Description Summary:
The Gotmls Anti-Malware Security and Bruteforce Firewall plugin for WordPress contains a path traversal vulnerability that can be exploited by unauthenticated remote attackers.

Executive Summary:
A path traversal vulnerability in the Gotmls Anti-Malware plugin allows unauthenticated attackers to access sensitive files, posing a critical risk to site security.

Vulnerability Details

CVE-ID: CVE-2021-47977

Affected Software: Gotmls Anti-Malware Security and Bruteforce Firewall

Affected Versions: 0 through 4.20.72

Vulnerability: This is a path traversal vulnerability (CWE-22) that does not require authentication (PR:N). An attacker can supply malicious input to trigger unauthorized file access, bypassing standard security restrictions.

Business Impact

The ability for an unauthenticated attacker to traverse the file system can lead to the exposure of sensitive configuration files, database credentials, or other critical system data. With a CVSS score of 7.5, this vulnerability represents a significant threat to confidentiality and should be addressed as a priority.

Remediation Plan

Immediate Action: Update the plugin to the latest version if available; if an update is not available, immediately deactivate and remove the plugin to prevent exploitation.

Proactive Monitoring: Monitor server logs for suspicious URL patterns containing directory traversal sequences (e.g., "../") directed at the plugin's file structure.

Compensating Controls: Deploy a WAF with rules configured to block common directory traversal strings and unauthorized access attempts to sensitive WordPress core files.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (50107).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of authentication requirements makes this vulnerability highly attractive to automated scanning tools.

Analyst Recommendation

The combination of unauthenticated access and a public exploit necessitates urgent action. Administrators should verify their current version and update or remove the plugin immediately to mitigate the risk of unauthorized file exposure.

Description Summary:
Textpattern CMS contains a Cross-Site Request Forgery (CSRF) vulnerability that can lead to remote code execution when an administrator is tricked into performing a malicious action.

Executive Summary:
A CSRF vulnerability in Textpattern CMS allows an authenticated attacker to achieve remote code execution, creating a critical risk to the entire application.

Vulnerability Details

CVE-ID: CVE-2021-47976

Affected Software: Textpattern CMS

Affected Versions: 4.9.0-dev

Vulnerability: This is a CSRF vulnerability (CWE-352) that, when exploited, allows an authenticated user to perform unauthorized actions such as plugin uploads, leading to Remote Code Execution (RCE). The attack requires the victim to have authenticated privileges to the CMS.

Business Impact

Exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary code on the underlying server. Given the CVSS score of 8.8, this impact is severe and could lead to complete data loss, site defacement, or the use of the server in further malicious activities.

Remediation Plan

Immediate Action: Ensure the CMS is updated to a secure version that addresses this vulnerability; if using a dev version, roll back to a stable release or apply the vendor-provided patch.

Proactive Monitoring: Monitor administrative audit logs for unexpected plugin installations or unauthorized modifications to system files.

Compensating Controls: Enforce strict access control policies and ensure administrators use secure browsers with anti-CSRF protections; utilize a WAF to inspect requests for suspicious modification attempts.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (50095).

Analyst Notes: As of May 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk of RCE is high, the requirement for an authenticated session provides a slight barrier to entry compared to unauthenticated flaws.

Analyst Recommendation

Administrative users must treat this vulnerability with the highest urgency. Because it allows for RCE, it is imperative to apply security updates immediately and restrict administrative access to the CMS to only trusted IP addresses and authenticated personnel.

Description Summary:
WP Learn Manager version 1.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input.

Executive Summary:
A Stored Cross-Site Scripting vulnerability in the WP Learn Manager WordPress plugin allows authenticated attackers to inject malicious scripts into web pages.

Vulnerability Details

CVE-ID: CVE-2021-47975

Affected Software: Wplearnmanager WP Learn Manager

Affected Versions: 1.1.2

Vulnerability: This is a CWE-79 Stored XSS vulnerability. The flaw allows an attacker with low-level privileges to inject malicious payloads that execute in the context of other users' sessions.

Business Impact

Successful exploitation of this XSS vulnerability could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the redirection of visitors to malicious sites. While the CVSS score of 7.2 reflects a significant risk, the impact is primarily focused on client-side integrity and user session security rather than server-side compromise.

Remediation Plan

Immediate Action: As no specific patched version is currently identified, verify if a security update has been released by the vendor; if not, disable the plugin until a fix is verified.

Proactive Monitoring: Monitor site traffic for unusual script injections in user-managed content fields or unexpected redirect patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to block known attack patterns targeting this plugin.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (50086).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit increases the likelihood of opportunistic attacks against unpatched installations.

Analyst Recommendation

Given the availability of a public exploit and the ease of exploitation, this vulnerability poses a credible threat to site integrity. Administrators should prioritize identifying instances of this plugin and either apply vendor-supplied patches or remove the component to eliminate the attack surface entirely.

Description Summary:
VX Search version 13.5.28 is susceptible to privilege escalation due to an unquoted service path vulnerability.

Executive Summary:
An unquoted service path vulnerability in VX Search 13.5.28 could allow a local attacker with low privileges to achieve full system-level privilege escalation.

Vulnerability Details

CVE-ID: CVE-2021-47974

Affected Software: Vxsearch VX Search

Affected Versions: 13.5.28

Vulnerability: This is a CWE-428 vulnerability where the software service path is not properly quoted. A local attacker can exploit this by placing a malicious executable in the path to gain elevated privileges.

Business Impact

The ability for a low-privileged user to escalate to full system privileges poses a critical risk to host security. With a CVSS score of 7.8, this flaw could allow an attacker to bypass all OS-level access controls, leading to total system compromise, data theft, or the installation of persistent malware.

Remediation Plan

Immediate Action: Audit systems for the affected VX Search version and apply any available security patches; if unavailable, manually quote the service path in the Windows Registry or disable the service.

Proactive Monitoring: Review system logs for unauthorized service installations or unexpected changes to service executables.

Compensating Controls: Implement strict file system permissions to prevent low-privileged users from writing to the directories identified in the service path.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (50026).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly reliable for local privilege escalation.

Analyst Recommendation

This vulnerability represents a significant security risk for Windows environments hosting VX Search. Immediate remediation via patching or manual path correction is required to prevent local attackers from gaining full control over the host operating system.

Description Summary:
The Sticky Notes Widget version 3.0.6 is vulnerable to a Denial of Service (DoS) attack through a buffer overflow triggered by excessive memory allocation.

Executive Summary:
A buffer overflow vulnerability in the Sticky Notes Widget 3.0.6 allows unauthenticated attackers to cause a Denial of Service through excessive memory allocation.

Vulnerability Details

CVE-ID: CVE-2021-47973

Affected Software: Sticky-notes Sticky Notes Widget

Affected Versions: 3.0.6

Vulnerability: This is a CWE-789 vulnerability. The application fails to properly validate the size of user-supplied data, leading to uncontrolled memory allocation and subsequent service crashes.

Business Impact

The primary impact of this vulnerability is the disruption of service, which can lead to significant downtime for dependent applications. With a CVSS score of 7.5, this is a high-severity issue that allows remote, unauthenticated attackers to effectively take the widget offline at will.

Remediation Plan

Immediate Action: Update to the latest version if available; otherwise, disable or remove the Sticky Notes Widget to prevent remote service disruption.

Proactive Monitoring: Monitor server memory usage and application logs for signs of service crashes or abnormally large request payloads.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and limit the size of incoming requests to the affected application endpoints.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (49978).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently simple to trigger remotely.

Analyst Recommendation

The ease of triggering this DoS remotely necessitates prompt attention. Organizations utilizing this widget should verify the availability of a patch or prioritize the removal of the vulnerable component to ensure continued service availability and resilience against remote disruption.

Description Summary:
A memory allocation vulnerability in Sticky Notes & Color Widgets allows unauthenticated remote attackers to trigger a denial of service via an excessive size value.

Executive Summary:
A memory allocation vulnerability in Sticky Notes & Color Widgets version 1.4.2 poses a significant denial-of-service risk to host systems.

Vulnerability Details

CVE-ID: CVE-2021-47972

Affected Software: Sticky Notes Color Widgets

Affected Versions: 1.4.2

Vulnerability: This issue is caused by improper memory allocation (CWE-789) where an unauthenticated attacker can supply an excessive size value, leading to application instability or resource exhaustion.

Business Impact

The vulnerability carries a CVSS score of 7.5, reflecting a high risk of service unavailability. Successful exploitation results in a denial-of-service condition, which can disrupt business operations, degrade user experience, and force manual service restarts.

Remediation Plan

Immediate Action: Monitor vendor communication channels for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review system and application logs for unusual memory usage patterns or frequent service crashes that may indicate exploitation attempts.

Compensating Controls: Implement network-level rate limiting or a Web Application Firewall (WAF) to filter malformed requests that attempt to trigger excessive memory allocation.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for remote, unauthenticated exploitation.

Analyst Recommendation

Given the availability of a public exploit and the high severity of the potential denial-of-service impact, administrators should prioritize this item in their maintenance cycle. If a patch is not currently available, isolate the affected instance from public-facing networks until a vendor-supplied update is applied.

Description Summary:
A memory allocation vulnerability in My Notes Safe allows unauthenticated remote attackers to trigger a denial-of-service condition using an excessive size value.

