---METADATA---
VENDOR: Color
PRODUCT: Color Notes
AFFECTED_VERSIONS: 1.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Color Notes 1.4 is vulnerable to a memory allocation flaw, allowing an unauthenticated attacker to trigger a denial-of-service condition.

Executive Summary:
A memory allocation vulnerability in Color Notes 1.4 exposes the application to potential denial-of-service attacks by unauthenticated remote actors.

Vulnerability Details

CVE-ID: CVE-2021-47969

Affected Software: Color Color Notes

Affected Versions: 1.4

Vulnerability: This vulnerability (CWE-789) involves memory allocation with an excessive size value. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that the vulnerability is exploitable by an unauthenticated attacker over the network without requiring user interaction.

Business Impact

Successful exploitation results in a denial-of-service (DoS) condition, potentially rendering the Color Notes application unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw threatens business continuity by disrupting service availability and requiring manual intervention to restore system stability.

Remediation Plan

Immediate Action: Since a specific patch is not identified, administrators should monitor vendor channels for security updates and restrict network access to the affected service where possible.

Proactive Monitoring: Review system logs for unusual memory usage spikes or repeated service crashes that may indicate an ongoing exploitation attempt.

Compensating Controls: Implement rate limiting or request size restrictions at the Web Application Firewall (WAF) or load balancer level to prevent malformed requests from reaching the application core.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input validation on memory allocation requests.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, organizations running Color Notes 1.4 must prioritize defensive measures. We recommend restricting access to the application and applying any vendor-supplied patches the moment they become available to eliminate the underlying memory exhaustion risk.

---METADATA---
VENDOR: Timeclock
PRODUCT: PHP Timeclock
AFFECTED_VERSIONS: 1.04
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
PHP Timeclock 1.04 is vulnerable to SQL Injection, allowing an unauthenticated attacker to execute arbitrary SQL commands via the login interface.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHP Timeclock 1.04 allows attackers to potentially compromise database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2021-47966

Affected Software: Timeclock PHP Timeclock

Affected Versions: 1.04

Vulnerability: This is an SQL Injection (CWE-89) vulnerability. The application fails to properly sanitize user input in the login module, allowing an unauthenticated attacker to inject malicious SQL commands.

Business Impact

With a CVSS score of 8.2, this vulnerability is severe. Successful exploitation could allow an attacker to bypass authentication, extract sensitive user information, or modify database contents, leading to a total loss of confidentiality for the application's user base.

Remediation Plan

Immediate Action: Upgrade to the latest secure version if available; otherwise, restrict access to the login interface via network-level controls.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected commands, or large data exports, which are characteristic of SQL injection attempts.

Compensating Controls: Implement a WAF with SQL injection detection rules to filter malicious payloads from incoming HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49849).

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication.

Analyst Recommendation

The presence of a public exploit significantly increases the risk of this vulnerability. Administrators must treat this as a high-priority item and ensure that the application is either patched or isolated from public-facing networks until a fix is confirmed.

---METADATA---
VENDOR: WordPress
PRODUCT: WP Super Edit
AFFECTED_VERSIONS: 2.5.4 and earlier
---END_METADATA---

Description Summary:
The WP Super Edit plugin for WordPress contains an unrestricted file upload vulnerability in the FCKeditor component, enabling remote code execution.

Executive Summary:
An unrestricted file upload vulnerability in the WordPress WP Super Edit plugin allows attackers to achieve remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47965

Affected Software: WordPress Plugin WP Super Edit

Affected Versions: 2.5.4 and earlier

Vulnerability: The plugin's FCKeditor component lacks validation for uploaded file types, allowing an attacker to upload malicious scripts directly to the server.

Business Impact

Successful exploitation allows an attacker to gain complete control over the WordPress site, leading to potential data exfiltration, malware distribution, and site defacement. The CVSS score of 9.8 signifies the highest level of risk.

Remediation Plan

Immediate Action: Update WP Super Edit to the latest available version; if no patch is available, remove the plugin entirely.

Proactive Monitoring: Scan the WordPress uploads directory for suspicious files (e.g., .php, .phtml) and review server access logs for unusual POST requests.

Compensating Controls: Use security plugins to disable file uploads or enforce strict directory permissions that prevent script execution in upload folders.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that directly facilitates remote code execution. Administrators are strongly advised to update or uninstall the vulnerable plugin immediately to secure the environment.

---METADATA---
VENDOR: Schlix
PRODUCT: Schlix CMS
AFFECTED_VERSIONS: 2.2.6-6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Schlix CMS 2.2.6-6 contains a code injection vulnerability in the core block manager, allowing an authenticated attacker with low privileges to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in Schlix CMS 2.2.6-6 allows low-privileged authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2021-47964

Affected Software: Schlix Schlix CMS

Affected Versions: 2.2.6-6

Vulnerability: This is a Code Injection (CWE-94) vulnerability located in the application's core block manager. It requires an attacker to have authenticated with low privileges to trigger the execution of arbitrary code on the server.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the entire server environment. An attacker achieving remote code execution can gain full control over the web server, leading to complete system compromise, lateral movement, and data exfiltration.

Remediation Plan

Immediate Action: Update Schlix CMS to the latest version. If an update is not available, disable the affected block manager functionality.

Proactive Monitoring: Audit server logs for unauthorized process execution, suspicious file modifications, or unexpected outbound network connections.

Compensating Controls: Use a WAF to block requests that contain patterns associated with code injection or attempt to access restricted block manager files.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49838).

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to the potential for full system takeover.

Analyst Recommendation

Due to the high CVSS score and the availability of a public exploit, immediate action is required. Organizations must restrict administrative access and apply patches immediately to prevent unauthorized code execution and full system compromise.

---METADATA---
VENDOR: AnotherNote
PRODUCT: Anote
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Anote 1.0 contains a persistent cross-site scripting (XSS) vulnerability that allows authenticated users to execute arbitrary scripts in the context of other users.

Executive Summary:
A persistent cross-site scripting flaw in Anote 1.0 allows authenticated attackers to perform unauthorized actions by injecting malicious scripts into the application.

Vulnerability Details

CVE-ID: CVE-2021-47963

Affected Software: AnotherNote Anote

Affected Versions: 1.0

Vulnerability: The software fails to properly neutralize user-supplied input, leading to persistent XSS (CWE-79). The CVSS vector (PR:L/UI:P) indicates that successful exploitation requires an authenticated user with low privileges and user interaction, such as clicking a malicious link or viewing compromised content.

Business Impact

This vulnerability enables attackers to hijack user sessions, steal sensitive session cookies, or perform unauthorized actions on behalf of legitimate users. While the CVSS score of 7.2 reflects high severity, the requirement for authentication limits the initial attack surface, though the impact on user privacy and data integrity remains significant.

Remediation Plan

Immediate Action: Identify and sanitize all user-controlled inputs within the application to prevent script execution; monitor vendor updates for a formal patch.

Proactive Monitoring: Inspect web access logs for suspicious script injection patterns or unusual redirects occurring within the application's user interface.

Compensating Controls: Deploy a WAF with strict XSS filtering rules to detect and block malicious payloads in HTTP requests before they reach the backend database.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for the persistent execution of arbitrary code within the browser of victims.

