Sudo before 1.9.17p1 contains a local root escalation vulnerability (CVE-2025-32463, CVSS 9.3) through the --chroot option, which loads /etc/nsswitch.conf from the user-controlled chroot directory instead of the host system. KEV-listed with EPSS 26.5% and public PoC, this vulnerability allows any user with sudo --chroot access to achieve root privileges by placing a malicious nsswitch configuration and library in their chroot.
Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write operations through crafted HTML pages. KEV-listed with public PoC, type confusion in V8 is the most reliable class of browser exploitation primitives, providing full memory read/write capability for code execution within the renderer sandbox.
Incorrect host matching in Sudo before 1.9.17p1 allows local attackers to execute commands on unintended machines when the sudoers file lists a specific host that is neither the current host nor ALL. This flaw (CWE-863) enables privilege escalation across system boundaries with a CVSS 8.8 (high) and EPSS exploitation probability of 17.4%, and publicly available exploit code increases real-world risk.
An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via system() function in the bin/goahead file
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A vulnerability was found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this issue is some unknown functionality of the file /goform/SetSysTimeCfg. The manipulation of the argument time/timeZone leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability has been found in Tenda AC5 15.03.06.47 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. The manipulation of the argument schedStartTime/schedEndTime leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was found in D-Link DI-8100 16.07.21. It has been rated as critical. Affected by this issue is some unknown functionality of the file /pppoe_base.asp of the component jhttpd. The manipulation of the argument mschap_en leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Several services in Honor Device Co., Ltd Honor PC Manager v16.0.0.118 was discovered to connect services to the named pipe iMateBookAssistant with default or overly permissive security attributes, leading to a privilege escalation.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.
Authentication bypass in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows adjacent network attackers to manipulate the authCode or goURL parameters to bypass authentication on the /formLoginAuth.htm endpoint. The vulnerability enables unauthorized access to administrative functions without credentials. Publicly available exploit code exists, but no active exploitation has been confirmed.
string-math v1.2.2 was discovered to contain a Regex Denial of Service (ReDoS) which is exploited via a crafted input.
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
CVE-2025-49493 is a security vulnerability (CVSS 5.8) that allows file inclusion. Remediation should follow standard vulnerability management procedures.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLottie: V0.2.
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie: V0.2.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.2.
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
We need to produce a JSON object with fields as specified. The CVE data: CVE-2025-6903, description, CVSS Score 5.5 but it says CVSS:4.0 vector which is new. So we need to incorporate that. The CVSS vector provided is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So the base score presumably corresponds to the parts before /E:P. So AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The description says "The attack can be launched remotely." and "The manipulation of the argument ID leads to sql injection." So it's an SQL injection. CWE: CWE-74 (improper neutralization of special elements in output used by a downstream component). But SQL injection is usually CWE-89, but they gave CWE-74. Might be a mistake. We'll reference CWE-74 but note SQL injection is a subset. EPSS 0.05% (low), POC publicly available. No KEV. Reported by VulDB. Affected product: Car Rental System 1.0 by code-projects (PHP). So we need to synthesize all. Now fields: - product_name: "Car Rental System" (3 words, product name). - summary: 2-3 sentences, original synthesis. Mention SQL injection, remote attack, low EPSS but public exploit, no KEV. Example: "SQL injection in Car Rental System 1.0 via the ID parameter in /admin/approve.php allows remote attackers to manipulate database queries. Exploit code is publicly available but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited real-world exploitation likelihood." - technical_context: Explain underlying technology: PHP-based web application, SQL injection due to improper sanitization of input in a PHP script, CWE-74 (but SQL injection is a specific form of injection). Affected product per CPE: anisha:car_rental_system:1.0. This is a code-projects.org project, likely a simple PHP app. The CWE might actually be CWE-89 but they assigned CWE-74, but we can mention it's injection. So: "The vulnerability resides in a PHP script that constructs SQL queries using unsanitised us
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
We need to analyze CVE-2025-6885: PHPGurukul Teachers Record Management System 2.1, SQL injection in /admin/edit-teacher-detail.php via tid. Critical classification, but CVSS? Provided CVSS vector is 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... This is a base score 5.5 (medium) from the vector. But the CVSS 3.1 vector is missing. Need to generate own assessed CVSS 3.1 vector. Given PR:N, UI:N, and attack vector network, but impact low integrity, low confidentiality, low availability? Wait, VC:L, VI:L, VA:L (vulnerable system impact low for all three). So this SQL injection is low impact? But SQL injection typically can be high. Perhaps the attack is limited. The CVSS 4.0 score is from the source (probably VulDB). We'll have to synthesize. Multi-source: EPSS 0.05% (percentile 14%) - very low exploitation probability. No KEV (not in input). POC/Exploit: Publicly available (disclosed to the public). CWE-74? Actually description says sql injection (CWE-89 should be). But provided CWE is CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – generic injection. I'll use that. CPE: phpgurukul:teachers_record_management_system:2.1. Product name: "Teachers Record Management System". 1-3 words. So "Teachers Record Management System". Could be "PHPGurukul Teachers Record Management System" too long, but 1-3 words: "Teachers Record Management System" is fine. Summary: Need original synthesis. Not copy description. Mention SQL injection, remote, POC available, EPSS low, no active exploitation. Mention product and version. "Remote SQL injection in PHPGurukul Teachers Record Management System 2.1 via tid parameter in /admin/edit-teacher-detail.php allows attackers to manipulate database queries, potentially leading to data exposure or modification." Technical context: Underlying technology: PHP web application, SQL injection via parameter tid. Root cause: failure to sanitize in
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash.
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2.
A vulnerability classified as critical has been found in D-Link DIR-513 1.0. This affects an unknown part of the file /goform/formSetWanPPTP. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In OpenShift, it can lead to service account token theft.
A security vulnerability in A flaw (CVSS 8.8) that allows an authenticated attacker. High severity vulnerability requiring prompt remediation.
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
Dell OpenManage Network Integration, versions prior to 3.8, contains an Authentication Bypass by Capture-replay vulnerability in the RADIUS protocol. An attacker with local network access could potentially exploit this vulnerability to forge a valid protocol accept message in response to a failed authentication request.
CVE-2025-52901 is a security vulnerability (CVSS 4.5). Risk factors: public PoC available. Vendor patch is available.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Delta Electronics DTN Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
Delta Electronics DTM Soft Project File Parsing Deserialization of Untrusted Data Remote Code Execution
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in taprio_dev_notifier Since taprio’s taprio_dev_notifier() isn’t protected by an RCU read-side critical section, a race with advance_sched() can lead to a use-after-free. Adding rcu_read_lock() inside taprio_dev_notifier() prevents this.
The endpoint hosts a script that allows an unauthorized remote attacker to put the system in a fail-safe state over the network due to missing authentication.
A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading.
CVE-2025-52996 is a security vulnerability (CVSS 3.1). Risk factors: public PoC available.