Executive Summary:
A memory allocation vulnerability in My Notes Safe version 5.3 exposes the application to a high-severity denial-of-service risk from unauthenticated remote actors.

Vulnerability Details

CVE-ID: CVE-2021-47971

Affected Software: My Notes Safe

Affected Versions: 5.3

Vulnerability: The application is susceptible to a memory allocation error (CWE-789) where an unauthenticated attacker can input an excessively large value, leading to a crash or resource exhaustion.

Business Impact

The CVSS score of 7.5 indicates a high risk to availability. Exploitation of this flaw causes service disruption, which may lead to data access delays and operational downtime for users relying on the application.

Remediation Plan

Immediate Action: Contact the vendor or check the official support portal for a security update and apply it as soon as it is released.

Proactive Monitoring: Monitor application logs and system resource metrics for unexplained spikes in memory consumption or unexpected process terminations.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing abnormally large parameters or unexpected data structures.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is easily triggered, making it a viable target for automated scanning.

Analyst Recommendation

Because a public exploit is available and the vulnerability is automatable, the risk of exploitation is elevated. Security teams must ensure that the software is not exposed to untrusted networks and apply the vendor patch as soon as it becomes available.

Description Summary:
A memory allocation vulnerability in Macaron Notes allows unauthenticated remote attackers to trigger a denial-of-service condition via an excessive size value.

Executive Summary:
A memory allocation vulnerability in Macaron Notes version 5.5 presents a high-severity denial-of-service risk that can be exploited by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2021-47970

Affected Software: Macaron Notes

Affected Versions: 5.5

Vulnerability: This vulnerability involves improper memory allocation (CWE-789), allowing an unauthenticated attacker to supply an excessively large input value that crashes the targeted service.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant threat to service availability. Exploitation results in immediate service disruption, potentially causing data unavailability and necessitating emergency administrative intervention to restore the system.

Remediation Plan

Immediate Action: Actively track vendor security advisories for a fix and apply the update immediately upon release.

Proactive Monitoring: Monitor system logs for repeated crash events or memory-related errors that may indicate an attacker is attempting to exploit the buffer or allocation mechanism.

Compensating Controls: Deploy a Web Application Firewall (WAF) to validate incoming requests and block those that exceed expected size constraints or exhibit signs of malformed input.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this vulnerability makes it highly susceptible to automated exploitation attempts.

Analyst Recommendation

The presence of a public exploit coupled with the high CVSS severity necessitates immediate attention. Organizations should restrict access to the affected software and apply the necessary vendor patches as the primary mitigation strategy once they are published.

Description Summary:
Color Notes 1.4 is vulnerable to a memory allocation flaw, allowing an unauthenticated attacker to trigger a denial-of-service condition.

Executive Summary:
A memory allocation vulnerability in Color Notes 1.4 exposes the application to potential denial-of-service attacks by unauthenticated remote actors.

Vulnerability Details

CVE-ID: CVE-2021-47969

Affected Software: Color Color Notes

Affected Versions: 1.4

Vulnerability: This vulnerability (CWE-789) involves memory allocation with an excessive size value. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that the vulnerability is exploitable by an unauthenticated attacker over the network without requiring user interaction.

Business Impact

Successful exploitation results in a denial-of-service (DoS) condition, potentially rendering the Color Notes application unavailable to legitimate users. With a CVSS score of 7.5, this high-severity flaw threatens business continuity by disrupting service availability and requiring manual intervention to restore system stability.

Remediation Plan

Immediate Action: Since a specific patch is not identified, administrators should monitor vendor channels for security updates and restrict network access to the affected service where possible.

Proactive Monitoring: Review system logs for unusual memory usage spikes or repeated service crashes that may indicate an ongoing exploitation attempt.

Compensating Controls: Implement rate limiting or request size restrictions at the Web Application Firewall (WAF) or load balancer level to prevent malformed requests from reaching the application core.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input validation on memory allocation requests.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, organizations running Color Notes 1.4 must prioritize defensive measures. We recommend restricting access to the application and applying any vendor-supplied patches the moment they become available to eliminate the underlying memory exhaustion risk.

Description Summary:
PHP Timeclock 1.04 is vulnerable to SQL Injection, allowing an unauthenticated attacker to execute arbitrary SQL commands via the login interface.

Executive Summary:
An unauthenticated SQL injection vulnerability in PHP Timeclock 1.04 allows attackers to potentially compromise database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2021-47966

Affected Software: Timeclock PHP Timeclock

Affected Versions: 1.04

Vulnerability: This is an SQL Injection (CWE-89) vulnerability. The application fails to properly sanitize user input in the login module, allowing an unauthenticated attacker to inject malicious SQL commands.

Business Impact

With a CVSS score of 8.2, this vulnerability is severe. Successful exploitation could allow an attacker to bypass authentication, extract sensitive user information, or modify database contents, leading to a total loss of confidentiality for the application's user base.

Remediation Plan

Immediate Action: Upgrade to the latest secure version if available; otherwise, restrict access to the login interface via network-level controls.

Proactive Monitoring: Monitor database query logs for syntax errors, unexpected commands, or large data exports, which are characteristic of SQL injection attempts.

Compensating Controls: Implement a WAF with SQL injection detection rules to filter malicious payloads from incoming HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49849).

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication.

Analyst Recommendation

The presence of a public exploit significantly increases the risk of this vulnerability. Administrators must treat this as a high-priority item and ensure that the application is either patched or isolated from public-facing networks until a fix is confirmed.

Description Summary:
The WP Super Edit plugin for WordPress contains an unrestricted file upload vulnerability in the FCKeditor component, enabling remote code execution.

Executive Summary:
An unrestricted file upload vulnerability in the WordPress WP Super Edit plugin allows attackers to achieve remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47965

Affected Software: WordPress Plugin WP Super Edit

Affected Versions: 2.5.4 and earlier

Vulnerability: The plugin's FCKeditor component lacks validation for uploaded file types, allowing an attacker to upload malicious scripts directly to the server.

Business Impact

Successful exploitation allows an attacker to gain complete control over the WordPress site, leading to potential data exfiltration, malware distribution, and site defacement. The CVSS score of 9.8 signifies the highest level of risk.

Remediation Plan

Immediate Action: Update WP Super Edit to the latest available version; if no patch is available, remove the plugin entirely.

Proactive Monitoring: Scan the WordPress uploads directory for suspicious files (e.g., .php, .phtml) and review server access logs for unusual POST requests.

Compensating Controls: Use security plugins to disable file uploads or enforce strict directory permissions that prevent script execution in upload folders.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This is a critical vulnerability that directly facilitates remote code execution. Administrators are strongly advised to update or uninstall the vulnerable plugin immediately to secure the environment.

Description Summary:
Schlix CMS 2.2.6-6 contains a code injection vulnerability in the core block manager, allowing an authenticated attacker with low privileges to execute arbitrary code.

Executive Summary:
A critical code injection vulnerability in Schlix CMS 2.2.6-6 allows low-privileged authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2021-47964

Affected Software: Schlix Schlix CMS

Affected Versions: 2.2.6-6

Vulnerability: This is a Code Injection (CWE-94) vulnerability located in the application's core block manager. It requires an attacker to have authenticated with low privileges to trigger the execution of arbitrary code on the server.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat to the entire server environment. An attacker achieving remote code execution can gain full control over the web server, leading to complete system compromise, lateral movement, and data exfiltration.

Remediation Plan

Immediate Action: Update Schlix CMS to the latest version. If an update is not available, disable the affected block manager functionality.

Proactive Monitoring: Audit server logs for unauthorized process execution, suspicious file modifications, or unexpected outbound network connections.

Compensating Controls: Use a WAF to block requests that contain patterns associated with code injection or attempt to access restricted block manager files.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 49838).

Analyst Notes: As of May 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to the potential for full system takeover.

Analyst Recommendation

Due to the high CVSS score and the availability of a public exploit, immediate action is required. Organizations must restrict administrative access and apply patches immediately to prevent unauthorized code execution and full system compromise.

Description Summary:
Anote 1.0 contains a persistent cross-site scripting (XSS) vulnerability that allows authenticated users to execute arbitrary scripts in the context of other users.

Executive Summary:
A persistent cross-site scripting flaw in Anote 1.0 allows authenticated attackers to perform unauthorized actions by injecting malicious scripts into the application.

Vulnerability Details

CVE-ID: CVE-2021-47963

Affected Software: AnotherNote Anote

Affected Versions: 1.0

Vulnerability: The software fails to properly neutralize user-supplied input, leading to persistent XSS (CWE-79). The CVSS vector (PR:L/UI:P) indicates that successful exploitation requires an authenticated user with low privileges and user interaction, such as clicking a malicious link or viewing compromised content.

Business Impact

This vulnerability enables attackers to hijack user sessions, steal sensitive session cookies, or perform unauthorized actions on behalf of legitimate users. While the CVSS score of 7.2 reflects high severity, the requirement for authentication limits the initial attack surface, though the impact on user privacy and data integrity remains significant.

Remediation Plan

Immediate Action: Identify and sanitize all user-controlled inputs within the application to prevent script execution; monitor vendor updates for a formal patch.

Proactive Monitoring: Inspect web access logs for suspicious script injection patterns or unusual redirects occurring within the application's user interface.

