CVE-2025-6489 is a critical SQL injection vulnerability in itsourcecode Agri-Trading Online Shopping System version 1.0, affecting the /transactionsave.php file through the 'del' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising confidentiality, integrity, and availability of the application database. Public disclosure of this vulnerability exists, and exploitation is feasible without authentication or user interaction.
CVE-2025-6483 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /edituser.php file's ID parameter. An unauthenticated remote attacker can exploit this weakness to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing the likelihood of active exploitation.
CVE-2025-6482 is a SQL injection vulnerability in Simple Pizza Ordering System 1.0 affecting the /edituser-exec.php endpoint via the userid parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept exploitation available, presenting immediate risk to affected installations. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this represents a moderately critical risk requiring urgent patching.
CVE-2025-6481 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /update.php file's ID parameter, allowing unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept availability, significantly increasing exploitation risk in production environments. With a CVSS score of 7.3 and low attack complexity, this represents an immediate threat to any organization running the affected version without patches.
A SQL injection vulnerability in A vulnerability classified as critical (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6479 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System 1.0 affecting the /salesreport.php file parameter 'dayfrom'. An unauthenticated attacker can remotely execute arbitrary SQL queries with no user interaction required, potentially enabling data exfiltration, modification, or deletion. The vulnerability has been publicly disclosed with exploit proof-of-concept availability, increasing real-world exploitation risk.
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
CVE-2025-6472 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0 affecting the /showprod.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with exploit code available, creating immediate risk for exposed instances.
CVE-2025-6471 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /administrator endpoint, where the 'aduser' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit code is available and the vulnerability is actively exploitable with no authentication required.
CVE-2025-6470 is a critical SQL injection vulnerability in code-projects Online Bidding System 1.0, specifically in the /bidlog.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, presenting immediate exploitation risk. With a CVSS score of 7.3 and network-accessible attack vector requiring no authentication, this poses significant risk to confidentiality, integrity, and availability of affected systems.
A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-6468 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /bidnow.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, potentially compromising confidentiality, integrity, and availability of the entire bidding system. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing exploitation risk in active deployments.
CVE-2025-6467 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /login.php file's User parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially compromise data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score of 7.3 indicates high severity, the attack requires no authentication or user interaction, making it highly exploitable in real-world scenarios.
CVE-2025-6458 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, affecting the /admin/execedituser.php endpoint. An unauthenticated remote attacker can manipulate the 'userid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.
CVE-2025-6457 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0 affecting the /reservation/demo.php file, where the 'Start' parameter is unsanitized and directly used in database queries. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database content including guest information, reservations, and payment data. The vulnerability has been publicly disclosed with exploit code available, though specific EPSS probability and KEV/CISA inclusion status cannot be determined from provided data.
CVE-2025-6456 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0, specifically in the /reservation/order.php file's 'Start' parameter. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available, and the vulnerability is actively exploitable.
CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.
CVE-2025-6451 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/delete_pending.php file where the transaction_id parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion of the hotel reservation database. Public exploit disclosure and active threat indicators suggest this vulnerability warrants immediate patching.
CVE-2025-6450 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/confirm_reserve.php endpoint where the transaction_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability meets criteria for active exploitation risk.
CVE-2025-6449 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System v1.0 affecting the /admin/checkout_query.php endpoint. An unauthenticated remote attacker can manipulate the 'transaction_id' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The vulnerability has been publicly disclosed with exploits available, and the CVSS 7.3 score reflects high impact across confidentiality, integrity, and availability despite moderate attack complexity.
CVE-2025-6448 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/delete_room.php endpoint. An unauthenticated remote attacker can manipulate the room_id parameter to execute arbitrary SQL queries, potentially resulting in unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
CVE-2025-6447 is a critical SQL injection vulnerability in the Simple Online Hotel Reservation System version 1.0, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing the risk of active exploitation.
A security vulnerability in Sangfor aTrust through 2.4.10 (CVSS 4.3) that allows users. Risk factors: public PoC available.
A vulnerability has been found in MarkText up to 0.17.1 and classified as problematic. Affected by this vulnerability is the function getRecommendTitleFromMarkdownString of the file marktext/src/main/utils/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A weakness has been identified in CodeMirror up to 5.65.20. Affected is an unknown function of the file mode/markdown/markdown.js of the component Markdown Mode. This manipulation causes inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 6.0 is able to address this issue. You should upgrade the affected component. Not all code samples mentioned in the GitHub issue can be found. The repository mentions, that "CodeMirror 6 exists, and is [...] much more actively maintained."