OS command injection in TOTOLINK CA300-PoE firmware 6.2c.884 allows remote attackers with low privileges to execute arbitrary commands on the device via the QuickSetting function. Exploit code is publicly available, increasing the risk of targeted attacks; no active exploitation has been confirmed by CISA KEV, though EPSS suggests moderate exploit probability (2.45%).
Remote OS command injection in TOTOLINK CA300-PoE firmware 6.2c.884 allows low-privileged authenticated attackers to execute arbitrary commands on the router's operating system via the FileName parameter of the setUpgradeUboot function in upgrade.so. Publicly available exploit code exists, and the EPSS score (2.45%, 85th percentile) indicates a moderate likelihood of exploitation in the wild, though no active exploitation has been confirmed.
OS command injection in TOTOLINK CA300-PoE firmware 6.2c.884 allows authenticated remote attackers to execute arbitrary OS commands via the FileName parameter in the firmware upgrade function. Public exploit code is available, though active exploitation has not been confirmed. EPSS indicates a moderate exploitation probability (2.45%).
OS command injection in TOTOLINK CA300-PoE firmware version 6.2c.884 allows remote authenticated attackers to execute arbitrary operating system commands via the PIN parameter in the SetWLanApcliSettings API. Public exploit code is available, and EPSS indicates a moderate exploitation probability (2.45%).
Unrestricted file upload in code-projects Car Rental System 1.0 allows remote attackers to upload arbitrary files via the image parameter in /admin/add_cars.php. A publicly available exploit exists, potentially leading to remote code execution, though exploitation requires low-privileged access to the admin panel. The vulnerability is not listed in CISA KEV, and EPSS predicts low exploitation probability (0.09%).
Cross-site request forgery in Patient Record Management System 1.0 allows remote attackers to perform unauthorized actions by tricking an authenticated user into clicking a malicious link. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. The EPSS score of 0.07% indicates a very low probability of widespread exploitation.
SQL injection in Best Salon Management System 1.0 allows remote authenticated attackers to query the application database via the fromdate and todate parameters in /panel/bwdates-reports-details.php. The vulnerability has a low CVSS 4.0 base score (impacts limited to low confidentiality, integrity, availability), with a 0.06% EPSS and no known in-the-wild exploitation despite a publicly disclosed exploit.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via the 'editid' parameter in the '/panel/edit-services.php' endpoint. Exploit code is publicly available, though the EPSS score (0.06%) indicates a low probability of exploitation in the wild.
SQL injection in Best Salon Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ID parameter of /panel/stock.php. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated attackers to manipulate database queries via the Type parameter in /panel/add-services.php. Publicly available exploit code exists, but no active exploitation has been confirmed through CISA KEV. The EPSS score of 0.06% suggests a low probability of widespread exploitation.
We are tasked with producing a comprehensive analysis JSON object. Let's extract data from the input. CVE: CVE-2025-6605 Description: A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel/edit-staff.php. The manipulation of the argument editid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. CVSS Score: 2.1 (given; but note the vector is 4.0 and score 2.1 is low; possibly the base score of a 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N -> that gives a score around 2.0-2.3? Let's check CVSS 4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N = base score 2.1 (low). So CVSS 4.0 score 2.1 low severity. The description says "classified as critical" but CVSS base score is low. This might be a discrepancy: the vulnerability is SQL injection but the impact is limited (low integrity, low confidentiality, low availability) likely because of the privileges required (PR:L) and the impact being limited to the application. We'll note that. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). That's a broad category, but SQL injection is CWE-89, so CWE-74 is a parent. So we'll mention it. EPSS: 0.06%, 18th percentile (low likelihood of widespread exploitation) POC/Exploit: Publicly available (the references include a GitHub link) KEV: Not mentioned, so not in KEV. So "no public exploit identified at time of analysis" is wrong; there is public exploit. So we'll use "publicly available exploit code exists" (since POC exists). KEV not present so not actively exploited by that metric. Tags: PHP, SQLi CPE: cpe:2.3:a:mayurik:best_salon_management_system:1.0:*:*:*:*:*:*:* — that's the affected product. So product name: "Best Salon Management System" (by Mayurik). But the description says SourceCodester Best Salon Management System. Probably SourceCodester is the source, vendor Mayurik? We'll use "Best Salon Management System" as product name. Now, for each field: product_name: "Best Salon Management System" (1-3 words). So "Best Salon Management System" fits. summary: Need a synthesis. Impact: SQL injection via editid parameter in /panel/edit-staff.php. Remote attack, but requires privileges (PR:L from CVSS, so authenticated? CVSS vector says PR:L, so low privilege, likely a logged-in user). The EPSS is low, but exploit code exists. CVSS base score low (2.1). So summary: "SQL injection in SourceCodester Best Salon Management System 1.0 allows remote authenticated users to inject SQL via the editid parameter in /panel/edit-staff.php. Exploit code is publicly