Compensating Controls: Deploy a WAF with strict XSS filtering rules to detect and block malicious payloads in HTTP requests before they reach the backend database.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous as it allows for the persistent execution of arbitrary code within the browser of victims.

Analyst Recommendation

Users of Anote 1.0 should restrict administrative access and implement strict Content Security Policies (CSP) to mitigate the impact of potential XSS attacks. Immediate application of vendor-provided security patches is required as soon as they are released to permanently address the underlying input validation deficiency.

Description Summary:
Synology SSL VPN Client stores passwords in plaintext, potentially allowing remote attackers to access user PINs and compromise VPN configurations.

Executive Summary:
A plaintext password storage vulnerability in the Synology SSL VPN Client exposes user credentials and risks unauthorized VPN configuration access.

Vulnerability Details

CVE-ID: CVE-2021-47961

Affected Software: Synology SSL VPN Client

Affected Versions: * up to (excluding) 1.4.5-0684

Vulnerability: This vulnerability involves the insecure storage of credentials (CWE-256) within the client software. An attacker can leverage this flaw to access or influence user PIN codes, which may facilitate unauthorized VPN configuration changes or the interception of VPN traffic when combined with user interaction.

Business Impact

The exploitation of this vulnerability could lead to significant security breaches, including the unauthorized access to private network resources via the VPN. With a CVSS score of 8.1, this represents a high-severity risk that could result in the compromise of sensitive corporate data, unauthorized lateral movement, and the potential for long-term credential theft.

Remediation Plan

Immediate Action: Update the Synology SSL VPN Client to version 1.4.5-0684 or later as specified in the official vendor advisory.

Proactive Monitoring: Review VPN access logs for anomalous login patterns or unauthorized configuration changes that do not correspond to known user behavior.

Compensating Controls: Ensure that multi-factor authentication (MFA) is enforced for all VPN connections to mitigate the impact of potentially compromised credentials.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires user interaction, the potential for persistent unauthorized access to secure network segments warrants prompt remediation.

Analyst Recommendation

Given the high CVSS score and the nature of VPN access as a primary gateway to internal networks, organizations should prioritize updating the Synology SSL VPN Client. Failure to patch these endpoints leaves remote access infrastructure vulnerable to credential harvesting and subsequent unauthorized entry.

Description Summary:
The WordPress plugin WPGraphQL 1.3.5 is susceptible to a denial-of-service vulnerability due to improper resource allocation limits.

Executive Summary:
An unauthenticated resource exhaustion vulnerability in WordPress plugin WPGraphQL 1.3.5 allows remote attackers to cause a denial-of-service condition.

Vulnerability Details

CVE-ID: CVE-2021-47959

Affected Software: WordPress WPGraphQL

Affected Versions: 1.3.5

Vulnerability: This vulnerability (CWE-770) occurs because the plugin fails to properly limit or throttle resource allocation. The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms that the attack is fully automatable and requires no authentication or user interaction to execute.

Business Impact

By overwhelming the system with resource-intensive requests, an attacker can crash the plugin or the underlying WordPress site, leading to significant downtime. Given the 7.5 CVSS score, this represents a critical risk to business availability, particularly for high-traffic websites that rely on WPGraphQL for data integration.

Remediation Plan

Immediate Action: Disable the WPGraphQL plugin if it is not strictly required for site functionality until an official patch is released.

Proactive Monitoring: Monitor server resource utilization (CPU/Memory) for sudden spikes and review access logs for high-frequency GraphQL queries from single source IPs.

Compensating Controls: Configure a WAF or API gateway to rate-limit GraphQL queries and block requests that exhibit patterns characteristic of resource exhaustion attempts.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly concerning due to its ability to be triggered remotely without authentication.

Analyst Recommendation

Organizations utilizing WPGraphQL 1.3.5 should exercise extreme caution. Given the availability of a public proof-of-concept and the potential for easy remote exploitation, we strongly recommend disabling the plugin or implementing robust rate-limiting controls to prevent service disruption until a patched version is deployed.

Description Summary:
Egavilanmedia PHPCRUD 1.0 is vulnerable to SQL injection via the firstname parameter, allowing unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Egavilanmedia PHPCRUD 1.0 allows unauthenticated remote attackers to compromise database confidentiality.

Vulnerability Details

CVE-ID: CVE-2021-47956

Affected Software: Egavilanmedia PHPCRUD

Affected Versions: 1.0

Vulnerability: This is an SQL injection (CWE-89) vulnerability occurring in the application's input handling. The vulnerability is exploitable by unauthenticated remote attackers (AV:N/AC:L/PR:N/UI:N), allowing for unauthorized database information disclosure.

Business Impact

Successful exploitation of this vulnerability could lead to significant data exfiltration, as an attacker can manipulate backend database queries. Given the CVSS score of 8.2, this represents a high-severity risk that could result in the compromise of sensitive user information and potential loss of data integrity.

Remediation Plan

Immediate Action: Since no official patch is currently listed, implement input validation and parameterized queries for all database interactions to neutralize the injection vector.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based or error-based SQL injection patterns originating from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads before they reach the application.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49878).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of sanitization on user-supplied input.

Analyst Recommendation

Given the availability of public exploit code and the ease of exploitation, organizations using Egavilanmedia PHPCRUD must prioritize hardening the application. If the vendor does not provide a patch, consider migrating to a supported CRUD framework or restricting access to the affected instance until a secure update is applied.

Description Summary:
LayerBB 1.1.4 contains an SQL injection vulnerability in the search query parameter, enabling unauthenticated remote attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in LayerBB 1.1.4 allows unauthenticated remote attackers to bypass security controls and access backend database contents.

Vulnerability Details

CVE-ID: CVE-2021-47954

Affected Software: LayerBB LayerBB

Affected Versions: 1.1.4

Vulnerability: This is an SQL injection (CWE-89) vulnerability where the search query parameter fails to properly neutralize special elements. The vulnerability is accessible to unauthenticated attackers (AV:N/AC:L/PR:N/UI:N), significantly increasing the potential attack surface.

Business Impact

The ability for an unauthenticated attacker to inject SQL commands poses a severe threat to the confidentiality of the application's database. With a CVSS score of 8.2, this vulnerability could result in unauthorized access to sensitive user data, intellectual property, or administrative credentials stored within the database.

Remediation Plan

Immediate Action: Apply vendor security updates immediately if available; otherwise, implement strict input sanitization on all search parameters.

Proactive Monitoring: Review application logs for suspicious search strings containing SQL syntax or special characters indicative of injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block malicious search queries that contain SQL injection payloads.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49593).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible, making it a prime target for automated scanning tools.

Analyst Recommendation

The presence of a public exploit increases the urgency of this remediation. System administrators must monitor for anomalous traffic directed at the search functionality and ensure that all input fields are properly sanitized to prevent unauthorized database access.

Description Summary:
The python jsonpickle library contains a remote code execution vulnerability via deserialization of malicious JSON payloads containing py/repr objects.

Executive Summary:
A critical remote code execution vulnerability in python jsonpickle 2.0.0 allows unauthenticated attackers to execute arbitrary system commands via malicious JSON payloads.

Vulnerability Details

CVE-ID: CVE-2021-47952

Affected Software: Python jsonpickle

Affected Versions: 2.0.0

Vulnerability: This is a deserialization vulnerability where the library fails to safely handle py/repr objects. An unauthenticated attacker can craft a JSON payload that triggers the execution of arbitrary Python commands during the deserialization process.

Business Impact

Successful exploitation allows for complete system compromise, enabling attackers to execute arbitrary code with the privileges of the application process. Given the critical CVSS score of 9.8, this flaw presents an extreme risk of data exfiltration, ransomware deployment, or total service disruption.

Remediation Plan

Immediate Action: Upgrade to the latest version of jsonpickle where this deserialization flaw is addressed.

Proactive Monitoring: Audit application logs for suspicious inbound JSON payloads containing "py/repr" or "eval" keywords.

Compensating Controls: Ensure that the application does not deserialize untrusted or user-supplied JSON data without strict validation and sanitization.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a severe security risk due to the potential for full remote code execution. Organizations utilizing jsonpickle must prioritize updating to a patched version immediately to prevent unauthorized system access and potential compromise of the host environment.

Description Summary:
A vulnerability has been identified in CyberPanel 2 that could permit unauthorized system access.

Executive Summary:
A critical-level vulnerability in CyberPanel 2 threatens the security and control of the hosting management environment.

Vulnerability Details

CVE-ID: CVE-2021-47949

Affected Software: CyberPanel

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves a flaw in the management interface, potentially allowing for unauthorized execution of commands or administrative access.

Business Impact

CyberPanel provides comprehensive control over web hosting environments. A CVSS score of 8.8 implies that a successful exploit could result in full server compromise, impacting all hosted websites and databases managed by the panel.

Remediation Plan

Immediate Action: Update CyberPanel to the latest version immediately to mitigate the risk of unauthorized access.

Proactive Monitoring: Check system logs for unauthorized command execution or unusual administrative activity.

Compensating Controls: Restrict access to the CyberPanel port to trusted management IPs and ensure all services are behind a robust firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CyberPanel administrators must act immediately to apply the latest security updates. Compromise of a hosting control panel is a severe incident that can affect multiple hosted services.

