings parameter. Scrutinize any such requests originating from IP addresses or user accounts that do not have administrative privileges. A sudden change in the plugin's configuration files should also trigger an alert.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block or flag requests containing the set_organization_settings action from non-administrative users. Additionally, enforce the principle of least privilege for all WordPress user accounts, ensuring users only have the permissions necessary for their roles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 7, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, given the ease of exploitation for authenticated users and the high-impact nature of the flaw, it is highly probable that threat actors will develop exploits in the near future.

Analyst Recommendation
Given the high CVSS score of 8.2, organizations are strongly advised to treat this vulnerability with high priority. The potential for an authenticated, low-privileged user to escalate privileges or compromise the site's authentication mechanism presents a significant risk. Although this CVE is not currently listed on the CISA KEV catalog, immediate patching is the most effective mitigation. All instances of the Cloud SAML SSO plugin should be identified and updated without delay.

Executive Summary:
A high-severity authentication bypass vulnerability has been identified in the LatePoint plugin for WordPress. This flaw allows an unauthenticated attacker to bypass security checks and gain unauthorized access to functions within the plugin, potentially leading to data exposure, modification of appointments, and further compromise of the affected website. Immediate patching is required to mitigate the significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2025-7038

Affected Software: LatePoint plugin for WordPress

Affected Versions: All versions up to, and including, 5

Vulnerability: The vulnerability exists due to insufficient identity verification in the latepoint_route_call AJAX action, specifically when handling the steps__load_step route. An unauthenticated attacker can send a specially crafted request to this endpoint. Because the endpoint fails to properly validate the user's session or privileges, the attacker can bypass authentication controls and execute functions that should be restricted to authenticated, privileged users.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.2. Successful exploitation could lead to significant business disruption and data compromise. An attacker could potentially access and exfiltrate sensitive customer information and personally identifiable information (PII) stored by the booking plugin, modify or delete existing appointments, or create fraudulent ones. This poses a direct threat to data confidentiality and integrity, potentially resulting in reputational damage, customer distrust, and regulatory fines.

Remediation Plan

Immediate Action: Immediately update the LatePoint plugin to the latest version available (a version greater than 5) which contains the security patch for this vulnerability. After updating, review the WordPress site's security settings and user accounts for any signs of compromise. If the plugin is no longer required for business operations, it should be deactivated and removed completely.

Proactive Monitoring: Monitor web server and WAF (Web Application Firewall) logs for suspicious POST requests to the /wp-admin/admin-ajax.php endpoint. Specifically, look for requests containing action=latepoint_route_call and route_name=steps__load_step originating from untrusted or unusual IP addresses. Monitor for unauthorized changes to appointments or user data within the LatePoint system.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block or flag requests to the vulnerable AJAX endpoint. Restrict access to the WordPress admin area (/wp-admin/) to trusted IP addresses only. Ensure the principle of least privilege is applied to all user accounts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of September 30, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, authentication bypass vulnerabilities in popular WordPress plugins are highly sought after by threat actors, and it is likely that a proof-of-concept exploit will be developed and published. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high severity (CVSS 8.2) and the critical nature of an authentication bypass, it is strongly recommended that organizations prioritize the immediate update of the LatePoint plugin on all WordPress instances. Although there is no evidence of active exploitation at this time, the risk of compromise is significant. Proactive patching is the most effective defense to prevent potential unauthorized access and protect sensitive customer data.

Executive Summary:
A high-severity vulnerability has been identified in the CleverReach® WP WordPress plugin, which could allow an unauthenticated attacker to steal sensitive information from the website's database. This flaw, a time-based SQL Injection, can be exploited remotely to extract data such as user credentials, personal information, and confidential site content. Organizations using this plugin are at significant risk of a data breach and should take immediate action to mitigate the threat.