Analyst Recommendation

Users of Anote 1.0 should restrict administrative access and implement strict Content Security Policies (CSP) to mitigate the impact of potential XSS attacks. Immediate application of vendor-provided security patches is required as soon as they are released to permanently address the underlying input validation deficiency.

---METADATA---
VENDOR: WordPress
PRODUCT: WPGraphQL
AFFECTED_VERSIONS: 1.3.5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The WordPress plugin WPGraphQL 1.3.5 is susceptible to a denial-of-service vulnerability due to improper resource allocation limits.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in WordPress plugin WPGraphQL 1.3.5 allows remote attackers to cause a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2021-47959

Affected Software: WordPress WPGraphQL

Affected Versions: 1.3.5

Vulnerability: This vulnerability (CWE-770) occurs because the plugin fails to properly limit or throttle resource allocation. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that the attack is fully automatable and requires no authentication or user interaction to execute.

Business Impact

By overwhelming the system with resource-intensive requests, an attacker can crash the plugin or the underlying WordPress site, leading to significant downtime. Given the 7.5 CVSS score, this represents a critical risk to business availability, particularly for high-traffic websites that rely on WPGraphQL for data integration.

Remediation Plan

Immediate Action: Disable the WPGraphQL plugin if it is not strictly required for site functionality until an official patch is released.

Proactive Monitoring: Monitor server resource utilization (CPU/Memory) for sudden spikes and review access logs for high-frequency GraphQL queries from single source IPs.

Compensating Controls: Configure a WAF or API gateway to rate-limit GraphQL queries and block requests that exhibit patterns characteristic of resource exhaustion attempts.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly concerning due to its ability to be triggered remotely without authentication.

Analyst Recommendation

Organizations utilizing WPGraphQL 1.3.5 should exercise extreme caution. Given the availability of a public proof-of-concept and the potential for easy remote exploitation, we strongly recommend disabling the plugin or implementing robust rate-limiting controls to prevent service disruption until a patched version is deployed.

---METADATA---
VENDOR: Egavilanmedia
PRODUCT: PHPCRUD
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Egavilanmedia PHPCRUD 1.0 is vulnerable to SQL injection via the firstname parameter, allowing unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Egavilanmedia PHPCRUD 1.0 allows unauthenticated remote attackers to compromise database confidentiality.

Vulnerability Details

CVE-ID: CVE-2021-47956

Affected Software: Egavilanmedia PHPCRUD

Affected Versions: 1.0

Vulnerability: This is an SQL injection (CWE-89) vulnerability occurring in the application's input handling. The vulnerability is exploitable by unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N), allowing for unauthorized database information disclosure.

Business Impact

Successful exploitation of this vulnerability could lead to significant data exfiltration, as an attacker can manipulate backend database queries. Given the CVSS score of 8.2, this represents a high-severity risk that could result in the compromise of sensitive user information and potential loss of data integrity.

Remediation Plan

Immediate Action: Since no official patch is currently listed, implement input validation and parameterized queries for all database interactions to neutralize the injection vector.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based or error-based SQL injection patterns originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads before they reach the application.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49878).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of sanitization on user-supplied input.

Analyst Recommendation

Given the availability of public exploit code and the ease of exploitation, organizations using Egavilanmedia PHPCRUD must prioritize hardening the application. If the vendor does not provide a patch, consider migrating to a supported CRUD framework or restricting access to the affected instance until a secure update is applied.

---METADATA---
VENDOR: LayerBB
PRODUCT: LayerBB
AFFECTED_VERSIONS: 1.1.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
LayerBB 1.1.4 contains an SQL injection vulnerability in the search query parameter, enabling unauthenticated remote attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in LayerBB 1.1.4 allows unauthenticated remote attackers to bypass security controls and access backend database contents.

Vulnerability Details

CVE-ID: CVE-2021-47954

Affected Software: LayerBB LayerBB

Affected Versions: 1.1.4

Vulnerability: This is an SQL injection (CWE-89) vulnerability where the search query parameter fails to properly neutralize special elements. The vulnerability is accessible to unauthenticated attackers (AV:N/AC:L/PR:N/UI:N), significantly increasing the potential attack surface.

Business Impact

The ability for an unauthenticated attacker to inject SQL commands poses a severe threat to the confidentiality of the application's database. With a CVSS score of 8.2, this vulnerability could result in unauthorized access to sensitive user data, intellectual property, or administrative credentials stored within the database.

Remediation Plan

Immediate Action: Apply vendor security updates immediately if available; otherwise, implement strict input sanitization on all search parameters.

Proactive Monitoring: Review application logs for suspicious search strings containing SQL syntax or special characters indicative of injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious search queries that contain SQL injection payloads.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49593).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible, making it a prime target for automated scanning tools.

Analyst Recommendation

The presence of a public exploit increases the urgency of this remediation. System administrators must monitor for anomalous traffic directed at the search functionality and ensure that all input fields are properly sanitized to prevent unauthorized database access.

---METADATA---
VENDOR: Python
PRODUCT: jsonpickle
AFFECTED_VERSIONS: 2.0.0
---END_METADATA---

Description Summary:
The python jsonpickle library contains a remote code execution vulnerability via deserialization of malicious JSON payloads containing py/repr objects.

Executive Summary:
A critical remote code execution vulnerability in python jsonpickle 2.0.0 allows unauthenticated attackers to execute arbitrary system commands via malicious JSON payloads.

Vulnerability Details

CVE-ID: CVE-2021-47952

Affected Software: Python jsonpickle

Affected Versions: 2.0.0

Vulnerability: This is a deserialization vulnerability where the library fails to safely handle py/repr objects. An unauthenticated attacker can craft a JSON payload that triggers the execution of arbitrary Python commands during the deserialization process.

Business Impact

Successful exploitation allows for complete system compromise, enabling attackers to execute arbitrary code with the privileges of the application process. Given the critical CVSS score of 9.8, this flaw presents an extreme risk of data exfiltration, ransomware deployment, or total service disruption.

Remediation Plan

Immediate Action: Upgrade to the latest version of jsonpickle where this deserialization flaw is addressed.

Proactive Monitoring: Audit application logs for suspicious inbound JSON payloads containing "py/repr" or "eval" keywords.

Compensating Controls: Ensure that the application does not deserialize untrusted or user-supplied JSON data without strict validation and sanitization.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe security risk due to the potential for full remote code execution. Organizations utilizing jsonpickle must prioritize updating to a patched version immediately to prevent unauthorized system access and potential compromise of the host environment.

---METADATA---
VENDOR: CyberPanel
PRODUCT: CyberPanel
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been identified in CyberPanel 2 that could permit unauthorized system access.

Executive Summary:
A critical-level vulnerability in CyberPanel 2 threatens the security and control of the hosting management environment.

Vulnerability Details

CVE-ID: CVE-2021-47949

Affected Software: CyberPanel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in the management interface, potentially allowing for unauthorized execution of commands or administrative access.

Business Impact

CyberPanel provides comprehensive control over web hosting environments. A CVSS score of 8.8 implies that a successful exploit could result in full server compromise, impacting all hosted websites and databases managed by the panel.

Remediation Plan

Immediate Action: Update CyberPanel to the latest version immediately to mitigate the risk of unauthorized access.