Description Summary:
A security vulnerability has been discovered in the Argus Surveillance DVR, potentially allowing unauthorized access to video feeds or system settings.

Executive Summary:
A high-severity vulnerability in the Argus Surveillance DVR could allow unauthorized access to physical security monitoring systems.

Vulnerability Details

CVE-ID: CVE-2021-47945

Affected Software: Argus Surveillance DVR

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to the remote management and viewing interface, potentially allowing an unauthenticated attacker to bypass security controls.

Business Impact

Surveillance systems are critical for physical security. A CVSS score of 7.8 indicates that a compromise could lead to unauthorized viewing of sensitive areas, disruption of security monitoring, or the use of the DVR as a beachhead for further network exploitation.

Remediation Plan

Immediate Action: Apply the latest firmware update provided by the manufacturer.

Proactive Monitoring: Monitor network traffic for unusual access to the DVR's web interface or management ports.

Compensating Controls: Isolate the DVR on a dedicated network segment and disable remote access via the internet.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should immediately secure their surveillance infrastructure by applying the latest firmware patches. Access to these devices should be strictly limited to prevent exploitation.

Description Summary:
A security vulnerability has been identified in memono Notepad 4 that requires investigation and remediation.

Executive Summary:
A critical security vulnerability has been identified in memono Notepad 4, potentially allowing for unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2021-47944

Affected Software: memono Notepad

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves an unspecified security flaw within the Notepad 4 application. Due to the lack of detailed disclosure, the specific attack vector remains unclear, though such flaws often involve improper input validation or memory handling.

Business Impact

With a CVSS score of 7.5, this vulnerability is classified as High severity. Exploitation could lead to unauthorized access or system instability, potentially resulting in the compromise of locally stored sensitive documents or disruption of administrative workflows.

Remediation Plan

Immediate Action: Consult the official memono security portal to identify and apply the latest security patches or version updates.

Proactive Monitoring: Review system and application access logs for any unusual process execution or unauthorized file access attempts.

Compensating Controls: Restrict application execution privileges and ensure that the software is running within a hardened environment with minimal user permissions.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, administrators must prioritize identifying if this software is deployed within their environment. Apply all vendor-recommended updates immediately to mitigate potential risks associated with this vulnerability.

Description Summary:
TextPattern CMS 4.8.7 is vulnerable to unrestricted file uploads, allowing an authenticated attacker to execute arbitrary code on the server.

Executive Summary:
An unrestricted file upload vulnerability in TextPattern CMS 4.8.7 enables remote code execution by authenticated users.

Vulnerability Details

CVE-ID: CVE-2021-47943

Affected Software: Textpattern TextPattern CMS

Affected Versions: 4.8.7

Vulnerability: This vulnerability involves unrestricted file uploads (CWE-434), which can be leveraged by an authenticated user to upload malicious files that are subsequently executed by the server.

Business Impact

Exploitation of this flaw grants an attacker the ability to execute arbitrary code, which can lead to complete server compromise. Given the 8.8 CVSS score, this risk includes total loss of confidentiality, integrity, and availability for the affected web application.

Remediation Plan

Immediate Action: Update to the latest version of TextPattern CMS that addresses this file upload vulnerability. If an update is unavailable, restrict file upload permissions and validate file types rigorously at the application level.

Proactive Monitoring: Inspect web server logs for suspicious file upload activity or requests to non-media file types within upload directories.

Compensating Controls: Use a WAF to inspect incoming file uploads and block files with dangerous extensions or signatures.

Exploitation Status

Public Exploit Available: Yes — multiple entries exist on ExploitDB.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The existence of multiple public exploits makes this a high-priority target for automated and manual exploitation.

Analyst Recommendation

The combination of the high severity score and the availability of multiple public exploits necessitates immediate action. Administrators should upgrade to a secure version immediately and audit the file system for any unauthorized files that may have already been uploaded.

Description Summary:
Home Assistant Community Store (HACS) prior to 1.10.0 is vulnerable to a path traversal attack, allowing unauthenticated remote attackers to read arbitrary files.

Executive Summary:
A path traversal vulnerability in Home Assistant Community Store (HACS) versions before 1.10.0 permits unauthenticated attackers to access sensitive files on the host system.

Vulnerability Details

CVE-ID: CVE-2021-47942

Affected Software: Home Assistant Community Store (HACS)

Affected Versions: 0 up to (excluding) 1.10.0

Vulnerability: This is a path traversal (CWE-22) vulnerability that allows for unauthorized file access by manipulating pathnames. The vulnerability is exploitable by unauthenticated attackers (AV:N/AC:L/PR:N/UI:N), which could lead to full account takeover or sensitive configuration disclosure.

Business Impact

The impact of this path traversal is severe, as it allows attackers to read arbitrary files from the server, potentially including sensitive credentials or configuration files. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the Home Assistant deployment.

Remediation Plan

Immediate Action: Update the Home Assistant Community Store (HACS) integration to version 1.10.0 or later immediately.

Proactive Monitoring: Inspect server logs for file access attempts containing directory traversal sequences such as "../" or "/etc/passwd".

Compensating Controls: Use file system permissions to restrict the web server user's access to only the necessary directories, effectively limiting the scope of any potential traversal.

Exploitation Status

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49495).

Analyst Notes: As of May 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is straightforward to exploit, necessitating prompt patching.

Analyst Recommendation

Given the potential for account takeover and sensitive data disclosure, immediate upgrading to version 1.10.0 is critical. Administrators should verify the HACS version currently running and ensure the update is applied across all affected installations to eliminate this risk.

Description Summary:
A vulnerability in the WordPress Plugin Survey & Poll may allow unauthorized access through manipulation of the cookie parameter.

Executive Summary:
A high-severity vulnerability in the Survey & Poll WordPress plugin could allow attackers to bypass security controls via cookie manipulation.

Vulnerability Details

CVE-ID: CVE-2021-47941

Affected Software: WordPress Survey & Poll Plugin

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability relates to improper handling of the cookie parameter, which may permit an attacker to bypass authentication or execute unauthorized actions.

Business Impact

Exploitation of this plugin could lead to the compromise of the underlying WordPress installation. A CVSS score of 8.2 justifies immediate action to prevent unauthorized data access, site defacement, or administrative account takeover.

Remediation Plan

Immediate Action: Update the Survey & Poll plugin to the latest vendor-provided version. If no patch is available, disable or remove the plugin immediately.

Proactive Monitoring: Audit WordPress user logs for suspicious account activity or unauthorized administrative actions.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious cookie input and restrict access to administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

All WordPress administrators using this plugin must verify their current version and update immediately. If the plugin is no longer maintained, it should be removed to eliminate the attack surface.

Description Summary:
An arbitrary file upload vulnerability in the Plugin Download WordPress plugin allows unauthenticated attackers to upload and execute malicious files via the admin-ajax.php endpoint.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress Plugin Download plugin allows attackers to achieve remote code execution by bypassing file extension restrictions.

Vulnerability Details

CVE-ID: CVE-2021-47940

Affected Software: WordPress Plugin Download

Affected Versions: 1.48 and earlier

Vulnerability: This vulnerability occurs in the AJAX fileupload action. Unauthenticated attackers can manipulate the allowExt parameter to bypass security checks and upload executable PHP shells to the web root.

Business Impact

The CVSS score of 9.8 reflects the high probability of total system compromise. By uploading and executing malicious scripts, an attacker can gain administrative access, steal sensitive configuration data, or use the server as a node for further malicious activities.

Remediation Plan

Immediate Action: Update the Plugin Download plugin to the latest version immediately to ensure file extension validation is correctly enforced.

Proactive Monitoring: Monitor server logs for requests to admin-ajax.php that include the download_from_files_617_fileupload action and investigate any suspicious file modifications in the web root.

Compensating Controls: Configure file system permissions to prevent the web server user from executing files uploaded to the plugin's upload directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability provides a straightforward path for attackers to gain execution privileges. Organizations must treat this as a high-priority update and verify that the plugin is fully patched to block unauthorized file uploads.

Description Summary:
Evolution CMS 3.1.6 contains a code injection vulnerability that allows an authenticated attacker to execute arbitrary code during module creation.

Executive Summary:
An authenticated code injection vulnerability in Evolution CMS 3.1.6 allows attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2021-47939

Affected Software: Evo Evolution CMS

Affected Versions: 3.1.6

Vulnerability: This vulnerability (CWE-94) is triggered during the module creation process. It requires the attacker to hold low-level privileges (PR:L), after which they can inject and execute arbitrary code.

Business Impact

Successful exploitation provides the attacker with a foothold to execute code on the underlying server, which can lead to total system compromise. With a CVSS score of 8.8, this flaw represents a significant risk to the integrity and security of the hosting environment.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the Evolution CMS project. Ensure that administrative module creation is restricted to authorized, trusted personnel only.

Proactive Monitoring: Review audit logs for unusual module creation activities or modifications to system files that do not align with expected administrative tasks.

Compensating Controls: Apply WAF rules to block malicious payloads within administrative forms and module creation requests.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains minimal access, making it a critical concern.

Analyst Recommendation

Given the potential for complete system compromise, organizations should prioritize updating their Evolution CMS instances to the latest patched version. Restricting administrative access is a vital interim measure to reduce the attack surface.