Vulnerability Details

CVE-ID: CVE-2025-7036

Affected Software: CleverReach® WP plugin for WordPress

Affected Versions: All versions up to, and including, 1

Vulnerability: The vulnerability is a time-based blind SQL Injection. An unauthenticated attacker can send specially crafted SQL queries through the 'title' parameter of the plugin. By injecting commands that cause a time delay in the database response (e.g., SLEEP()), the attacker can infer the contents of the database one character at a time based on how long the server takes to respond. This allows for the gradual exfiltration of sensitive data without directly seeing the query output.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation could lead to a complete compromise of the confidentiality of the website's database. The potential business impact includes the theft of sensitive customer data, user credentials, and proprietary business information, leading to significant reputational damage, financial loss, and potential regulatory penalties (e.g., under GDPR or CCPA). Furthermore, stolen administrator credentials could be used to gain full control over the affected WordPress site, enabling further malicious activities.

Remediation Plan

Immediate Action: The primary remediation is to update the CleverReach® WP plugin to the latest patched version (greater than version 1) as recommended by the vendor. If the plugin is not essential for business operations, the most secure course of action is to deactivate and completely remove it to eliminate the attack surface.

Proactive Monitoring: Monitor web server access logs for unusual or lengthy requests targeting the plugin's functionality, specifically looking for malicious payloads in the 'title' parameter. Implement and review Web Application Firewall (WAF) logs for alerts related to SQL Injection attempts. Database monitoring should be configured to flag abnormally long-running queries or those containing SLEEP or BENCHMARK commands.

Compensating Controls: If patching cannot be performed immediately, deploy a properly configured Web Application Firewall (WAF) with rules designed to detect and block SQL Injection attacks. This can serve as a virtual patch by inspecting incoming traffic and blocking malicious requests before they reach the vulnerable plugin. Additionally, ensure the database user associated with WordPress has the least privileges necessary, which can limit the scope of data an attacker can access if the exploit is successful.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 6, 2025, there are no known public exploits for this vulnerability. However, the CISA KEV status is "No", meaning it is not currently known to be actively exploited in the wild. Given the popularity of WordPress and the relative simplicity of exploiting SQL injection flaws, it is highly probable that threat actors will develop exploits and begin scanning for vulnerable systems in the near future.

Analyst Recommendation

Given the High severity rating (CVSS 7.5) and the risk of a complete database compromise, we strongly recommend that organizations immediately identify all WordPress instances running the vulnerable CleverReach® WP plugin. The plugin must be updated to the latest secure version without delay. If the plugin is no longer required, it should be removed entirely. The lack of a "Yes" on the CISA KEV list should not be a reason for inaction; proactive patching is critical to prevent exploitation by opportunistic attackers who actively target WordPress vulnerabilities.

---METADATA---
VENDOR: webfsd
PRODUCT: webfsd
AFFECTED_VERSIONS: 1.21
---END_METADATA---

Description Summary:
webfsd 1.21 is vulnerable to a buffer overflow through the 'filename' variable in crafted requests, potentially allowing remote attackers to execute arbitrary code.

Executive Summary:
A critical buffer overflow in webfsd 1.21 allows remote attackers to execute arbitrary code and compromise the host system via specially crafted requests.

Vulnerability Details

CVE-ID: CVE-2025-70314

Affected Software: webfsd

Affected Versions: 1.21

Vulnerability: The vulnerability is caused by insufficient bounds checking on the filename variable within the webfsd service. By sending a crafted request with an excessively long filename, a remote attacker can trigger a buffer overflow, overwriting memory and hijacking the execution flow of the application.

Business Impact

A successful exploit of this buffer overflow allows for remote code execution (RCE) on the server hosting webfsd. Given its CVSS score of 9.8, this represents a critical threat to the availability and security of the server, as an attacker could gain full control, disrupt services, or use the system to launch further attacks.

Remediation Plan

Immediate Action: Update webfsd to the latest version immediately. Consult the vendor's security advisory for specific patch details and installation instructions.

Proactive Monitoring: Monitor for unusual service crashes or restarts of the webfsd process, as these can be indicators of failed or successful buffer overflow exploitation attempts.

Compensating Controls: Deploy memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), and use a firewall to limit access to the webfsd service to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, buffer overflows in file-handling variables are classic targets for automated exploitation scripts.

Analyst Recommendation

The ability to achieve RCE through a simple crafted request makes this a high-priority vulnerability. It is strongly recommended to apply the vendor's patch immediately or transition to a more secure file-serving alternative if updates are not available.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: v1.10
---END_METADATA---

Description Summary:
A stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter in formAdvNetwork allows unauthenticated attackers to potentially execute arbitrary code.