Proactive Monitoring: Check system logs for unauthorized command execution or unusual administrative activity.

Compensating Controls: Restrict access to the CyberPanel port to trusted management IPs and ensure all services are behind a robust firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CyberPanel administrators must act immediately to apply the latest security updates. Compromise of a hosting control panel is a severe incident that can affect multiple hosted services.

---METADATA---
VENDOR: Argus
PRODUCT: Surveillance DVR
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been discovered in the Argus Surveillance DVR, potentially allowing unauthorized access to video feeds or system settings.

Executive Summary:
A high-severity vulnerability in the Argus Surveillance DVR could allow unauthorized access to physical security monitoring systems.

Vulnerability Details

CVE-ID: CVE-2021-47945

Affected Software: Argus Surveillance DVR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the remote management and viewing interface, potentially allowing an unauthenticated attacker to bypass security controls.

Business Impact

Surveillance systems are critical for physical security. A CVSS score of 7.8 indicates that a compromise could lead to unauthorized viewing of sensitive areas, disruption of security monitoring, or the use of the DVR as a beachhead for further network exploitation.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unusual access to the DVR's web interface or management ports.

Compensating Controls: Isolate the DVR on a dedicated network segment and disable remote access via the internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately secure their surveillance infrastructure by applying the latest firmware patches. Access to these devices should be strictly limited to prevent exploitation.

---METADATA---
VENDOR: memono
PRODUCT: Notepad
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in memono Notepad 4 that requires investigation and remediation.

Executive Summary:
A critical security vulnerability has been identified in memono Notepad 4, potentially allowing for unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2021-47944

Affected Software: memono Notepad

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within the Notepad 4 application. Due to the lack of detailed disclosure, the specific attack vector remains unclear, though such flaws often involve improper input validation or memory handling.

Business Impact

With a CVSS score of 7.5, this vulnerability is classified as High severity. Exploitation could lead to unauthorized access or system instability, potentially resulting in the compromise of locally stored sensitive documents or disruption of administrative workflows.

Remediation Plan

Immediate Action: Consult the official memono security portal to identify and apply the latest security patches or version updates.

Proactive Monitoring: Review system and application access logs for any unusual process execution or unauthorized file access attempts.

Compensating Controls: Restrict application execution privileges and ensure that the software is running within a hardened environment with minimal user permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize identifying if this software is deployed within their environment. Apply all vendor-recommended updates immediately to mitigate potential risks associated with this vulnerability.

---METADATA---
VENDOR: Textpattern
PRODUCT: TextPattern CMS
AFFECTED_VERSIONS: 4.8.7
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
TextPattern CMS 4.8.7 is vulnerable to unrestricted file uploads, allowing an authenticated attacker to execute arbitrary code on the server.

Executive Summary:
An unrestricted file upload vulnerability in TextPattern CMS 4.8.7 enables remote code execution by authenticated users.

Vulnerability Details

CVE-ID: CVE-2021-47943

Affected Software: Textpattern TextPattern CMS

Affected Versions: 4.8.7

Vulnerability: This vulnerability involves unrestricted file uploads (CWE-434), which can be leveraged by an authenticated user to upload malicious files that are subsequently executed by the server.

Business Impact

Exploitation of this flaw grants an attacker the ability to execute arbitrary code, which can lead to complete server compromise. Given the 8.8 CVSS score, this risk includes total loss of confidentiality, integrity, and availability for the affected web application.

Remediation Plan

Immediate Action: Update to the latest version of TextPattern CMS that addresses this file upload vulnerability. If an update is unavailable, restrict file upload permissions and validate file types rigorously at the application level.

Proactive Monitoring: Inspect web server logs for suspicious file upload activity or requests to non-media file types within upload directories.

Compensating Controls: Use a WAF to inspect incoming file uploads and block files with dangerous extensions or signatures.

Exploitation Status

Public Exploit Available: Yes — multiple entries exist on ExploitDB.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The existence of multiple public exploits makes this a high-priority target for automated and manual exploitation.

Analyst Recommendation

The combination of the high severity score and the availability of multiple public exploits necessitates immediate action. Administrators should upgrade to a secure version immediately and audit the file system for any unauthorized files that may have already been uploaded.

---METADATA---
VENDOR: Home Assistant
PRODUCT: Community Store (HACS)
AFFECTED_VERSIONS: 0 up to 1.10.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Home Assistant Community Store (HACS) prior to 1.10.0 is vulnerable to a path traversal attack, allowing unauthenticated remote attackers to read arbitrary files.

Executive Summary:
A path traversal vulnerability in Home Assistant Community Store (HACS) versions before 1.10.0 permits unauthenticated attackers to access sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2021-47942

Affected Software: Home Assistant Community Store (HACS)

Affected Versions: 0 up to (excluding) 1.10.0

Vulnerability: This is a path traversal (CWE-22) vulnerability that allows for unauthorized file access by manipulating pathnames. The vulnerability is exploitable by unauthenticated attackers (AV:N/AC:L/PR:N/UI:N), which could lead to full account takeover or sensitive configuration disclosure.

Business Impact

The impact of this path traversal is severe, as it allows attackers to read arbitrary files from the server, potentially including sensitive credentials or configuration files. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the Home Assistant deployment.

Remediation Plan

Immediate Action: Update the Home Assistant Community Store (HACS) integration to version 1.10.0 or later immediately.

Proactive Monitoring: Inspect server logs for file access attempts containing directory traversal sequences such as "../" or "/etc/passwd".

Compensating Controls: Use file system permissions to restrict the web server user's access to only the necessary directories, effectively limiting the scope of any potential traversal.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49495).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is straightforward to exploit, necessitating prompt patching.

Analyst Recommendation

Given the potential for account takeover and sensitive data disclosure, immediate upgrading to version 1.10.0 is critical. Administrators should verify the HACS version currently running and ensure the update is applied across all affected installations to eliminate this risk.

---METADATA---
VENDOR: WordPress
PRODUCT: Survey & Poll
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability in the WordPress Plugin Survey & Poll may allow unauthorized access through manipulation of the cookie parameter.

Executive Summary:
A high-severity vulnerability in the Survey & Poll WordPress plugin could allow attackers to bypass security controls via cookie manipulation.

Vulnerability Details

CVE-ID: CVE-2021-47941

Affected Software: WordPress Survey & Poll Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to improper handling of the cookie parameter, which may permit an attacker to bypass authentication or execute unauthorized actions.

Business Impact

Exploitation of this plugin could lead to the compromise of the underlying WordPress installation. A CVSS score of 8.2 justifies immediate action to prevent unauthorized data access, site defacement, or administrative account takeover.

Remediation Plan

Immediate Action: Update the Survey & Poll plugin to the latest vendor-provided version. If no patch is available, disable or remove the plugin immediately.

Proactive Monitoring: Audit WordPress user logs for suspicious account activity or unauthorized administrative actions.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious cookie input and restrict access to administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All WordPress administrators using this plugin must verify their current version and update immediately. If the plugin is no longer maintained, it should be removed to eliminate the attack surface.

---METADATA---
VENDOR: WordPress
PRODUCT: Plugin Download
AFFECTED_VERSIONS: 1.48 and earlier
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in the Plugin Download WordPress plugin allows unauthenticated attackers to upload and execute malicious files via the admin-ajax.php endpoint.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress Plugin Download plugin allows attackers to achieve remote code execution by bypassing file extension restrictions.