Description Summary:
A security vulnerability has been identified in ImpressCMS 1 that requires immediate investigation and patching.

Executive Summary:
A critical vulnerability in ImpressCMS 1 could allow remote attackers to execute arbitrary code, threatening the entire web application.

Vulnerability Details

CVE-ID: CVE-2021-47938

Affected Software: ImpressCMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability resides within the ImpressCMS platform and relates to improper control of code execution paths. Attackers could potentially trigger this flaw to execute unauthorized code on the server, compromising the integrity of the application.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe threat. Successful exploitation could result in total system compromise, unauthorized data access, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Apply the vendor-provided security patches or upgrade to a secure version of ImpressCMS immediately.

Proactive Monitoring: Review application logs for unauthorized execution of scripts or abnormal system behavior.

Compensating Controls: Deploy a WAF with rules configured to detect and block common web-based exploit attempts and command injection strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate action. Administrators must prioritize updating ImpressCMS to the latest version to eliminate the risk of remote code execution and protect the underlying infrastructure.

Description Summary:
A security vulnerability has been discovered in e107 CMS 2 that could permit unauthorized access or code execution.

Executive Summary:
A high-severity vulnerability in e107 CMS 2 presents a significant risk of remote compromise if left unpatched.

Vulnerability Details

CVE-ID: CVE-2021-47937

Affected Software: e107 CMS

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw affects the e107 Content Management System. It likely involves improper handling of input at an endpoint, which could be leveraged by an attacker to execute arbitrary code or bypass security controls.

Business Impact

The CVSS score of 8.8 highlights the severity of this issue. A successful exploit could lead to full site compromise, defacement, or the theft of user data stored within the CMS database.

Remediation Plan

Immediate Action: Upgrade to the latest stable version of e107 CMS as recommended by the vendor.

Proactive Monitoring: Inspect web server logs for indicators of injection attacks, such as unusual URL parameters or encoded payloads.

Compensating Controls: Use a Web Application Firewall (WAF) to block known attack patterns and malicious input signatures targeting CMS platforms.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

CMS vulnerabilities are frequent targets for automated exploitation. It is imperative to verify the current version of your e107 installation and apply the latest security patches immediately to secure the platform against potential attackers.

Description Summary:
A remote code execution vulnerability in OpenCATS allows unauthenticated attackers to execute arbitrary system commands by uploading malicious PHP files as resume attachments.

Executive Summary:
An unauthenticated remote code execution vulnerability in OpenCATS allows attackers to gain full control of the server via malicious file uploads disguised as resumes.

Vulnerability Details

CVE-ID: CVE-2021-47936

Affected Software: OpenCATS

Affected Versions: 0.9.4

Vulnerability: This is a remote code execution vulnerability occurring at the careers job application endpoint. Unauthenticated attackers can upload PHP files disguised as resume attachments and execute them by accessing the file path directly.

Business Impact

The CVSS score of 9.8 highlights the critical danger of this vulnerability. Successful exploitation permits attackers to execute system commands, potentially leading to a complete compromise of the underlying host server and access to the applicant database.

Remediation Plan

Immediate Action: Update OpenCATS to the latest version that enforces strict file validation and prevents the execution of uploaded files.

Proactive Monitoring: Check the upload directories for any unexpected PHP files and monitor server access logs for requests targeting these files.

Compensating Controls: Configure the web server to disable script execution in the directory where user-submitted files are stored.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote code execution is among the most severe security risks. Organizations using OpenCATS must apply updates immediately to prevent unauthorized command execution on their servers.

Description Summary:
A vulnerability has been detected in Sentry 8, potentially impacting the monitoring and error-tracking capabilities of the platform.

Executive Summary:
A high-severity security flaw in Sentry 8 poses a risk to the security of the error-tracking and monitoring platform.

Vulnerability Details

CVE-ID: CVE-2021-47935

Affected Software: Sentry

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability affects the core functionality of Sentry 8, potentially allowing an attacker to manipulate error data or gain unauthorized access.

Business Impact

Sentry is a critical tool for monitoring application health and security. A CVSS score of 8.8 indicates a major security risk; if compromised, an attacker could gain insight into application vulnerabilities or administrative access to the monitoring infrastructure.

Remediation Plan

Immediate Action: Upgrade to the latest supported version of Sentry to remediate the vulnerability.

Proactive Monitoring: Monitor Sentry logs for suspicious administrative actions or unauthorized modifications to error reporting configurations.

Compensating Controls: Use strict network segmentation to ensure the Sentry instance is only accessible by authorized systems.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role of Sentry in application oversight, this update should be treated with high urgency. Ensure that all instances of Sentry are updated to the latest version to maintain platform integrity.

Description Summary:
An arbitrary file upload vulnerability in the MStore API allows unauthenticated attackers to execute malicious code on the host server via the REST API.

Executive Summary:
An unauthenticated arbitrary file upload vulnerability in the WordPress MStore API enables remote code execution, posing a critical threat to server integrity.

Vulnerability Details

CVE-ID: CVE-2021-47933

Affected Software: WordPress MStore API

Affected Versions: 2.0.6

Vulnerability: This is an unauthenticated arbitrary file upload vulnerability within the REST API endpoint. Attackers can submit crafted POST requests to the config_file endpoint to upload malicious PHP files and execute arbitrary code.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk of full system compromise. Successful exploitation grants attackers remote code execution capabilities, allowing for complete control over the web server, data exfiltration, and the ability to pivot into the internal network.

Remediation Plan

Immediate Action: Update the MStore API to the latest patched version available from the vendor.

Proactive Monitoring: Inspect the web server's upload directories and system logs for unexpected PHP files or unauthorized POST requests targeting the REST API.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing executable file extensions directed at the REST API endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The critical nature of this remote code execution vulnerability requires immediate attention. Administrators must verify their MStore API version and apply updates immediately to prevent potential server takeover.

Description Summary:
An unauthenticated privilege escalation vulnerability in TheCartPress WordPress plugin allows attackers to create new administrative accounts via the AJAX handler.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the WordPress TheCartPress plugin allows attackers to gain full administrative control by injecting unauthorized user registration requests.

Vulnerability Details

CVE-ID: CVE-2021-47932

Affected Software: WordPress TheCartPress

Affected Versions: 1.5.3.6

Vulnerability: This is an unauthenticated privilege escalation vulnerability in the tcp_register_and_login_ajax action. Attackers can send crafted POST requests to the AJAX handler with the tcp_role parameter set to "administrator" to create an illicit admin account.

Business Impact

With a CVSS score of 9.8, this flaw allows for immediate and total takeover of the WordPress installation. An attacker with administrative access can modify site content, install malicious plugins, or access sensitive customer data, leading to severe business and privacy impacts.

Remediation Plan

Immediate Action: Update the TheCartPress plugin to the latest version. If a patch is unavailable, deactivate or remove the plugin until a secure version is released.

Proactive Monitoring: Review the site's user list for any unauthorized administrator accounts created recently and check logs for anomalous AJAX requests.

Compensating Controls: Restrict access to the admin-ajax.php file using server-level configuration or a WAF to prevent unauthorized registrations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Privilege escalation vulnerabilities are critical and must be remediated immediately. Administrators should audit all existing administrative users to ensure no accounts have been compromised through this vector.

Description Summary:
A security flaw in the Balbooa Joomla Forms Builder may allow an attacker to exploit form submission processes.

Executive Summary:
The Balbooa Forms Builder for Joomla contains a high-severity vulnerability that could lead to unauthorized system impact.

Vulnerability Details

CVE-ID: CVE-2021-47930

Affected Software: Balbooa Joomla Forms Builder

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves improper input sanitization within the forms builder, potentially allowing for arbitrary data submission or system interaction.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk to Joomla-based sites. Compromise could result in unauthorized data collection or, in certain configurations, remote code execution, leading to full site takeover.

Remediation Plan

Immediate Action: Update the Balbooa Forms Builder to the latest version provided by the developer.

Proactive Monitoring: Monitor for anomalous form submission traffic and check web server logs for suspicious activity.

Compensating Controls: Implement a WAF to monitor and block malformed HTTP requests targeting the form builder components.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Joomla administrators should verify the status of this plugin and apply updates immediately. Given the high severity, ensure that all third-party components are kept up to date to maintain site security.

Description Summary:
The TMD Vendor System extension for Opencart is vulnerable to an unauthenticated SQL injection, allowing attackers to manipulate database queries via the product route.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Opencart TMD Vendor System extension allows remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2021-47928

Affected Software: Opencart TMD Vendor System

Affected Versions: opencartextensions Extension TMD Vendor System: 3.0

Vulnerability: This is a classic SQL injection (CWE-89) flaw where the application fails to properly neutralize special elements in an SQL command. The vulnerability is exploitable by unauthenticated remote attackers via the product route.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 8.2, this represents a significant risk to the confidentiality and integrity of the e-commerce platform and associated customer data.

Remediation Plan

Immediate Action: Contact the vendor (Opencart Extensions) to verify the availability of a security update; if no patch is available, remove or disable the extension immediately.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION SELECT statements or unexpected error patterns, which may indicate automated scanning or exploitation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules configured to inspect the product route parameters.

Exploitation Status

Public Exploit Available: Yes — a public exploit is available via ExploitDB (ID 50493).

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication.

