Analysis

Plane versions before 1.4.0 ship fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in the aio and cli community deployment manifests, and these stay active when operators do not override them. The record lists a CVSS 3.1 base score of 9.8 (critical). The record states the issue is fixed in 1.4.0, and no confirmed exploitation appears in the sources consulted.

CVE-2020-37027 is a critical OS command injection flaw (CWE-78) in Sickbeard alpha, which the record says can be triggered by unauthenticated remote attackers through the extra scripts configuration. VulnCheck scores it 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0. The record lists no KEV entry, no affected version ranges and no fixed version, so defenders should focus on isolating or removing exposed installations.

CVE-2026-20407 is a flaw in the MediaTek WLAN STA driver caused by a missing bounds check, classified as CWE-787 (out-of-bounds write). The vendor-derived description states that it allows local privilege escalation with user-level execution and no user interaction, and NVD records a CVSS 3.1 base score of 9.3 (critical). The record lists no fixed version and no confirmed exploitation, so administrators should check the MediaTek February 2026 bulletin for the builds they run.

CVE-2025-49380 is a critical deserialization of untrusted data flaw (CWE-502) in the WooCommerce Vehicle Parts Finder plugin by wpinstinct, which allows object injection. The CNA scored it 9.8 under CVSS 3.1, and the description covers versions from n/a through 3.7. The record shows no KEV listing and no fixed version, so administrators should verify their plugin status and reduce exposure.

CVE-2026-1590 is an SQL injection weakness in the itsourcecode School Management System 1.0, triggered through manipulation of the ID argument in a faculty module page. The NVD assigns a CVSS 3.1 base score of 9.8 (Critical), and the CNA VulDB publishes additional scores under other CVSS versions. The record states that a public exploit is available, but it is not listed in CISA KEV and no confirmed active exploitation appears in the sources consulted.

CVE-2025-57794 affects Explorance Blue versions prior to 8.14.9. An authenticated user of the administrative interface can upload files of dangerous types because the application does not adequately restrict them, and the record states this enables remote code execution under default configurations. The record rates it critical with a CVSS 3.1 base score of 9.1.

CVE-2025-63624 is an SQL injection flaw in the IoT smart water meter monitoring platform from Shandong Kede Electronics Co., Ltd, version 1.0, reachable through the imei_list.aspx file. The record describes it as allowing a remote attacker to execute arbitrary code and assigns a CVSS 3.1 base score of 9.8. No fixed version or CISA KEV listing appears in the record, so organizations should prioritize access restriction and vendor follow-up.

CVE-2025-7015 is a session fixation weakness (CWE-384) in Akinsoft QR Menu, affecting versions before s1.05.12. NVD rates it critical at 9.8, while the CNA USOM rates it 5.7 under CVSS 3.1. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

A SQL injection weakness was reported in code-projects Online Music Site 1.0, in the AdminEditUser.php file, through the ID argument. The record states the attack can be started remotely and that a public exploit is available, and NVD scores it 9.8 (CVSS 3.1, critical). The record does not list the CVE in CISA KEV, and the sources consulted show no confirmed exploitation in the wild.

CVE-2025-61506 affects MediaCrush through version 1.0.1 and allows remote, unauthenticated users to upload arbitrary files of any size via the /upload endpoint. The record maps it to CWE-434 and assigns a CVSS 3.1 base score of 9.8 (Critical). The record shows no KEV listing, no EPSS value and no fixed version.

CVE-2026-1593 is an SQL injection weakness in the administrative file /admin/edit_expenses_query.php of the itsourcecode Society Management System 1.0, triggered through the detail argument. NVD scored it 9.8 (critical) under CVSS 3.1, while the CNA VulDB scored it 7.3 under CVSS 3.1. The record states that a public exploit exists, but CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted.

Johnson Controls reported a critical command injection weakness (CWE-77) affecting several Metasys components and related configuration tools where SQL Express is deployed as part of the installation. The record states that successful exploitation could allow remote SQL execution. The sources consulted show no confirmed exploitation, and the record does not list fixed versions.

AirControl 1.4.2 is reported to allow unauthenticated remote code execution through Java expression injection on the /.seam endpoint. The record carries a CVSS 3.1 score of 9.8 (critical), but it lists no affected versions, no fixed versions and no confirmed exploitation. Defenders should restrict access to the management interface and verify vendor updates.

ASUSTOR Data Master (ADM) contains an improper input validation flaw in a CGI program that is reachable when a specific function is enabled while joining an AD domain. The record states that an unauthenticated remote attacker could write arbitrary data to any file, and NVD rates the issue 9.8 (Critical) under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

CVE-2025-69602 is a session fixation flaw in 66biolinks version 62.0.0 by AltumCode, where the session identifier is not regenerated after successful authentication. The NVD record rates it critical with CVSS 3.1 score 9.1 and maps it to CWE-384. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.