Vulnerability Details

CVE-ID: CVE-2021-47940

Affected Software: WordPress Plugin Download

Affected Versions: 1.48 and earlier

Vulnerability: This vulnerability occurs in the AJAX fileupload action. Unauthenticated attackers can manipulate the allowExt parameter to bypass security checks and upload executable PHP shells to the web root.

Business Impact

The CVSS score of 9.8 reflects the high probability of total system compromise. By uploading and executing malicious scripts, an attacker can gain administrative access, steal sensitive configuration data, or use the server as a node for further malicious activities.

Remediation Plan

Immediate Action: Update the Plugin Download plugin to the latest version immediately to ensure file extension validation is correctly enforced.

Proactive Monitoring: Monitor server logs for requests to admin-ajax.php that include the download_from_files_617_fileupload action and investigate any suspicious file modifications in the web root.

Compensating Controls: Configure file system permissions to prevent the web server user from executing files uploaded to the plugin's upload directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides a straightforward path for attackers to gain execution privileges. Organizations must treat this as a high-priority update and verify that the plugin is fully patched to block unauthorized file uploads.

---METADATA---
VENDOR: Evo
PRODUCT: Evolution CMS
AFFECTED_VERSIONS: 3.1.6
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Evolution CMS 3.1.6 contains a code injection vulnerability that allows an authenticated attacker to execute arbitrary code during module creation.

Executive Summary:
An authenticated code injection vulnerability in Evolution CMS 3.1.6 allows attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2021-47939

Affected Software: Evo Evolution CMS

Affected Versions: 3.1.6

Vulnerability: This vulnerability (CWE-94) is triggered during the module creation process. It requires the attacker to hold low-level privileges (PR:L), after which they can inject and execute arbitrary code.

Business Impact

Successful exploitation provides the attacker with a foothold to execute code on the underlying server, which can lead to total system compromise. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and security of the hosting environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Evolution CMS project. Ensure that administrative module creation is restricted to authorized, trusted personnel only.

Proactive Monitoring: Review audit logs for unusual module creation activities or modifications to system files that do not align with expected administrative tasks.

Compensating Controls: Apply WAF rules to block malicious payloads within administrative forms and module creation requests.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains minimal access, making it a critical concern.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize updating their Evolution CMS instances to the latest patched version. Restricting administrative access is a vital interim measure to reduce the attack surface.

---METADATA---
VENDOR: ImpressCMS
PRODUCT: ImpressCMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been identified in ImpressCMS 1 that requires immediate investigation and patching.

Executive Summary:
A critical vulnerability in ImpressCMS 1 could allow remote attackers to execute arbitrary code, threatening the entire web application.

Vulnerability Details

CVE-ID: CVE-2021-47938

Affected Software: ImpressCMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the ImpressCMS platform and relates to improper control of code execution paths. Attackers could potentially trigger this flaw to execute unauthorized code on the server, compromising the integrity of the application.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat. Successful exploitation could result in total system compromise, unauthorized data access, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches or upgrade to a secure version of ImpressCMS immediately.

Proactive Monitoring: Review application logs for unauthorized execution of scripts or abnormal system behavior.

Compensating Controls: Deploy a WAF with rules configured to detect and block common web-based exploit attempts and command injection strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate action. Administrators must prioritize updating ImpressCMS to the latest version to eliminate the risk of remote code execution and protect the underlying infrastructure.

---METADATA---
VENDOR: e107
PRODUCT: e107 CMS
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security vulnerability has been discovered in e107 CMS 2 that could permit unauthorized access or code execution.

Executive Summary:
A high-severity vulnerability in e107 CMS 2 presents a significant risk of remote compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2021-47937

Affected Software: e107 CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the e107 Content Management System. It likely involves improper handling of input at an endpoint, which could be leveraged by an attacker to execute arbitrary code or bypass security controls.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. A successful exploit could lead to full site compromise, defacement, or the theft of user data stored within the CMS database.

Remediation Plan

Immediate Action: Upgrade to the latest stable version of e107 CMS as recommended by the vendor.

Proactive Monitoring: Inspect web server logs for indicators of injection attacks, such as unusual URL parameters or encoded payloads.

Compensating Controls: Use a Web Application Firewall (WAF) to block known attack patterns and malicious input signatures targeting CMS platforms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CMS vulnerabilities are frequent targets for automated exploitation. It is imperative to verify the current version of your e107 installation and apply the latest security patches immediately to secure the platform against potential attackers.

---METADATA---
VENDOR: OpenCATS
PRODUCT: OpenCATS
AFFECTED_VERSIONS: 0.9.4
---END_METADATA---

Description Summary:
A remote code execution vulnerability in OpenCATS allows unauthenticated attackers to execute arbitrary system commands by uploading malicious PHP files as resume attachments.

Executive Summary:
An unauthenticated remote code execution vulnerability in OpenCATS allows attackers to gain full control of the server via malicious file uploads disguised as resumes.

Vulnerability Details

CVE-ID: CVE-2021-47936

Affected Software: OpenCATS

Affected Versions: 0.9.4

Vulnerability: This is a remote code execution vulnerability occurring at the careers job application endpoint. Unauthenticated attackers can upload PHP files disguised as resume attachments and execute them by accessing the file path directly.

Business Impact

The CVSS score of 9.8 highlights the critical danger of this vulnerability. Successful exploitation permits attackers to execute system commands, potentially leading to a complete compromise of the underlying host server and access to the applicant database.

Remediation Plan

Immediate Action: Update OpenCATS to the latest version that enforces strict file validation and prevents the execution of uploaded files.

Proactive Monitoring: Check the upload directories for any unexpected PHP files and monitor server access logs for requests targeting these files.

Compensating Controls: Configure the web server to disable script execution in the directory where user-submitted files are stored.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution is among the most severe security risks. Organizations using OpenCATS must apply updates immediately to prevent unauthorized command execution on their servers.

---METADATA---
VENDOR: Sentry
PRODUCT: Sentry
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A vulnerability has been detected in Sentry 8, potentially impacting the monitoring and error-tracking capabilities of the platform.

Executive Summary:
A high-severity security flaw in Sentry 8 poses a risk to the security of the error-tracking and monitoring platform.

Vulnerability Details

CVE-ID: CVE-2021-47935

Affected Software: Sentry

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of Sentry 8, potentially allowing an attacker to manipulate error data or gain unauthorized access.

Business Impact

Sentry is a critical tool for monitoring application health and security. A CVSS score of 8.8 indicates a major security risk; if compromised, an attacker could gain insight into application vulnerabilities or administrative access to the monitoring infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest supported version of Sentry to remediate the vulnerability.

Proactive Monitoring: Monitor Sentry logs for suspicious administrative actions or unauthorized modifications to error reporting configurations.

Compensating Controls: Use strict network segmentation to ensure the Sentry instance is only accessible by authorized systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of Sentry in application oversight, this update should be treated with high urgency. Ensure that all instances of Sentry are updated to the latest version to maintain platform integrity.