Executive Summary:
D-Link DIR-513 routers contain a critical stack buffer overflow vulnerability in the advanced network configuration form, allowing unauthenticated attackers to gain remote control.

Vulnerability Details

CVE-ID: CVE-2025-70223

Affected Software: D-Link DIR-513

Affected Versions: v1.10

Vulnerability: This is a stack-based buffer overflow vulnerability in the goform/formAdvNetwork endpoint. An unauthenticated remote attacker can exploit this by providing an excessively long value to the curTime parameter, causing memory corruption and potentially allowing for arbitrary code execution.

Business Impact

This vulnerability carries a CVSS score of 9.8, signifying a critical risk to the network perimeter. Successful exploitation allows for complete device takeover, enabling attackers to intercept sensitive communications, disrupt internet connectivity, and pivot to other systems within the internal network environment.

Remediation Plan

Immediate Action: Apply the latest firmware update from D-Link for the DIR-513 router to patch the vulnerable goform endpoints.

Proactive Monitoring: Audit network logs for suspicious POST requests to the /goform/ directory and monitor for unauthorized administrative access to the router.

Compensating Controls: Restrict access to the router’s web management interface and implement strong firewall rules to limit exposure of the device to the public internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation. Stack overflows in web-facing parameters are a classic and highly effective attack vector for home and small-office routers.

Analyst Recommendation

Immediate action is required to patch or replace the affected D-Link DIR-513 routers. Because this vulnerability can be exploited without authentication, it represents a high-priority risk that could lead to the full compromise of the local network infrastructure.

---METADATA---
VENDOR: D-Link
PRODUCT: DIR-513
AFFECTED_VERSIONS: v1.10
---END_METADATA---

Description Summary:
A stack buffer overflow in D-Link DIR-513 v1.10 via the curTime parameter in formAutoDetecWAN_wizard4 allows unauthenticated attackers to potentially execute code.

Executive Summary:
The D-Link DIR-513 router is vulnerable to a critical stack buffer overflow that could allow unauthenticated remote attackers to execute arbitrary code and seize control of the device.

Vulnerability Details

CVE-ID: CVE-2025-70220

Affected Software: D-Link DIR-513

Affected Versions: v1.10

Vulnerability: A stack-based buffer overflow exists in the goform/formAutoDetecWAN_wizard4 endpoint. By sending an overlong string to the curTime parameter, an unauthenticated remote attacker can overflow the stack, leading to a denial of service or arbitrary code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability poses a severe threat to network security. An attacker who gains control of the router can redirect traffic, perform man-in-the-middle attacks, or use the device as a jumping-off point for attacks on the internal network. This could lead to the compromise of all connected devices and sensitive data.

Remediation Plan

Immediate Action: Update the D-Link DIR-513 firmware to the latest available version or replace the device if it has reached end-of-life (EOL).

Proactive Monitoring: Monitor the router for frequent reboots or unusual configuration changes, which may indicate exploitation attempts.

Compensating Controls: Disable remote management of the router and ensure the web interface is only accessible from the local network.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 4, 2026, there is no public information indicating active exploitation. However, buffer overflows in D-Link routers are frequently exploited by automated botnets.

Analyst Recommendation

D-Link routers are common targets for automated attacks. It is critical to apply the latest firmware updates immediately. If the device is no longer supported by the vendor, it should be decommissioned and replaced with a modern, supported alternative to mitigate the risk of remote takeover.

---METADATA---
VENDOR: Code-Projects
PRODUCT: Scholars Tracking System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Scholars Tracking System 1.0 is vulnerable to unauthenticated SQL injection in its admin user management endpoints.

Executive Summary:
The Scholars Tracking System 1.0 contains a critical SQL injection vulnerability allowing unauthenticated attackers to manipulate database records.

Vulnerability Details

CVE-ID: CVE-2025-70152

Affected Software: Code-Projects Scholars Tracking System

Affected Versions: 1.0

Vulnerability: The application fails to perform authentication checks and sanitization on POST parameters (firstname, lastname, username, password, user_id) in /admin/save_user.php and /admin/update_user.php, facilitating unauthenticated SQL injection.