Analyst Recommendation

Due to the availability of a public exploit and the high severity of SQL injection vulnerabilities, immediate action is required. Organizations using the Opencart TMD Vendor System should prioritize auditing their installations and applying any available vendor patches or disabling the vulnerable component entirely.

Description Summary:
A session fixation vulnerability in OpenCart allows attackers to hijack user sessions by forcing the use of a known, malicious session identifier.

Executive Summary:
A session fixation vulnerability in OpenCart enables attackers to hijack active user sessions, leading to unauthorized account access and potential data theft.

Vulnerability Details

CVE-ID: CVE-2021-47923

Affected Software: OpenCart

Affected Versions: 3.0.3.8

Vulnerability: This is a session fixation vulnerability where an attacker can inject arbitrary values into the OCSESSID cookie. By forcing a specific session ID, the attacker can hijack the session of an unsuspecting user once they authenticate.

Business Impact

The CVSS score of 9.8 indicates the high severity of this session hijacking risk. Successful exploitation allows an attacker to impersonate legitimate users, including administrators, leading to unauthorized access to sensitive account information and backend system controls.

Remediation Plan

Immediate Action: Update OpenCart to the latest version and ensure that the application properly regenerates session IDs upon authentication.

Proactive Monitoring: Monitor server logs for abnormal session activity or multiple logins originating from different IP addresses using the same session cookie.

Compensating Controls: Implement strict session management policies, such as limiting the lifetime of session cookies and ensuring they are flagged as Secure and HttpOnly.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Session fixation remains a potent threat to web applications. Administrators are urged to update their OpenCart installations and audit session handling configurations to mitigate this risk.

Description Summary:
Simple CMS 2.1 is vulnerable to SQL injection in the users module, allowing authenticated attackers to execute arbitrary SQL commands via the admin.php file.

Executive Summary:
A remote SQL injection vulnerability in Simple CMS 2.1 allows authenticated attackers to compromise the underlying database and application by injecting malicious SQL commands.

Vulnerability Details

CVE-ID: CVE-2021-47918

Affected Software: Simplephpscripts Simple CMS

Affected Versions: 2.1

Vulnerability: The application fails to properly sanitize input parameters within the newUser and editUser functions of the users module. By submitting crafted POST requests to admin.php, an authenticated user with moderator privileges can inject arbitrary SQL queries into the database management system.

Business Impact

Successful exploitation of this flaw can lead to a complete compromise of the database management system, potentially resulting in unauthorized data access, modification, or deletion. Given the CVSS score of 8.1, this vulnerability poses a high risk to organizational data integrity and application availability, as it permits attackers to manipulate the backend database directly.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the administrative panel to trusted personnel only and implement strict input validation on the server side.

Proactive Monitoring: Review web server and application access logs for unusual POST requests directed at admin.php, specifically monitoring for SQL syntax errors or unexpected characters in the name, username, and password fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, such as single quotes or SQL syntax keywords, within the application request parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the vulnerability research write-up by Vulnerability Laboratory.

Analyst Notes: As of February 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of prepared statements or input sanitization in the affected backend functions.

Analyst Recommendation

Due to the high severity of this SQL injection vulnerability, organizations currently utilizing Simple CMS 2.1 must treat this as a significant security risk. Since a public proof-of-concept is available, the likelihood of exploitation is elevated for internet-facing installations. Administrators are urged to apply strict access controls and consider migrating to a more secure, actively maintained content management solution.

Description Summary:
PHP Melody 3.0 contains a SQL injection vulnerability in the edit video module, allowing authenticated administrators or moderators to execute arbitrary database queries via the vid parameter.

Executive Summary:
An authenticated SQL injection vulnerability in PHP Melody 3.0 allows privileged users to execute arbitrary database commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47915

Affected Software: PHPSUGAR PHP Melody

Affected Versions: 3.0

Vulnerability: This vulnerability is a SQL injection flaw located in the edit-video.php file, specifically within the vid parameter. It requires an attacker to possess authenticated moderator or administrator privileges to successfully inject and execute malicious SQL statements.

Business Impact

Successful exploitation of this vulnerability allows an attacker to manipulate the underlying database management system. This can lead to unauthorized data access, modification of site content, or complete compromise of the web application and server environment. Given the CVSS score of 8.1, this represents a high-severity risk that could result in significant data loss or service disruption.

Remediation Plan

Immediate Action: Update the PHP Melody installation to the latest version as provided by PHPSUGAR, which includes the necessary patches for this vulnerability.

Proactive Monitoring: Monitor administrative access logs for unusual GET requests targeting the edit-video.php file, particularly those containing SQL syntax characters or unexpected parameter lengths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious SQL injection payloads targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is documented in the technical write-up provided by Vulnerability-Lab.

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation in the wild. While the vulnerability requires administrative or moderator privileges, the presence of a published proof-of-concept makes the risk of internal misuse or credential-based exploitation credible.

Analyst Recommendation

Organizations utilizing PHP Melody 3.0 should prioritize updating their software to the vendor-patched version immediately. Because this vulnerability grants high-level database access to already authenticated users, it is critical to enforce the principle of least privilege for administrative accounts and audit access logs to ensure no unauthorized modifications have occurred.

Description Summary:
Techraft Digital Multivendor Marketplace Online Store v2.4 contains multiple SQL injection vulnerabilities in core modules, allowing authenticated attackers to execute arbitrary database commands.

Executive Summary:
A high-severity SQL injection vulnerability in Techraft Digital Multivendor Marketplace Online Store v2.4 allows privileged attackers to compromise the backend database.

Vulnerability Details

CVE-ID: CVE-2021-47909

Affected Software: Techraft Digital Multivendor Marketplace Online Store

Affected Versions: 2.4

Vulnerability: The application is susceptible to SQL injection via the 'id' parameter across multiple modules, including inventory, customer, vendor, and order management. This flaw requires the attacker to hold an authenticated vendor or administrator role to trigger the execution of malicious SQL statements.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database management system. This can lead to the exfiltration of sensitive customer data, modification of order information, or full compromise of the application backend, resulting in significant operational and reputational damage. The CVSS score of 8.1 reflects the high severity of potential data loss and unauthorized control.

Remediation Plan

Immediate Action: Since no specific patch is documented, administrators must restrict access to the administrative and vendor backend panels to trusted IP addresses only until a vendor update is applied.

Proactive Monitoring: Security teams should monitor database logs for abnormal queries or syntax errors, particularly those involving the 'id' parameter in the identified modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to intercept and block malicious payloads targeting the vulnerable 'id' parameters in GET requests.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Vulnerability Laboratory research write-up.

Analyst Notes: As of February 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input is not properly sanitized before being processed by the database query functions.

Analyst Recommendation

Given the availability of public proof-of-concept material, the risk of exploitation is elevated. Administrators are urged to audit their environments for the presence of the vulnerable software and implement the suggested WAF controls immediately. If the software is no longer supported by the vendor, migration to a secure, actively maintained alternative is strongly recommended.

Description Summary:
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager, allowing remote attackers to upload malicious PHP files and achieve remote code execution.

Executive Summary:
An authenticated remote code execution vulnerability exists in PhreeBooks 5.2.3 that permits attackers to execute arbitrary commands on the underlying server.

Vulnerability Details

CVE-ID: CVE-2021-47904

Affected Software: Phreesoft PhreeBooks

Affected Versions: 5.2.3

Vulnerability: The application fails to perform adequate file type validation within the Image Manager component. By exploiting this flaw, an authenticated user can upload a PHP web shell to the server, which can subsequently be accessed and executed to run arbitrary system commands.

Business Impact

A successful exploit of this vulnerability grants an attacker full control over the affected application server. This level of access enables the theft of sensitive accounting data, the modification of financial records, and potential lateral movement into the broader corporate network. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: Upgrade to a secure version of PhreeBooks if available, or remove the vulnerable Image Manager component if it is not required for business operations.

Proactive Monitoring: Review web server access logs for requests directed at unexpected PHP files within the image upload directory, and monitor for unusual child processes spawned by the web server service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads containing prohibited extensions, such as .php, .php3, or .phtml, and restrict access to the administration portal to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes, multiple published proof-of-concept scripts exist on ExploitDB (EDB-ID 49524 and 46645).

Analyst Notes: As of January 25, 2026, there is no public information indicating active exploitation in the wild, though the existence of functional, publicly available exploit code makes the risk of exploitation credible. The vulnerability is highly exploitable due to the lack of server-side validation for file extensions.

Analyst Recommendation

Given the severity of this remote code execution flaw, organizations must treat this as a high priority. If patching is not immediately feasible, administrators should disable the affected Image Manager functionality or restrict access to the application to prevent unauthorized users from reaching the vulnerable endpoint. Immediate remediation is necessary to prevent potential system compromise.

Description Summary:
LiteSpeed Web Server Enterprise 5.4.11 is vulnerable to authenticated command injection via the configuration interface, allowing remote code execution by administrative users.