---METADATA---
VENDOR: WordPress
PRODUCT: MStore API
AFFECTED_VERSIONS: 2.0.6
---END_METADATA---

Description Summary:
An arbitrary file upload vulnerability in the MStore API allows unauthenticated attackers to execute malicious code on the host server via the REST API.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress MStore API enables remote code execution, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2021-47933

Affected Software: WordPress MStore API

Affected Versions: 2.0.6

Vulnerability: This is an unauthenticated arbitrary file upload vulnerability within the REST API endpoint. Attackers can submit crafted POST requests to the config_file endpoint to upload malicious PHP files and execute arbitrary code.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of full system compromise. Successful exploitation grants attackers remote code execution capabilities, allowing for complete control over the web server, data exfiltration, and the ability to pivot into the internal network.

Remediation Plan

Immediate Action: Update the MStore API to the latest patched version available from the vendor.

Proactive Monitoring: Inspect the web server's upload directories and system logs for unexpected PHP files or unauthorized POST requests targeting the REST API.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing executable file extensions directed at the REST API endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The critical nature of this remote code execution vulnerability requires immediate attention. Administrators must verify their MStore API version and apply updates immediately to prevent potential server takeover.

---METADATA---
VENDOR: WordPress
PRODUCT: TheCartPress
AFFECTED_VERSIONS: 1.5.3.6
---END_METADATA---

Description Summary:
An unauthenticated privilege escalation vulnerability in TheCartPress WordPress plugin allows attackers to create new administrative accounts via the AJAX handler.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the WordPress TheCartPress plugin allows attackers to gain full administrative control by injecting unauthorized user registration requests.

Vulnerability Details

CVE-ID: CVE-2021-47932

Affected Software: WordPress TheCartPress

Affected Versions: 1.5.3.6

Vulnerability: This is an unauthenticated privilege escalation vulnerability in the tcp_register_and_login_ajax action. Attackers can send crafted POST requests to the AJAX handler with the tcp_role parameter set to "administrator" to create an illicit admin account.

Business Impact

With a CVSS score of 9.8, this flaw allows for immediate and total takeover of the WordPress installation. An attacker with administrative access can modify site content, install malicious plugins, or access sensitive customer data, leading to severe business and privacy impacts.

Remediation Plan

Immediate Action: Update the TheCartPress plugin to the latest version. If a patch is unavailable, deactivate or remove the plugin until a secure version is released.

Proactive Monitoring: Review the site's user list for any unauthorized administrator accounts created recently and check logs for anomalous AJAX requests.

Compensating Controls: Restrict access to the admin-ajax.php file using server-level configuration or a WAF to prevent unauthorized registrations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical and must be remediated immediately. Administrators should audit all existing administrative users to ensure no accounts have been compromised through this vector.

---METADATA---
VENDOR: Balbooa
PRODUCT: Joomla Forms Builder
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A security flaw in the Balbooa Joomla Forms Builder may allow an attacker to exploit form submission processes.

Executive Summary:
The Balbooa Forms Builder for Joomla contains a high-severity vulnerability that could lead to unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2021-47930

Affected Software: Balbooa Joomla Forms Builder

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves improper input sanitization within the forms builder, potentially allowing for arbitrary data submission or system interaction.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to Joomla-based sites. Compromise could result in unauthorized data collection or, in certain configurations, remote code execution, leading to full site takeover.

Remediation Plan

Immediate Action: Update the Balbooa Forms Builder to the latest version provided by the developer.

Proactive Monitoring: Monitor for anomalous form submission traffic and check web server logs for suspicious activity.

Compensating Controls: Implement a WAF to monitor and block malformed HTTP requests targeting the form builder components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Joomla administrators should verify the status of this plugin and apply updates immediately. Given the high severity, ensure that all third-party components are kept up to date to maintain site security.

---METADATA---
VENDOR: Opencart
PRODUCT: TMD Vendor System
AFFECTED_VERSIONS: opencartextensions Extension TMD Vendor System: 3.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The TMD Vendor System extension for Opencart is vulnerable to an unauthenticated SQL injection, allowing attackers to manipulate database queries via the product route.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Opencart TMD Vendor System extension allows remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2021-47928

Affected Software: Opencart TMD Vendor System

Affected Versions: opencartextensions Extension TMD Vendor System: 3.0

Vulnerability: This is a classic SQL injection (CWE-89) flaw where the application fails to properly neutralize special elements in an SQL command. The vulnerability is exploitable by unauthenticated remote attackers via the product route.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.2, this represents a significant risk to the confidentiality and integrity of the e-commerce platform and associated customer data.

Remediation Plan

Immediate Action: Contact the vendor (Opencart Extensions) to verify the availability of a security update; if no patch is available, remove or disable the extension immediately.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION SELECT statements or unexpected error patterns, which may indicate automated scanning or exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules configured to inspect the product route parameters.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 50493).

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication.

Analyst Recommendation

Due to the availability of a public exploit and the high severity of SQL injection vulnerabilities, immediate action is required. Organizations using the Opencart TMD Vendor System should prioritize auditing their installations and applying any available vendor patches or disabling the vulnerable component entirely.

---METADATA---
VENDOR: OpenCart
PRODUCT: OpenCart
AFFECTED_VERSIONS: 3.0.3.8
---END_METADATA---

Description Summary:
A session fixation vulnerability in OpenCart allows attackers to hijack user sessions by forcing the use of a known, malicious session identifier.

Executive Summary:
A session fixation vulnerability in OpenCart enables attackers to hijack active user sessions, leading to unauthorized account access and potential data theft.

Vulnerability Details

CVE-ID: CVE-2021-47923

Affected Software: OpenCart

Affected Versions: 3.0.3.8

Vulnerability: This is a session fixation vulnerability where an attacker can inject arbitrary values into the OCSESSID cookie. By forcing a specific session ID, the attacker can hijack the session of an unsuspecting user once they authenticate.

Business Impact

The CVSS score of 9.8 indicates the high severity of this session hijacking risk. Successful exploitation allows an attacker to impersonate legitimate users, including administrators, leading to unauthorized access to sensitive account information and backend system controls.

Remediation Plan

Immediate Action: Update OpenCart to the latest version and ensure that the application properly regenerates session IDs upon authentication.

Proactive Monitoring: Monitor server logs for abnormal session activity or multiple logins originating from different IP addresses using the same session cookie.

Compensating Controls: Implement strict session management policies, such as limiting the lifetime of session cookies and ensuring they are flagged as Secure and HttpOnly.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Session fixation remains a potent threat to web applications. Administrators are urged to update their OpenCart installations and audit session handling configurations to mitigate this risk.

Executive Summary:
A high-severity vulnerability, identified as CVE-2021-47918, has been discovered in Simple CMS 2. This flaw could allow a remote, unauthenticated attacker to compromise the affected content management system, potentially leading to unauthorized data access, website defacement, or a complete system takeover. Organizations are urged to apply the vendor-provided security updates immediately to mitigate the significant risk of exploitation.

