The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
CVE-2025-49493 is a security vulnerability (CVSS 5.8) that allows file inclusion. Remediation should follow standard vulnerability management procedures.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
We need to produce a JSON object with fields as specified. The CVE data: CVE-2025-6903, description, CVSS Score 5.5 but it says CVSS:4.0 vector which is new. So we need to incorporate that. The CVSS vector provided is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So the base score presumably corresponds to the parts before /E:P. So AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The description says "The attack can be launched remotely." and "The manipulation of the argument ID leads to sql injection." So it's an SQL injection. CWE: CWE-74 (improper neutralization of special elements in output used by a downstream component). But SQL injection is usually CWE-89, but they gave CWE-74. Might be a mistake. We'll reference CWE-74 but note SQL injection is a subset. EPSS 0.05% (low), POC publicly available. No KEV. Reported by VulDB. Affected product: Car Rental System 1.0 by code-projects (PHP). So we need to synthesize all. Now fields: - product_name: "Car Rental System" (3 words, product name). - summary: 2-3 sentences, original synthesis. Mention SQL injection, remote attack, low EPSS but public exploit, no KEV. Example: "SQL injection in Car Rental System 1.0 via the ID parameter in /admin/approve.php allows remote attackers to manipulate database queries. Exploit code is publicly available but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited real-world exploitation likelihood." - technical_context: Explain underlying technology: PHP-based web application, SQL injection due to improper sanitization of input in a PHP script, CWE-74 (but SQL injection is a specific form of injection). Affected product per CPE: anisha:car_rental_system:1.0. This is a code-projects.org project, likely a simple PHP app. The CWE might actually be CWE-89 but they assigned CWE-74, but we can mention it's injection. So: "The vulnerability resides in a PHP script that constructs SQL queries using unsanitised us
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
We need to analyze CVE-2025-6885: PHPGurukul Teachers Record Management System 2.1, SQL injection in /admin/edit-teacher-detail.php via tid. Critical classification, but CVSS? Provided CVSS vector is 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... This is a base score 5.5 (medium) from the vector. But the CVSS 3.1 vector is missing. Need to generate own assessed CVSS 3.1 vector. Given PR:N, UI:N, and attack vector network, but impact low integrity, low confidentiality, low availability? Wait, VC:L, VI:L, VA:L (vulnerable system impact low for all three). So this SQL injection is low impact? But SQL injection typically can be high. Perhaps the attack is limited. The CVSS 4.0 score is from the source (probably VulDB). We'll have to synthesize. Multi-source: EPSS 0.05% (percentile 14%) - very low exploitation probability. No KEV (not in input). POC/Exploit: Publicly available (disclosed to the public). CWE-74? Actually description says sql injection (CWE-89 should be). But provided CWE is CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – generic injection. I'll use that. CPE: phpgurukul:teachers_record_management_system:2.1. Product name: "Teachers Record Management System". 1-3 words. So "Teachers Record Management System". Could be "PHPGurukul Teachers Record Management System" too long, but 1-3 words: "Teachers Record Management System" is fine. Summary: Need original synthesis. Not copy description. Mention SQL injection, remote, POC available, EPSS low, no active exploitation. Mention product and version. "Remote SQL injection in PHPGurukul Teachers Record Management System 2.1 via tid parameter in /admin/edit-teacher-detail.php allows attackers to manipulate database queries, potentially leading to data exposure or modification." Technical context: Underlying technology: PHP web application, SQL injection via parameter tid. Root cause: failure to sanitize in
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerable crash if the client sends a kernel RPC server a specially crafted packet. If decoding the RPC reply fails in such a way that SVC_GARBAGE is returned without setting the rq_accept_statp pointer, then that pointer can be dereferenced and a value stored there. If it's the first time the thread has processed an RPC, then that pointer will be set to NULL and the kernel will crash. In other cases, it could create a memory scribble. The server sunrpc code treats a SVC_GARBAGE return from svc_authenticate or pg_authenticate as if it should send a GARBAGE_ARGS reply. RFC 5531 says that if authentication fails that the RPC should be rejected instead with a status of AUTH_ERR. Handle a SVC_GARBAGE return as an AUTH_ERROR, with a reason of AUTH_BADCRED instead of returning GARBAGE_ARGS in that case. This sidesteps the whole problem of touching the rpc_accept_statp pointer in this situation and avoids the crash.
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The manipulation of the argument filePath leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-52901 is a security vulnerability (CVSS 4.5). Risk factors: public PoC available. Vendor patch is available.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.
A security vulnerability in the default settings of MikroTik RouterOS 7 and fixed in (CVSS 6.5). Remediation should follow standard vulnerability management procedures.
A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
Akamai CloudTest before 60 2025.06.09 (12989) allows SSRF.
CVE-2025-38090 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member-level permissions to bypass system admin restrictions and add or remove users to/from private channels via the playbook run participants feature, even when the 'Manage Members' permission has been explicitly removed. This can lead to unauthorized access to sensitive channel content and allow guest users to gain channel management privileges.
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS.This issue affects Library Software: before 24.11.02.
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not channel members to access sensitive information about linked private channels including channel name, display name, and participant count through the run metadata API endpoint.