Executive Summary:
An authenticated command injection vulnerability in LiteSpeed Web Server Enterprise 5.4.11 allows administrative users to execute arbitrary shell commands, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2021-47903

Affected Software: LiteSpeed Technologies LiteSpeed Web Server Enterprise

Affected Versions: 5.4.11

Vulnerability: This vulnerability involves improper neutralization of special elements used in an OS command (CWE-78). By manipulating the Command parameter within the external application configuration interface, an authenticated administrator can achieve remote code execution through path traversal and bash command injection.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary system commands with the privileges of the web server process. Given the CVSS score of 8.8, this vulnerability represents a high risk: it could lead to complete server takeover, unauthorized data access, or the deployment of persistent malicious backdoors within the infrastructure.

Remediation Plan

Immediate Action: Upgrade LiteSpeed Web Server Enterprise to a version beyond 5.4.11 immediately to patch the command injection vulnerability.

Proactive Monitoring: Review web server configuration access logs for suspicious POST requests directed at the config/confMgr.php endpoint, specifically monitoring for unusual command strings or path traversal sequences.

Compensating Controls: Ensure that administrative access to the web server configuration interface is restricted to trusted internal networks or authorized VPN connections to minimize the attack surface.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists via ExploitDB (EDB-ID: 49523).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker gains administrative credentials, as the interface explicitly accepts user-defined commands.

Analyst Recommendation

This vulnerability presents a significant security risk due to the potential for full remote code execution. Organizations running LiteSpeed Web Server Enterprise 5.4.11 must prioritize applying the vendor provided security updates to remediate this flaw. Failure to patch may allow an attacker with administrative access to gain total control over the underlying server environment.

Description Summary:
Testa Online Test Management System 3.4.7 is vulnerable to SQL injection via the 'q' search parameter, allowing unauthenticated attackers to extract database information.

Executive Summary:
A critical SQL injection vulnerability in Testa Online Test Management System 3.4.7 allows unauthenticated attackers to compromise sensitive database information.

Vulnerability Details

CVE-ID: CVE-2021-47902

Affected Software: Testa Online Test Management System

Affected Versions: 3.4.7

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) located in the search functionality. An unauthenticated attacker can manipulate the 'q' parameter in search queries to execute arbitrary SQL commands against the backend database.

Business Impact

The ability to perform unauthorized SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive user data, administrative credentials, or system configurations, potentially resulting in full database compromise. With a CVSS score of 8.2, this vulnerability represents a high-severity risk that requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Update the Testa Online Test Management System to the latest available version that addresses this vulnerability. If no patch is currently available from the vendor, restrict access to the application until a fix can be implemented.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL keywords like UNION, SELECT, or SLEEP within the 'q' search parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application search endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exploit is available via the Exploit-DB entry 49194.

Analyst Notes: As of January 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to trigger the flaw.

Analyst Recommendation

Given the availability of public exploit code and the ease of exploitation, this vulnerability should be prioritized for remediation. Organizations currently running version 3.4.7 must treat this as a high-priority security event. Ensure that the application is updated immediately and that defensive measures, such as WAF rules, are active to mitigate potential probing or exploitation attempts.

Description Summary:
Dirsearch 0.4.1 is vulnerable to CSV injection via the --csv-report flag, allowing attackers to inject malicious spreadsheet formulas through redirected server endpoints.

Executive Summary:
A CSV injection vulnerability in Dirsearch 0.4.1 allows attackers to manipulate generated reports, posing a risk to users who process these files in spreadsheet applications.

Vulnerability Details

CVE-ID: CVE-2021-47901

Affected Software: maurosoria dirsearch

Affected Versions: 0.4.1

Vulnerability: This is a CWE-1236 Improper Neutralization of Formula Elements vulnerability. An unauthenticated attacker can craft malicious redirects that, when included in a CSV report, execute arbitrary formulas upon opening the file.

Business Impact

While the technical impact is limited to the client-side manipulation of CSV files, the potential for data exfiltration or unauthorized system interaction via spreadsheet macros is high if the reports are processed by administrative staff. The CVSS score reflects this risk to data integrity within the organization's reporting workflow.

Remediation Plan

Immediate Action: Upgrade to the latest version of dirsearch available from the official repository, as the vendor has addressed this class of vulnerability in subsequent releases.

Proactive Monitoring: Review generated CSV reports for unexpected character sequences (e.g., =, +, -, @) in fields that should contain standard text.

Compensating Controls: Configure spreadsheet software (like Microsoft Excel or LibreOffice) to disable automatic macro execution and display warnings for untrusted external data sources.

Exploitation Status

Public Exploit Available: Yes — an entry exists on ExploitDB (49370).

Analyst Notes: As of Jan 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit increases the likelihood of opportunistic attacks.

Analyst Recommendation

Users of dirsearch version 0.4.1 should update immediately to mitigate the risk of CSV injection. Security teams should ensure that automated reporting workflows are hardened against malicious formula injection by validating input data before report generation.

Description Summary:
Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary system commands via manipulated HTTP User-Agent headers.

Executive Summary:
A critical remote code execution vulnerability in Gila CMS allows unauthenticated attackers to compromise the underlying server, posing a severe risk to system integrity and data confidentiality.

Vulnerability Details

CVE-ID: CVE-2021-47900

Affected Software: Gila CMS

Affected Versions: 0 up to (excluding) 2.0.0

Vulnerability: This is a remote code execution vulnerability stemming from improper input validation. Attackers can inject malicious PHP code into the User-Agent HTTP header, which is then processed by the application via shell_exec(), allowing for unauthenticated command execution on the host server.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the web server, enabling them to steal sensitive data, modify application content, or pivot into the internal network. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete system compromise and significant reputational damage.

Remediation Plan

Immediate Action: Upgrade Gila CMS to version 2.0.0 or the latest available release to patch the underlying code execution flaw.

Proactive Monitoring: Review web server access logs for anomalous entries in the User-Agent field, particularly those containing PHP syntax or system commands, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing suspicious patterns or executable code within HTTP headers.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exploit is available via Exploit-DB (EDB-ID: 49412).

Analyst Notes: As of January 27, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action. Administrators must prioritize updating Gila CMS to version 2.0.0 or higher to eliminate the attack vector. Failure to apply this update leaves the environment vulnerable to complete remote system compromise by unauthenticated actors.

Description Summary:
Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service, which may allow local attackers to gain elevated system privileges.

Executive Summary:
The Epson USB Display software is vulnerable to a local privilege escalation flaw that could allow an attacker to execute malicious code with LocalSystem privileges.

Vulnerability Details

CVE-ID: CVE-2021-47898

Affected Software: Epson USB Display

Affected Versions: 1.6.0.0

Vulnerability: This is an unquoted service path vulnerability (CWE-428) in the EMP_UDSA service. Because the service path is not enclosed in quotes, a local user with low privileges can place a malicious executable in an intermediate directory, which the service will then execute with elevated LocalSystem permissions.

Business Impact

Successful exploitation of this vulnerability allows a local, low-privileged user to achieve full control over the affected system. Given the CVSS score of 7.8, this represents a high-severity risk to confidentiality, integrity, and availability. Compromise of the LocalSystem account typically results in total system takeover, potentially leading to unauthorized data access and the deployment of persistent malware.

Remediation Plan

Immediate Action: Since no patch is explicitly available, administrators should manually remediate the service path by adding quotes to the binary path in the Windows Registry (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMP_UDSA) or uninstall the software if it is not business-critical.

Proactive Monitoring: Monitor system logs for unauthorized service modifications or the creation of unexpected executable files within the Epson installation directory structure.

Compensating Controls: Implement strict file system permissions on the installation directories to prevent low-privileged users from writing or modifying files within the path used by the EMP_UDSA service.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit Database (EDB-ID: 49548).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any local user who can write to the file system path.

Analyst Recommendation

Due to the high severity of potential privilege escalation, organizations using Epson USB Display version 1.6.0.0 must prioritize manual remediation of the service configuration. If the software is not required for daily operations, removal is the most effective way to eliminate this risk. Ensure that all systems are audited for similar unquoted service paths to prevent lateral movement and privilege escalation attacks.

Description Summary:
PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script, allowing attackers to execute arbitrary client-side scripts.

Executive Summary:
A stored cross-site scripting vulnerability in PEEL Shopping 9.3.0 allows authenticated attackers to execute malicious scripts, posing a risk of session hijacking and unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2021-47897

Affected Software: PEEL Shopping

Affected Versions: 9.3.0

Vulnerability: This vulnerability is a stored cross-site scripting (XSS) flaw located in the address parameter of the change_params.php script. The vulnerability requires a low-privileged authenticated user to trigger the malicious payload, which executes when a user interacts with the compromised input field.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to the theft of session cookies, account takeover, or the redirection of users to malicious sites, significantly impacting user privacy and system integrity. While the CVSS score of 7.2 reflects a high severity, the impact is primarily focused on client-side compromise rather than direct server-side code execution.

Remediation Plan

Immediate Action: Since no official patch is currently identified, users should audit their implementations and restrict access to account management features. If possible, migrate to a supported version or alternative platform if the vendor has deprecated this specific release.

Proactive Monitoring: Monitor web server logs for suspicious activity, specifically looking for unusual characters or script tags being submitted to the change_params.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block XSS patterns in HTTP requests, specifically targeting the address parameter to neutralize potential payloads.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented on Exploit-DB (EDB-ID 49553).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published proof-of-concept on Exploit-DB confirms that the technical barrier for exploitation is low.