Vulnerability Details

CVE-ID: CVE-2021-47918

Affected Software: Simple Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The specific technical details of this vulnerability have not been publicly disclosed, but its high CVSS score of 8.1 suggests a critical flaw. A vulnerability of this severity in a Content Management System (CMS) typically allows for Remote Code Execution (RCE) or critical SQL Injection. An unauthenticated remote attacker could likely exploit this flaw by sending a specially crafted request to a vulnerable system, requiring no user interaction, to execute arbitrary commands, manipulate the underlying database, or upload malicious files.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have a severe impact on the business, leading to the complete compromise of the public-facing website and its underlying server. Potential consequences include theft of sensitive data (such as customer information or intellectual property), service disruption, significant reputational damage, and financial loss. A compromised web server could also be used as a pivot point for launching further attacks against the internal network, escalating the overall security risk to the organization.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor to all affected systems without delay. After patching, administrators should review web server and application access logs for any signs of compromise or attempted exploitation that may have occurred before the patch was applied.

Proactive Monitoring: Implement continuous monitoring of web server logs, looking for unusual or malformed requests, especially those targeting CMS components. Monitor for unexpected file modifications in the web root directory, suspicious outbound network connections originating from the web server, and the creation of any unauthorized administrative accounts within the CMS.

Compensating Controls: If immediate patching is not feasible, implement the following compensating controls to reduce the risk:

• Place a Web Application Firewall (WAF) in front of the affected application with rules designed to block common attack vectors like RCE and SQLi.
• Restrict access to the CMS administrative portal to trusted IP addresses only.
• Ensure the web server application runs with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of February 2, 2026, there is no known public proof-of-concept exploit code available for this vulnerability, and it is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given the high CVSS score, it is highly probable that threat actors will actively research and develop exploits. The lack of current public exploitation should not diminish the urgency of remediation.

Analyst Recommendation

Due to the high severity (CVSS 8.1) of this vulnerability and the critical role of CMS platforms, we recommend that organizations treat this as a high-priority issue. The potential for a remote, unauthenticated attacker to compromise the system presents a significant risk. All organizations using the affected Simple products must prioritize the immediate application of vendor-supplied security patches to prevent potential exploitation.

Executive Summary:
A high-severity SQL Injection vulnerability, identified as CVE-2021-47915, exists in PHP Melody version 3. This flaw allows an unauthenticated remote attacker to execute arbitrary commands on the application's database, potentially leading to a complete compromise of sensitive data, including user credentials and website content. Due to the public availability of exploit code, immediate remediation is critical to prevent data breaches and system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47915

Affected Software: Melody PHP Melody

Affected Versions: PHP Melody version 3.0 and potentially prior versions. See vendor advisory for specific affected versions.

Vulnerability: This vulnerability is a time-based blind SQL Injection flaw. The article.php script fails to properly sanitize user-supplied input in the p parameter before using it in a SQL query. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing malicious SQL syntax to the vulnerable parameter, allowing them to infer information from the database by observing the time it takes for the server to respond. This can be used to exfiltrate sensitive data, such as usernames and password hashes, from the database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have a significant negative impact on the business. An attacker could exfiltrate the entire database, leading to the theft of sensitive user data, intellectual property, and other confidential information. This could result in severe reputational damage, loss of customer trust, regulatory fines (e.g., GDPR, CCPA), and financial losses associated with incident response and recovery. Furthermore, an attacker could potentially modify or delete website data, causing service disruption and impacting business operations.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. All instances of PHP Melody should be upgraded to a patched version as recommended by the vendor. After patching, it is crucial to review access logs for any signs of exploitation that may have occurred prior to remediation.

Proactive Monitoring: Security teams should actively monitor web server and database logs for suspicious activity. Specifically, look for unusual or malformed requests to article.php that contain SQL keywords (e.g., SELECT, UNION, SLEEP, BENCHMARK) within the p parameter. Implement alerts for multiple failed database queries or queries that exhibit abnormally long response times, which could indicate blind SQL injection attempts.

Compensating Controls: If immediate patching is not feasible, deploy a Web Application Firewall (WAF) with a robust ruleset configured to block SQL injection attacks. Additionally, ensure the database user account associated with the PHP Melody application operates with the principle of least privilege, restricting its permissions to only what is absolutely necessary for the application to function. This can limit the impact of a successful exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of February 2, 2026, multiple proof-of-concept (PoC) exploits are publicly available for this vulnerability. The existence of public exploits lowers the barrier for attackers, making it easy for even less-skilled actors to target vulnerable systems. While this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, the availability of a public exploit significantly increases the likelihood of active exploitation attempts.

Analyst Recommendation

Given the high CVSS score, the unauthenticated nature of the attack, and the public availability of exploit code, this vulnerability poses a critical risk to the organization. We strongly recommend that all affected PHP Melody instances be patched immediately. This vulnerability should be treated as a top priority for remediation. Delaying action exposes the organization to a high probability of a data breach and subsequent operational and financial damages.

Executive Summary:
A high-severity SQL Injection vulnerability has been identified in Mult-E-Cart Ultimate 2 software. This flaw allows a remote, unauthenticated attacker to execute malicious commands on the backend database, potentially leading to a complete compromise of sensitive data, including customer information and financial records. Immediate patching is required to prevent data breaches and maintain system integrity.

Vulnerability Details

CVE-ID: CVE-2021-47909

Affected Software: Mult-E-Cart Ultimate 2

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a classic SQL Injection flaw. An unauthenticated attacker can send a specially crafted request to the index.php page, manipulating the subcat_id parameter with malicious SQL syntax. Due to insufficient input validation, the application directly incorporates this malicious input into a database query, allowing the attacker to execute arbitrary SQL commands against the backend database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.1. Successful exploitation could have severe consequences for the business, including the unauthorized access, modification, or theft of sensitive data such as customer Personally Identifiable Information (PII), credentials, and payment card details. This can lead to significant financial loss, severe reputational damage, and potential regulatory fines for non-compliance with data protection standards like GDPR or PCI-DSS. An attacker could also potentially leverage this access to disrupt business operations by deleting or corrupting critical data.

Remediation Plan

Immediate Action: Apply vendor security updates immediately to patch the vulnerable component. After patching, it is critical to monitor for any ongoing exploitation attempts and conduct a thorough review of web server and database access logs to identify any signs of compromise that may have occurred before the patch was applied.

Proactive Monitoring: Implement robust monitoring of web application traffic. Specifically, look for suspicious GET requests to index.php containing SQL keywords (e.g., UNION, SELECT, ', --) within the subcat_id parameter. Utilize a Web Application Firewall (WAF) to detect and block common SQL injection attack patterns.

Compensating Controls: If immediate patching is not feasible, deploy a WAF with strict rules to filter malicious input targeting the vulnerable subcat_id parameter. Enforce the principle of least privilege by ensuring the web application's database user has the minimum permissions necessary for its operation, thereby limiting the impact of a potential breach.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of February 2, 2026, proof-of-concept (PoC) exploit code for this vulnerability is publicly available. The existence of a public exploit significantly increases the likelihood of attacks by a wide range of threat actors, from automated scanners to targeted attackers. Although not currently listed on the CISA KEV list, its high severity and public exploitability make it an attractive target.

Analyst Recommendation

Given the high CVSS score of 8.1 and the public availability of functional exploit code, this vulnerability presents a critical and immediate risk to the organization. We strongly recommend that the vendor-supplied patch be applied on an emergency basis across all affected systems. Following remediation, a security audit should be conducted to ensure no persistent threats remain from a potential compromise.