available, but EPSS exploitation probability is low (0.06%). No active exploitation reported (not in KEV)." technical_context: Explain technology: PHP application, SQL injection. The CWE is CWE-74 (Injection). The specific file /panel/edit-staff.php is part of staff editing functionality. The root cause: improper validation/sanitization of the editid parameter, which is directly used in SQL query. The CPE confirms the specific product and version. So mention PHP and SQLi. risk_assessment: CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N — remote network attack, low attack complexity, no user interaction, low privilege required, low impact on confidentiality, integrity, availability, no scope change. Score 2.1 (Low). But the description says "critical" which is inconsistent; we must highlight that CVSS base score is actually low. EPSS 0.06% (low). POC exists but not known to be actively exploited. So risk is low: low privilege required and limited impact, combined with low EPSS, suggest this is a low-priority issue despite the "critical" classification in the description. Also note: the CVSS vector shows PR:L, so authentication needed, limiting attack surface. affected_products: Product: SourceCodester Best Salon Management System version 1.0. CPE: cpe:2.3:a:mayurik:best_salon_management_system:1.0. Advisory references from VulDB. So write: "SourceCodester Best Salon Management System version 1.0 is affected. The vulnerability is in the /panel/edit-staff.php file. Vendor advisory is available at VulDB (https://vuldb.com/?id.313822) and a PoC exploit is hosted on GitHub (https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-6.md)." remediation: No patch explicitly mentioned. We need to check input: the description does not mention a fix version, and the references include VulDB entries that might have patch info, but input does not mention a patch. The patch field is not provided, so we must state "No vendor-released patch identified at time of analysis." But we can suggest mitigating controls: restrict access to /panel/edit-staff.php to trusted users, implement input validation/sanitization for the editid parameter, use parameterized queries. Since the vulnerability requires authentication, ensure strong password policies and limit access to admin panel. Note trade-offs. So we'll write: "No official patch is available from the vendor at the time of analysis. As a workaround, restrict access to the administrative panel (/panel/) to trusted IP addresses and require strong authentication. Implement input validation and parameterized queries to prevent SQL injection in the editid parameter. Alternatively, consider disabling the vulnerable functionality if possible, though this may break staff editing features." Specific, actionable. exploit_scenario: "An authenticated low-privileged user sends a crafted editid parameter in a request to /panel/edit-staff.php to inject SQL commands, potentially extracting database contents or altering records." (Since the CVSS impact: low on all three, so not full database compromise, but still data exposure and manipulation). Since exploit is public, an attacker could use the PoC. exploitation_conditions: Conditions: attacker must be authenticated (low privilege), as indicated by CVSS PR:L. No specific non-default configuration required beyond the application being deployed. So we state: "Low-privileged authenticated access to the application's administrative panel is required; no other special conditions are needed beyond default installation." Not just "network access required" generic. We add: "The vulnerability is in /panel/edit-staff.php, so the attacker must have a valid user account with privilege to edit staff (or at least access the panel)." So exact feature: staff editing functionality. That's a concrete condition. attack_chain: Will use 4-step? Steps: Access authenticated session → Send crafted editid parameter → SQL injection executes → Data leakage/manipulation. So: "Authenticate to Best Salon Management System panel → Send crafted HTTP request to /panel/edit-staff.php with malicious editid parameter → SQL injection executes against backend database → Extract or modify database records." With limited impact, so no code execution. confidence_notes: "Exploit code is publicly available, confirmed by GitHub repository. No vendor patch identified; affected product versions confirmed via CPE. EPSS and CVSS derived from VulDB; CVSS 4.0 score is low despite 'critical' classification in description, likely due to the low privileges and limited impact." Also, CWE-74 is broad; the underlying issue is SQL injection. The data from VulDB is the primary source; no NVD analysis yet (just references). So note that. prevalence: "low" – Best Salon Management System is a niche product for salon management, likely small business usage, not ubiquitous. So prevalence: low. prevalence_basis: "niche salon management system, limited enterprise deployment" (less than 12 words). So "low deployment footprint for a specialized salon management application." assessed_cvss_vector: Our independent assessment? Based on description and CVSS 4.0 vector given, it's already a 4.0 vector. We need to provide CVSS 3.1 vector equivalent. We'll convert the 4.0 vector to 3.1 as best we can: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That matches 3.1 base score: (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) = 6.5 (Medium). Wait, that would be 6.5, not 2.1. The given CVSS 4.0 vector has low impact on VC/VI/VA, which in 4.0 yields low severity because the impact metrics are weighted differently. In 3.1, L/L/L for C/I/A gives 0.22 impact sub-score and 6.5 base. But our vector must be consistent with the actual severity. According to the CVSS 4.0 specification, a vector with AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N yields a score of 2.1 (Low). If we translate that to 3.1, it would be AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L = 6.5, which is Medium. This suggests the 4.0 vector "downgrades" because impact is low? Wait, in 3.1, L/L/L for a low-privilege attack is Medium, not Low. The CVSS 4.0 introduces new severity levels; low score 2.1 might be "Low" in 4.0, but in 3.1 it would be "Medium". So to be independent, we can provide a 3.1 vector that reflects the actual technical risk. But we are asked to provide an independent assessment, grounded in description. I'll assess: The vulnerability is SQL injection, remote, authenticated (low privilege), no user interaction, scope unchanged, impact likely low on confidentiality, integrity, availability? For SQL injection, usually you can extract data, modify data, and possibly cause denial by dropping tables. So impact could be high, but from CVSS it's limited to low maybe because the vulnerable parameter only affects a specific table and the user has low privileges? The description doesn't specify. Given the public exploit likely shows limited injection, but a skilled attacker could escalate. To be cautious, I'd set C:L/I:L/A:L if authentication is needed. So my independent 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (score 6.5). I'll provide that with rationale: "Requires low-privilege authentication, no user interaction, and limited data exposure in default configuration; however, SQL injection can potentially escalate impact." But I'll note that the given CVSS 4.0 vector shows low impact, and I'll reflect that. Actually, the input includes a CVSS vector already, so I could just use that 4.0 vector for assessed_cvss40_vector, but the instruction says "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." So I'll create my own 3.1, and also a 4.0 that's consistent with my 3.1. Since the input's 4.0 has low impact and low score, my independent assessment might produce a higher impact (e.g., C:H/I:H/A:H) for SQLi, but I need to be grounded in description: The description says it leads to SQL injection, but the CVSS 4.0 given says low impact on all three. Why? Possibly because the attacker is only low privilege and the database user might also have limited permissions, or the injection point is such that only simple injection possible? The description doesn't elaborate. However, typical SQL injection can lead to full database compromise. But the authoritative source is the VulDB entry which assigned low impact. It's risky to overrule that without further data. I'll stick to a moderate approach: I'll assign C:L/I:L/A:L, acknowledging that higher impact might be possible but not confirmed. So rationale: "Authenticated SQL injection with limited impact likely due to restricted database permissions, but could potentially be escalated." So 3.1 vector: CVSS:3.1
SQL injection in Best Salon Management System 1.0 through the Name parameter in /panel/add-staff.php allows authenticated remote attackers to read, modify, or delete database contents. Publicly available exploit code exists, but the low EPSS score (0.06%) and low CVSS impact suggest limited real-world exploitation risk.
SQL injection in Best Salon Management System 1.0 allows remote attackers with low privileges to manipulate database queries via the viewid parameter in /view-appointment.php. A public proof-of-concept exploit exists but active exploitation is not confirmed. The flaw can lead to unauthorized data access or modification.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote authenticated attackers to manipulate the editid parameter in /edit-customer-detailed.php, potentially leading to unauthorized data access or modification. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed.
SQL injection in itsourcecode Employee Management System 1.0 allows remote attackers to manipulate SQL queries via the FirstName parameter in /admin/editempprofile.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS 0.06%). The vulnerability requires admin authentication and can lead to unauthorized data access or modification.
Cross-site scripting in PHPGurukul Hospital Management System 4.0 allows authenticated attackers to inject malicious scripts via the Name parameter in /doctor/manage-patient.php. Successful exploitation modifies user-facing content with no confidentiality or availability impact. A public Proof of Concept exists, but EPSS is very low (0.05%) and the vulnerability is not listed in CISA KEV, indicating limited real-world exploitation likelihood.
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26985.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26733.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26732.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26731.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26730.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26726.
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26724.
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26712.
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26709.
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26671.
PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26643.
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26532.
PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-26528.
Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. This vulnerability (CVE-2025-4656) has been remediated in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11, 1.17.17, and 1.16.22.
A security vulnerability in gooaclok819 sublinkX (CVSS 3.7). Remediation should follow standard vulnerability management procedures.
Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access. Exploitation of this issue does not require user interaction.