Business Impact

This flaw permits an unauthenticated attacker to bypass authentication, modify administrative accounts, or extract sensitive data from the database. With a CVSS score of 9.8, the vulnerability poses a severe risk of total application compromise and unauthorized access to student/user records.

Remediation Plan

Immediate Action: Since no official patch is available, immediately restrict access to the /admin/ directory via network-level controls or web server authentication.

Proactive Monitoring: Review database query logs for unusual syntax or unauthorized modifications to user tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to block malicious traffic targeting the vulnerable PHP endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

Given the lack of a vendor patch, this software should be considered insecure for production use. If continued use is required, administrators must implement strict network-level isolation and monitor for signs of unauthorized database manipulation.

---METADATA---
VENDOR: CodeAstro
PRODUCT: Membership Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The CodeAstro Membership Management System 1.0 contains a missing authentication flaw allowing unauthenticated deletion of records.

Executive Summary:
The CodeAstro Membership Management System 1.0 is susceptible to unauthenticated record deletion due to missing access controls.

Vulnerability Details

CVE-ID: CVE-2025-70150

Affected Software: CodeAstro Membership Management System

Affected Versions: 1.0

Vulnerability: The delete_members.php file lacks necessary authentication checks, permitting unauthenticated attackers to delete arbitrary member records by manipulating the id parameter.

Business Impact

This vulnerability allows for unauthorized data destruction, which can lead to significant operational disruption and loss of data integrity. With a CVSS score of 9.8, the potential for an attacker to wipe the entire membership database is high, causing severe reputational damage and data loss.

Remediation Plan

Immediate Action: Because no patch is currently available, disable the delete_members.php functionality or restrict access to the application via IP whitelisting.

Proactive Monitoring: Monitor application logs for frequent or unauthorized requests to delete_members.php and track sudden drops in database record counts.

Compensating Controls: Implement an authentication wrapper or reverse proxy requiring valid credentials before allowing any requests to reach the administration scripts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Feb 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible.

Analyst Recommendation

The absence of authentication on destructive administrative functions renders this software highly vulnerable to malicious activity. Organizations currently utilizing this system must apply manual access restrictions immediately, as no official vendor patch is available to remediate the root cause.

---METADATA---
VENDOR: CodeAstro
PRODUCT: Membership Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
CodeAstro Membership Management System 1.0 is vulnerable to unauthenticated SQL injection in print_membership_card.php via the ID parameter.

Executive Summary:
A critical SQL injection vulnerability in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-70149

Affected Software: CodeAstro Membership Management System

Affected Versions: 1.0

Vulnerability: This is an unauthenticated SQL injection vulnerability located within the 'print_membership_card.php' script. An attacker can manipulate the 'ID' parameter to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation allows an unauthenticated remote attacker to extract sensitive user data, modify database contents, or potentially gain full control over the application backend. With a CVSS score of 9.8, this flaw represents an extreme risk to data confidentiality, integrity, and availability, likely resulting in significant regulatory and reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently listed, users should immediately restrict access to the 'print_membership_card.php' file or disable the affected functionality.

Proactive Monitoring: Monitor database query logs for anomalous patterns, specifically looking for SQL syntax characters or unexpected union-based queries originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block SQL injection patterns targeting the 'ID' parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository is available on GitHub.

Analyst Notes: As of Feb 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the injection vector makes this highly susceptible to automated exploitation.

Analyst Recommendation

Given the critical severity and the availability of public exploit code, organizations using CodeAstro Membership Management System 1.0 must take immediate action to isolate the vulnerable component. Until the vendor provides a formal security update, the risk of data exfiltration remains high and requires active mitigation strategies.

---METADATA---
VENDOR: ProjectWorlds
PRODUCT: Online Time Table Generator
AFFECTED_VERSIONS: 1.0
---END_METADATA---

Description Summary:
Missing authentication in administrative scripts of the Online Time Table Generator allows unauthenticated attackers to perform unauthorized data operations via direct HTTP requests.