Executive Summary:
A high-severity vulnerability exists within PhreeBooks software, allowing an unauthenticated remote attacker to execute arbitrary commands on the underlying database. Successful exploitation could lead to the complete compromise of sensitive data, including financial records and customer information, resulting in significant data breaches and financial loss.

Vulnerability Details

CVE-ID: CVE-2021-47904

Affected Software: PhreeBooks Multiple Products

Affected Versions: PhreeBooks ERP version 5.2.5 and potentially prior versions. See vendor advisory for a complete list.

Vulnerability: This vulnerability is a SQL Injection flaw in the phreebooks.php script. An unauthenticated attacker can send a specially crafted HTTP request to the id parameter of this script. Due to insufficient input validation, the malicious payload is passed directly to the backend database, allowing the attacker to execute arbitrary SQL commands, bypass authentication, and read, modify, or delete any data in the database.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation could lead to the unauthorized access and exfiltration of highly sensitive business data, such as financial statements, customer Personally Identifiable Information (PII), and proprietary company information. The potential consequences include severe reputational damage, direct financial loss from fraud, regulatory penalties for data privacy violations, and significant disruption to business operations that rely on the integrity of the financial data managed by PhreeBooks.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates to all affected PhreeBooks instances without delay. After patching, review web server and database access logs for any indicators of compromise that may have occurred prior to remediation.

Proactive Monitoring: Implement continuous monitoring of web server logs for suspicious requests targeting phreebooks.php, specifically looking for SQL injection syntax (e.g., single quotes, UNION, SELECT, comments) within the id parameter. Monitor database logs for unusual or unauthorized queries originating from the web application's service account. Utilize a Web Application Firewall (WAF) to detect and block SQL injection attempts in real-time.

Compensating Controls: If immediate patching is not feasible, deploy a WAF with strict rules specifically configured to block SQL injection attacks against the PhreeBooks application. Restrict network access to the application, allowing connections only from trusted IP addresses. Ensure the database user account used by the application operates with the principle of least privilege to limit the potential damage of a successful exploit.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of January 25, 2026, proof-of-concept (PoC) exploit code for this vulnerability is widely and publicly available. This lowers the technical skill required for an attacker to target vulnerable systems. Although this CVE is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its high severity and the availability of public exploits make it a prime target for opportunistic and targeted attacks.

Analyst Recommendation

Given the high severity (CVSS 8.8) and the public availability of functional exploit code, this vulnerability poses a critical and immediate risk to the organization. We strongly recommend that the vendor's security updates be applied as a top priority. Until patching is complete, compensating controls must be implemented to mitigate the risk of a data breach. A thorough compromise assessment should also be conducted to identify any potential exploitation that may have already occurred.

Executive Summary:
A high-severity vulnerability has been identified in LiteSpeed Web Server Enterprise 5, posing a significant risk to affected systems. Successful exploitation could allow a remote attacker to compromise the web server, potentially leading to unauthorized code execution, data theft, or complete system takeover. Organizations are urged to apply vendor-supplied security updates immediately to mitigate this critical threat.

Vulnerability Details

CVE-ID: CVE-2021-47903

Affected Software: Web Multiple Products

Affected Versions: LiteSpeed Web Server Enterprise version 5. See vendor advisory for specific affected versions.

Vulnerability: This vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on the target server. The flaw likely exists in a core component responsible for processing incoming web requests. By sending a specially crafted request to a vulnerable LiteSpeed server, an attacker can trigger the vulnerability to gain control over the server process, effectively compromising the entire web application and underlying system.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. Exploitation of this flaw could have severe consequences for the business, including the compromise of sensitive data hosted on the server, such as customer information, financial records, or intellectual property. An attacker could deface the website, cause a denial-of-service condition leading to business disruption and revenue loss, or use the compromised server as a pivot point to launch further attacks against the internal network. The potential for reputational damage and regulatory fines is significant.

Remediation Plan

Immediate Action: The primary remediation is to apply the security updates provided by the vendor immediately. System administrators should prioritize the deployment of these patches across all affected LiteSpeed Web Server instances. After patching, it is crucial to monitor systems for any signs of exploitation attempts that may have occurred prior to the update and to review web server access and error logs for anomalous activity.

Proactive Monitoring: Implement enhanced monitoring on affected servers. Security teams should look for unusual or malformed requests in web server access logs, unexpected outbound network connections from the server, unexplained spikes in CPU or memory utilization, and the presence of suspicious files or processes in the web application's directory.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the risk. These can include deploying a Web Application Firewall (WAF) with virtual patching rules designed to block exploit attempts, restricting access to the server from untrusted IP addresses, and ensuring the web server process runs with the lowest possible privileges to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 25, 2026, there are no public reports of active exploitation in the wild. However, given the high severity score (CVSS 8.8) and the nature of the vulnerability (remote code execution), it is highly likely that threat actors will develop and weaponize an exploit. Organizations should operate under the assumption that an exploit is imminent.

Analyst Recommendation

The high severity of this vulnerability warrants immediate attention and action. Although CVE-2021-47903 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, its potential for enabling remote code execution makes it a critical risk to the organization. We strongly recommend that all available vendor patches are applied on an emergency basis. Until patching is complete, the compensating controls and proactive monitoring detailed above should be implemented to reduce the attack surface and improve detection capabilities.

---METADATA---
VENDOR: maurosoria
PRODUCT: dirsearch
AFFECTED_VERSIONS: 0.4.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Dirsearch 0.4.1 is vulnerable to CSV injection via the --csv-report flag, allowing attackers to inject malicious spreadsheet formulas through redirected server endpoints.

Executive Summary:
A CSV injection vulnerability in Dirsearch 0.4.1 allows attackers to manipulate generated reports, posing a risk to users who process these files in spreadsheet applications.

Vulnerability Details

CVE-ID: CVE-2021-47901

Affected Software: maurosoria dirsearch

Affected Versions: 0.4.1

Vulnerability: This is a CWE-1236 Improper Neutralization of Formula Elements vulnerability. An unauthenticated attacker can craft malicious redirects that, when included in a CSV report, execute arbitrary formulas upon opening the file.

Business Impact

While the technical impact is limited to the client-side manipulation of CSV files, the potential for data exfiltration or unauthorized system interaction via spreadsheet macros is high if the reports are processed by administrative staff. The CVSS score reflects this risk to data integrity within the organization's reporting workflow.

Remediation Plan

Immediate Action: Upgrade to the latest version of dirsearch available from the official repository, as the vendor has addressed this class of vulnerability in subsequent releases.

Proactive Monitoring: Review generated CSV reports for unexpected character sequences (e.g., =, +, -, @) in fields that should contain standard text.

Compensating Controls: Configure spreadsheet software (like Microsoft Excel or LibreOffice) to disable automatic macro execution and display warnings for untrusted external data sources.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (49370).

Analyst Notes: As of Jan 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit increases the likelihood of opportunistic attacks.

Analyst Recommendation

Users of dirsearch version 0.4.1 should update immediately to mitigate the risk of CSV injection. Security teams should ensure that automated reporting workflows are hardened against malicious formula injection by validating input data before report generation.

