CVE Vulnerability Advisory Database

[Affected Scope] Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.30

[Impact] Low-privileged authenticated users (such as Subscribers) can bypass capability checks to send arbitrary emails with spoofed sender addresses

[Mitigation] Immediately update the Kali Forms plugin to version 2.4.30 or later

[Affected Scope] Booktics WordPress plugin versions up to 1.0.31.

[Impact] Authenticated users with low privileges can access unauthorized data or functions due to broken access control.

[Mitigation] Update to the latest version (1.0.32 or higher) immediately.

[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)

[Impact] Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.

[Mitigation] Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.

[Affected Scope] Appsmith versions 1.94 and below with publicly accessible applications

[Impact] Unauthenticated attackers can execute unpublished (edit-mode) actions, leading to sensitive data exposure, unauthorized database queries, and side-effect behaviors

[Mitigation] Restrict public access to applications and implement request filtering on reverse proxies or WAFs to block unauthorized edit-mode execution requests

[Affected Scope] SonicWall SMA1000 appliances utilizing the Appliance Management Console (AMC)

[Impact] High-privileged attackers can exploit insufficient authorization to escalate privileges to root, leading to complete system compromise

[Mitigation] Apply the official security patches immediately and restrict network access to the management console

[Affected Scope] Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software with Remote Access VPN enabled

[Impact] Unauthenticated remote attackers can bypass authentication to access restricted VPN-related URL endpoints, and active exploit variants can trigger unexpected device reloads, causing a complete Denial of Service (DoS)

[Mitigation] Immediately upgrade to the fixed software releases recommended in the official Cisco Security Advisory

[Affected Scope] DELMIA Apriso from Release 2020 through Release 2025

[Impact] Unauthenticated remote attackers can bypass authorization checks to gain privileged access to the application

[Mitigation] Apply official security patches immediately, restrict external access, and enforce IP-based access control lists

[Affected Scope] Digiever DS-2105 Pro devices running firmware version 3.1.0.71-11 and prior (including End-of-Life products)

[Impact] Authenticated attackers can execute arbitrary OS commands with root privileges via the vulnerable CGI script

[Mitigation] Immediately isolate affected devices from the public internet and restrict access using firewalls or WAF rules

[Affected Scope] SimpleHelp remote support software v5.5.7 and earlier versions

[Impact] Low-privilege technician accounts can generate API keys with excessive permissions, leading to full server administrator privilege escalation

[Mitigation] Immediately upgrade to SimpleHelp v5.5.8 or later, and audit all existing API keys for unauthorized creation

[Affected Scope] Container environments and host OS running Linux kernel versions prior to v5.17-rc3

[Impact] An attacker inside a container can bypass namespace isolation, escalate privileges to host root, and execute arbitrary code

[Mitigation] Update the Linux kernel to the patched version, and enforce container security profiles (AppArmor, Seccomp, non-root users)