Executive Summary:
Unauthenticated attackers can gain full administrative control over the ProjectWorlds Online Time Table Generator due to missing session validation on critical management endpoints.

Vulnerability Details

CVE-ID: CVE-2025-70146

Affected Software: ProjectWorlds Online Time Table Generator

Affected Versions: 1.0

Vulnerability: Several administrative scripts located under the /admin/ directory fail to verify if a user is logged in. This allows an unauthenticated remote attacker to add, delete, or modify records by sending direct HTTP requests to these endpoints.

Business Impact

The lack of authentication leads to a complete loss of data integrity and availability. Attackers can wipe schedules, inject malicious data, or disrupt the primary function of the application. The CVSS score of 9.1 reflects the high impact of unauthorized administrative access.

Remediation Plan

Immediate Action: Update the software to the latest version or manually implement session checks at the beginning of every script within the /admin/ directory.

Proactive Monitoring: Audit web server access logs for requests to /admin/ endpoints that do not originate from authorized IP addresses or lack associated session cookies.

Compensating Controls: Use a reverse proxy or web server configuration to restrict access to the /admin/ directory to a specific whitelist of internal IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation. However, the simplicity of exploiting missing authentication makes this a high-risk vulnerability for any internet-facing deployment.

Analyst Recommendation

Authentication bypasses on administrative interfaces are severe security failures. We recommend an immediate review of all administrative scripts to ensure robust session validation is enforced, alongside restricting network access to the management portal.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Customer Support System
AFFECTED_VERSIONS: 1.0
---END_METADATA---

Description Summary:
SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php, allowing unauthenticated attackers to invoke administrative methods and delete or modify records.

Executive Summary:
Unauthenticated attackers can gain full administrative control over the SourceCodester Customer Support System 1.0, enabling the deletion of the admin account and unauthorized data modification.

Vulnerability Details

CVE-ID: CVE-2025-70141

Affected Software: SourceCodester Customer Support System

Affected Versions: 1.0

Vulnerability: The ajax.php dispatcher fails to enforce any authentication or authorization checks before calling methods in admin_class.php. This allows an unauthenticated remote attacker to trigger actions intended only for administrators, such as creating or deleting users, tickets, and departments.

Business Impact

With a CVSS score of 9.4, this vulnerability represents a critical threat to business operations. An attacker can effectively lock out legitimate administrators by deleting their accounts and can destroy or alter customer support records, leading to significant data loss, operational disruption, and reputational damage.

Remediation Plan

Immediate Action: Update to the latest version of the software or manually implement authentication checks within the ajax.php dispatcher to validate user sessions before processing requests.

Proactive Monitoring: Review database logs for unauthorized deletions or modifications of user accounts and support tickets.

Compensating Controls: Place the application behind a Web Application Firewall (WAF) and restrict access to the ajax.php endpoint to authenticated sessions only using custom rules.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 18, 2026, there is no public information indicating active exploitation of this vulnerability. Because this software is often used as a template or in small-scale environments, it may be targeted by script kiddies looking for easy access control bypasses.

Analyst Recommendation

The lack of access control on an administrative dispatcher is a fundamental security failure. Immediate remediation is required to protect the integrity of the support system. If a vendor patch is unavailable, developers should immediately wrap the ajax.php logic in a robust authentication check.

---METADATA---
VENDOR: OpenSourcePOS
PRODUCT: OpenSourcePOS
AFFECTED_VERSIONS: v3 (See vendor advisory for specific sub-versions)
---END_METADATA---

Description Summary:
OpenSourcePOS v3 is affected by a security vulnerability that could compromise the integrity of point-of-sale operations and sensitive retail data.

Executive Summary:
A high-severity vulnerability in OpenSourcePOS v3 risks unauthorized access to retail transaction data and system configurations, potentially impacting business continuity.

Vulnerability Details

CVE-ID: CVE-2025-70093

Affected Software: OpenSourcePOS

Affected Versions: v3

Vulnerability: This entry identifies a high-severity security issue within the OpenSourcePOS version 3 architecture. The flaw likely relates to improper input validation or session management, potentially allowing an attacker to interact with the POS database or administrative interface.