Executive Summary:
A critical remote code execution vulnerability exists in Gila CMS versions prior to 2.0.0, allowing unauthenticated attackers to gain complete control of the server. By sending a specially crafted web request with malicious code in the HTTP User-Agent header, an attacker can execute arbitrary commands on the system. This can lead to a full system compromise, data theft, and deployment of malware.

Vulnerability Details

CVE-ID: CVE-2021-47900

Affected Software: Gila CMS

Affected Versions: All versions prior to 2.0.0

Vulnerability: The vulnerability is a Remote Code Execution (RCE) flaw that allows an unauthenticated attacker to inject and execute arbitrary PHP code. The flaw exists in how the application processes HTTP headers, specifically the User-Agent header, for requests sent to the admin endpoint. An attacker can craft a request where the User-Agent header contains a malicious PHP payload (e.g., utilizing shell_exec()). When the Gila CMS application logs or processes this header, it improperly executes the embedded PHP code, leading to the execution of system commands with the privileges of the web server process.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, representing a severe risk to the organization. A successful exploit grants an attacker complete control over the affected web server, which can lead to theft of sensitive data, website defacement, service disruption, or the installation of ransomware. The compromised server could also be used as a foothold to launch further attacks against the internal network, escalating the incident's impact. This poses a significant threat to business operations, data confidentiality, and organizational reputation.

Remediation Plan

Immediate Action: The primary remediation is to immediately upgrade all instances of Gila CMS to version 2.0.0 or the latest available version. After patching, it is critical to review web server access logs for any signs of prior exploitation, such as unusual requests to the admin endpoint or suspicious User-Agent strings.

Proactive Monitoring: Implement continuous monitoring of web server access logs, specifically looking for requests with malicious-looking User-Agent strings containing PHP functions like shell_exec(), system(), passthru(), or eval(). Monitor for unexpected outbound network connections from the web server and use file integrity monitoring (FIM) to detect unauthorized changes to application files.

Compensating Controls: If patching is not immediately possible, deploy a Web Application Firewall (WAF) with rules to inspect and block malicious payloads within HTTP headers. Restrict access to the Gila CMS admin endpoint (/admin) to trusted IP addresses only. Ensure the web server process runs with the least privilege necessary to limit the potential impact of a compromise.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of Jan 27, 2026, proof-of-concept (PoC) exploit code is publicly available for this vulnerability. The ease of exploitation (requiring no authentication) and the high impact make it a prime target for opportunistic attackers. Although this CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, any internet-facing, unpatched Gila CMS instance should be considered at immediate risk of compromise.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this unauthenticated remote code execution vulnerability and the public availability of exploit code, immediate action is imperative. Organizations must prioritize patching all vulnerable Gila CMS instances to version 2.0.0 or later without delay. Due to the high likelihood of automated scanning and exploitation, all internet-facing installations should be considered compromised until patched and thoroughly investigated for indicators of compromise.

---METADATA---
VENDOR: Unified Intents AB
PRODUCT: Unified Remote
AFFECTED_VERSIONS: 3.9.0.2463
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Unified Remote contains a remote code execution vulnerability where unauthenticated attackers can send crafted packets to port 9512 to execute arbitrary commands.

Executive Summary:
Unified Remote 3.9.0.2463 is vulnerable to unauthenticated remote code execution, allowing attackers to take full control of the host system.

Vulnerability Details

CVE-ID: CVE-2021-47891

Affected Software: Unified Intents AB Unified Remote

Affected Versions: 3.9.0.2463

Vulnerability: The application lacks proper authentication for critical functions (CWE-306). By sending specially crafted network packets to port 9512, an unauthenticated, remote attacker can trigger command execution on the underlying host.

Business Impact

This is a critical vulnerability that allows for complete system compromise, including the potential for data exfiltration, malware installation, and long-term persistence. With a CVSS score of 9.8, the ability for an unauthenticated attacker to execute arbitrary commands poses an immediate threat to the entire network segment where the software is deployed.

Remediation Plan

Immediate Action: Update Unified Remote to the latest available version provided by the vendor. If an update is not immediately available, disable the service or restrict network access to port 9512 to trusted internal segments only.

Proactive Monitoring: Monitor network traffic for unusual payloads targeting port 9512 and audit system logs for unexpected command execution or process creation.

Compensating Controls: Utilize a firewall to strictly control ingress traffic to the service port, ensuring only authorized management workstations can communicate with the application.

Exploitation Status

Public Exploit Available: Yes — ExploitDB (ID 49587)

Analyst Notes: As of Jan 23, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit in ExploitDB significantly lowers the barrier for attackers to weaponize this flaw.

Analyst Recommendation

The presence of a public exploit combined with the ease of remote code execution makes this a high-urgency issue. Immediate remediation or network isolation is required to prevent potential compromise of systems running the affected version.

Executive Summary:
A high-severity vulnerability has been identified in Textpattern CMS versions prior to 4.0.0, assigned a CVSS score of 8.8. This flaw could allow a remote attacker to compromise the web server, potentially leading to a complete system takeover, data theft, or service disruption. Organizations using affected versions of Textpattern are at significant risk and should apply security updates immediately.

Vulnerability Details

CVE-ID: CVE-2021-47888

Affected Software: prior Multiple Products

Affected Versions: Textpattern versions prior to 4.0.0

Vulnerability: This vulnerability exists within the Textpattern content management system (CMS). Based on the high CVSS score, the flaw likely allows for remote code execution (RCE) or a critical SQL injection. An unauthenticated remote attacker could potentially exploit this by sending a specially crafted request to the affected server, bypassing security controls to execute arbitrary commands, manipulate the database, or upload malicious files. Successful exploitation does not require user interaction or special privileges, making it a critical threat to internet-facing servers.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit could have a severe impact on the business, including the complete compromise of the web server. Potential consequences include theft of sensitive data (such as customer information, credentials, or intellectual property), website defacement, reputational damage, and financial loss. The compromised server could also be used as a pivot point to launch further attacks against the internal network or to host malicious content.

Remediation Plan

Immediate Action: The primary remediation is to apply the vendor-provided security updates to upgrade Textpattern to version 4.0.0 or a later, patched version. All internet-facing systems running the affected software should be prioritized for immediate patching. After patching, it is crucial to review access and error logs for any signs of compromise that may have occurred before the update was applied.

Proactive Monitoring: Security teams should actively monitor web server logs for unusual or malformed requests, particularly those targeting core application files or plugins. Monitor for unexpected processes running on the server, unauthorized file modifications, and suspicious outbound network traffic. Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) systems should be configured with rules to detect potential RCE or SQL injection attempts.

Compensating Controls: If immediate patching is not feasible, implement compensating controls to reduce the risk. Deploy a Web Application Firewall (WAF) with rules designed to block common web attack patterns. Restrict administrative access to the Textpattern backend to trusted IP addresses only. Ensure the web application runs with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of January 25, 2026, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, given the high severity (CVSS 8.8), it is highly probable that proof-of-concept exploits will be developed and released by security researchers or malicious actors. The vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Analyst Recommendation

Given the high CVSS score of 8.8, this vulnerability represents a critical risk to the organization. We strongly recommend that all systems running affected versions of Textpattern be patched immediately without delay. Although there is no evidence of active exploitation at this time, the severity of the vulnerability means that it is a prime target for attackers. Prioritize this patching activity above routine updates to prevent potential server compromise and data breaches.