Analyst Recommendation

Given the availability of a public proof-of-concept and the nature of stored XSS, organizations should treat this vulnerability with urgency. Implement strict input validation and output encoding for all user-supplied data in the address field to prevent script execution, while prioritizing the transition to a modern, supported version of the software.

Description Summary:
PDF Complete Corporate Edition 4.1.45 contains an unquoted service path vulnerability in the pdfcDispatcher service that allows local attackers to execute arbitrary code with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability in PDF Complete Corporate Edition 4.1.45 allows attackers to execute arbitrary code with LocalSystem privileges due to an unquoted service path.

Vulnerability Details

CVE-ID: CVE-2021-47896

Affected Software: PDF Complete, Inc. PDF Complete Corporate Edition

Affected Versions: 4.1.45

Vulnerability: The application utilizes an unquoted service path for the pdfcDispatcher service, which fails to properly handle spaces in the file path. A local attacker can exploit this by placing a malicious executable in a directory that the service path resolves, resulting in the execution of the payload with LocalSystem privileges.

Business Impact

The exploitation of this vulnerability results in full system compromise, as the malicious code runs with the highest level of administrative permissions on the affected Windows host. This allows an attacker to install persistent backdoors, exfiltrate sensitive data, or disable security controls. While the CVSS score of 7.8 indicates a high severity, the requirement for local access necessitates that organizations prioritize this for systems where untrusted users or applications may have limited local execution rights.

Remediation Plan

Immediate Action: Since a specific patch is not confirmed, administrators should manually modify the Windows Service configuration to quote the path for the pdfcDispatcher service or move the executable to a secure, non-writable location.

Proactive Monitoring: Monitor system logs for the creation of unauthorized executables in the C:\Program Files (x86)\ or C:\Program Files\ directories, particularly those matching service names.

Compensating Controls: Ensure that standard users are restricted from writing files to the root of the system drive or the Program Files directory to prevent the placement of malicious service binaries.

Exploitation Status

Public Exploit Available: Yes, a local exploit is documented in the Exploit Database (EDB-ID 49558).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user with the ability to write files to the path resolution chain of the service.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability poses a significant risk to internal security. Organizations should audit their installations of PDF Complete Corporate Edition and implement the recommended service path hardening immediately to prevent unauthorized privilege escalation.

Description Summary:
Nsauditor 3.2.2.0 contains a resource exhaustion vulnerability in the Event Description field that allows an attacker to trigger an application crash via a large buffer overflow.

Executive Summary:
A buffer overflow vulnerability in Nsauditor 3.2.2.0 allows unauthenticated attackers to cause a denial of service by crashing the application.

Vulnerability Details

CVE-ID: CVE-2021-47895

Affected Software: Nsauditor Nsauditor

Affected Versions: 3.2.2.0

Vulnerability: The application fails to properly limit the size of data accepted in the Event Description field, allowing an attacker to submit a 10,000-character string that triggers an unhandled memory exception and subsequent application crash. This vulnerability is triggered through a local configuration interface, though the lack of input validation makes it susceptible to resource exhaustion.

Business Impact

The exploitation of this vulnerability results in a denial of service, rendering the security auditing tool unavailable for its intended purpose. While the CVSS score of 7.5 indicates a high severity, the primary impact is the interruption of security monitoring capabilities, which may prevent administrators from detecting other malicious activities while the service is offline.

Remediation Plan

Immediate Action: Upgrade to the latest version of Nsauditor immediately, as vendor-supplied patches are the only definitive way to address the underlying memory management flaw.

Proactive Monitoring: Review application logs for signs of repeated service restarts or unexpected crashes that may indicate an attempt to exploit this vulnerability.

Compensating Controls: Restrict access to the application configuration settings to authorized administrative personnel only, thereby limiting the attack surface for this local vector.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept script is available via the Exploit Database (EDB-ID 49568).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly straightforward to replicate using a simple script to generate a large character buffer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for service disruption, organizations should prioritize updating the Nsauditor installation. Administrators must ensure that the software is patched to the latest version to prevent unauthorized service termination and maintain the integrity of their security auditing infrastructure.

Description Summary:
Northwest Performance Software Managed Switch Port Mapping Tool 2.85.2 is susceptible to a denial of service vulnerability triggered by inputting an oversized buffer into specific configuration fields.

Executive Summary:
A denial of service vulnerability in the Managed Switch Port Mapping Tool 2.85.2 allows unauthenticated attackers to crash the application via buffer overflow techniques.

Vulnerability Details

CVE-ID: CVE-2021-47894

Affected Software: Northwest Performance Software, Inc. Managed Switch Port Mapping Tool

Affected Versions: 2.85.2

Vulnerability: The application fails to implement proper bounds checking on the IP Address and SNMP Community Name fields. An unauthenticated attacker can input a 10,000-character buffer to trigger a resource exhaustion condition, resulting in an application crash.

Business Impact

The ability to remotely or locally crash this management tool results in a loss of network visibility and administrative control over switch ports. Given the CVSS score of 7.5, this high-severity flaw can cause significant operational disruption by forcing administrators to manually restart the service, potentially delaying critical network troubleshooting or security response activities.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, users should restrict access to the application interface to trusted administrative networks only.

Proactive Monitoring: Monitor system logs for repeated application crashes or unusual process termination events that may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation to ensure that the management interface is not exposed to untrusted users, as the application lacks robust input validation for configuration parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the Exploit-DB entry 49566.

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit by copying a specifically crafted string into the target fields.

Analyst Recommendation

The vulnerability represents a significant risk to network availability and monitoring capabilities. Because there is currently no vendor-supplied patch, organizations must prioritize network-level access controls to prevent unauthorized interaction with the vulnerable fields. Users are advised to monitor the official vendor website for future updates and to treat this instance as a high-priority configuration security concern.

Description Summary:
AgataSoft PingMaster Pro 2.1 is vulnerable to a denial of service attack via a buffer overflow in the Trace Route feature, allowing local attackers to crash the application.

Executive Summary:
A buffer overflow vulnerability in AgataSoft PingMaster Pro 2.1 allows an attacker to cause an application crash and potential system instability by injecting a malicious payload into the Trace Route host name field.

Vulnerability Details

CVE-ID: CVE-2021-47893

Affected Software: AgataSoft PingMaster Pro

Affected Versions: 2.1

Vulnerability: The application fails to properly sanitize user input in the Trace Route feature, leading to a buffer overflow (CWE-770). This vulnerability can be triggered by an attacker providing a 10,000 character string in the host name field, which results in the application crashing.

Business Impact

The exploitation of this vulnerability results in a denial of service, rendering the PingMaster Pro application unavailable. While the CVSS score of 7.5 indicates a high severity, the primary impact is limited to system instability and operational disruption for the affected workstation. Repeated crashes may lead to significant workflow interruptions for teams relying on the software for network diagnostics.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the application to trusted personnel only and avoid entering untrusted host names into the Trace Route feature.

Proactive Monitoring: Security teams should monitor system logs for frequent application crashes or unexpected service terminations associated with PingMaster Pro.

Compensating Controls: Implement endpoint security policies that restrict the execution of unauthorized or vulnerable software and utilize host based intrusion detection to monitor for buffer overflow attempts.

Exploitation Status

Public Exploit Available: Yes, a proof of concept script is available via the Exploit Database (EDB-ID: 49567).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit given that it requires only a simple buffer overflow string to trigger the crash.

Analyst Recommendation

Given the availability of a public proof of concept and the potential for service disruption, organizations should treat this vulnerability with moderate urgency. Until a vendor update is released, users must exercise caution when using the Trace Route functionality and consider alternative network diagnostic tools if stability becomes a concern.

Description Summary:
PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the purchase page that allows for arbitrary client-side script execution.

Executive Summary:
A stored cross-site scripting vulnerability in PEEL Shopping 9.3.0 allows authenticated attackers to execute malicious JavaScript, potentially leading to session hijacking or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2021-47892

Affected Software: PEEL Shopping

Affected Versions: 9.3.0

Vulnerability: This vulnerability is a stored cross-site scripting flaw located in the Comments or Special Instructions parameter of the purchase page. An authenticated user can inject malicious scripts that execute in the context of the user's browser whenever the page is refreshed.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of other users, including administrators. This can lead to the theft of session cookies, redirection to malicious websites, or the performance of unauthorized actions on behalf of the victim, potentially resulting in full account compromise. While the CVSS score of 7.2 reflects a high risk, the requirement for user interaction and authentication limits the overall impact compared to unauthenticated remote code execution.

Remediation Plan

Immediate Action: Upgrade to the latest available version of PEEL Shopping that addresses this vulnerability. If an update is not immediately available, restrict access to the purchase page to trusted users.

Proactive Monitoring: Review application access logs for suspicious payloads within the Comments or Special Instructions fields. Monitor for unusual client-side behavior or unauthorized changes to account settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common cross-site scripting patterns in HTTP POST requests. Ensure that Content Security Policy (CSP) headers are implemented to restrict the sources from which scripts can be executed.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 49574).

Analyst Notes: As of January 25, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any authenticated user who can reach the purchase workflow.

Analyst Recommendation

Given the availability of a public proof-of-concept and the nature of stored cross-site scripting, organizations utilizing PEEL Shopping 9.3.0 should prioritize patching. If immediate remediation is not feasible, implement strict input validation and sanitization filters on the affected parameter to prevent the injection of malicious scripts.