Command injection in Tenda AC9 router firmware 15.03.02.13 allows remote authenticated attackers to execute arbitrary commands via the 'list' parameter in the formSetIptv handler. A public exploit is available, and EPSS score (2.05%, 84th percentile) indicates moderate exploitation likelihood, though no active exploitation in CISA KEV is reported.
SQL injection vulnerability in PHPGurukul Employee Record Management System 1.3 allows remote authenticated attackers to manipulate the AdminName parameter in /admin/adminprofile.php, potentially exposing or modifying database contents. A public proof-of-concept exploit exists, though EPSS scores indicate a low probability of widespread exploitation (0.06%).
SQL injection in PHPGurukul Employee Record Management System 1.3 allows authenticated attackers to execute arbitrary SQL commands via the delid parameter in /admin/allemployees.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.06%), indicating limited exploitation likelihood.