Business Impact

A successful exploit could result in the theft of customer transaction records, modification of inventory data, or unauthorized financial adjustments. With a CVSS score of 7.4, the impact is significant, potentially leading to financial loss, regulatory non-compliance, and severe damage to customer trust.

Remediation Plan

Immediate Action: Update OpenSourcePOS to the latest patched version of the v3 branch or migrate to a supported version as recommended by the vendor.

Proactive Monitoring: Audit database transaction logs for unusual patterns and monitor administrative login attempts for brute-force or unauthorized access signatures.

Compensating Controls: Ensure the POS system is behind a restrictive firewall and implement strong multi-factor authentication for all administrative access.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, POS systems are frequent targets for financial gain, increasing the likelihood of targeted attacks.

Analyst Recommendation

Given the sensitive nature of point-of-sale data, organizations running OpenSourcePOS v3 must apply available patches immediately. We recommend a full audit of the POS environment to ensure no unauthorized changes have occurred prior to patching.

---METADATA---
VENDOR: Lantronix
PRODUCT: EDS3000PS
AFFECTED_VERSIONS: v3.1.0.0R2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in the Lantronix EDS3000PS ltrx_evo component allows unauthenticated attackers to execute arbitrary code and retrieve sensitive information.

Executive Summary:
A critical remote code execution vulnerability in the Lantronix EDS3000PS allows unauthenticated attackers to execute arbitrary commands and exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-70082

Affected Software: Lantronix EDS3000PS

Affected Versions: v3.1.0.0R2

Vulnerability: The flaw exists within the ltrx_evo component and permits unauthenticated remote attackers to execute arbitrary system code. This vulnerability allows for a complete compromise of the device's security posture.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code presents a catastrophic risk, including the potential for full system takeover, lateral movement within the network, and the theft of sensitive operational data. The 9.8 CVSS score reflects the high severity of a remote, unauthenticated RCE condition.

Remediation Plan

Immediate Action: Users should consult the vendor's security advisory (ICSA-26-069-02) to verify the availability of a firmware update and apply it immediately.

Proactive Monitoring: Continuously monitor device performance and system logs for unexpected processes or unauthorized connections originating from the device.

Compensating Controls: If a patch is not yet available, isolate the device from external networks using a segmented VLAN and ensure it is not accessible via the public internet.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Due to the critical severity and the potential for remote code execution, this device must be treated as a high-risk asset. Administrators must prioritize applying vendor-issued patches as soon as they are made available to prevent exploitation of this RCE vulnerability.

---METADATA---
VENDOR: Gen Digital
PRODUCT: Avast Antivirus
AFFECTED_VERSIONS: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.
---END_METADATA---

Description Summary:
A heap buffer out-of-bounds read vulnerability in Avast Antivirus during the scanning of malformed Windows PE files with .NET metadata may cause local code execution or denial-of-service.

Executive Summary:
A heap-based buffer over-read vulnerability in Gen Digital security software could be leveraged by an attacker to crash the antivirus service or potentially execute unauthorized code.

Vulnerability Details

CVE-ID: CVE-2025-7008

Affected Software: Gen Digital Avast Antivirus

Affected Versions: Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310.

Vulnerability: This vulnerability involves a heap buffer out-of-bounds read occurring when the antivirus engine scans malformed Windows PE files containing .NET metadata. The flaw is present within the shared virus definition scanning logic.

Business Impact

The vulnerability carries a CVSS score of 7.8, indicating a high level of risk. An attacker can exploit this flaw to induce a denial-of-service by crashing the security agent, effectively blinding the host to further threats, or potentially gain unauthorized code execution. The impact is significant as it undermines the integrity of the primary security defense on the affected endpoints.

Remediation Plan

Immediate Action: Deploy virus definition update VPS 25021310 or newer to all affected systems.

Proactive Monitoring: Review security agent logs for recurring process failures or unexpected service restarts.

Compensating Controls: Utilize application allow-listing and EDR monitoring to detect and block the execution of malformed or suspicious PE files while updates are being deployed.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should ensure that the update cycle for virus definitions is strictly enforced. Because this vulnerability exists within the scanning engine itself, standard security posture is insufficient without the specific patch provided in the latest virus definition build.