Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability arises from insecure URL validation using the `startswith()` method, which can be bypassed through URL username injection. This allows attackers to craft URLs that appear to be from YouTube but resolve to malicious domains, potentially leading to phishing attacks, malware distribution, or data exfiltration. The issue is fixed in version 4.52.1.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
Authenticated path traversal in risesoft-y9 Digital-Infrastructure up to 9.6.7 enables remote attackers with low privileges to delete arbitrary files via a crafted fullPath parameter in the deleteFile endpoint. A public proof-of-concept exploit is available; the vendor did not respond to disclosure and no patch is available.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to inject malicious SQL via the adminname parameter in /panel/admin-profile.php, potentially leading to data leakage or tampering. Despite being publicly disclosed with proof-of-concept code, the actual impact is limited according to CVSS 4.0 (score 2.1), and EPSS predicts a low exploitation probability (0.06%).
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the staff_id parameter in the /panel/s
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated remote attackers to manipulate the cid parameter in /users/complaint-details.php, potentially reading or modifying database data. A public proof-of-concept exploit is available, but the vulnerability requires low-privilege user authentication and the impact is limited, as reflected by the low CVSS 4.0 score of 2.1 and EPSS exploitation probability of 0.06%. No active exploitation has been reported via CISA KEV.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).
SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.
Cross-site request forgery (CSRF) in CodeAstro Online Movie Ticket Booking System 1.0 allows remote attackers to trick authenticated users into performing unauthorized actions, such as modifying data. Exploit code is publicly available, but no active exploitation has been reported, and EPSS predicts a very low exploitation probability (0.03%).
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated administrators to manipulate cid/uid parameters via /admin/complaint-details.php, enabling arbitrary SQL query execution that can read or modify database records. A public proof-of-concept exploit is available, but the vulnerability requires high privileges and has low exploitation probability (EPSS 0.06%), with no evidence of active attacks.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.
Stored cross-site scripting in CodeAstro Simple Hospital Management System 1.0 allows authenticated attackers to inject arbitrary web script via POST parameters at /patient.html. A public exploit is available, but EPSS score of 0.05% and low CVSS severity indicate limited real-world exploitation risk. The flaw can compromise patient data integrity in hospital management deployments.
We need to produce a JSON object with the specified fields. The input provides CVE-2025-7113, Portabilis i-Educar 2.9.0, XSS in Curricular Components Module, CVSS 4.0 vector given. We'll synthesize. Product name: "i-Educar" (that's the product, 1-3 words). Actually the product is "i-Educar" by Portabilis. But the description says "Portabilis i-Educar". Product name: "i-Educar". It fits. Summary: Not copy description. Original synthesis: Cross-site scripting in i-Educar 2.9.0's Curricular Components editing page allows remote attackers to inject arbitrary web script via the "Nome" parameter. The vulnerability is publicly disclosed with a POC available, but no evidence of active exploitation. Low severity due to required low privileges and user interaction. Technical context: CWE-79 reflected XSS. Affects i-Educar 2.9.0 exactly (CPE). It's a web application, PHP-based probably. The parameter "Nome" in the component editing URL. We'll mention that. Risk assessment: CVSS 4.0 vector: AV:N/AC:L/PR:L/UI:P, meaning network, low attack complexity, low privileges required, passive user interaction. VC:N, VI:L, VA:N, so manipulated victim sees content, no confidentiality/availability impact. EPSS 0.03% (low) so low exploitation probability. No KEV. POC exists. So overall risk low. SSVC: exploitation: none, automatable: yes (XSS is usually automatable), technical impact: partial (only integrity impact on victim browser). So it's a low priority. Not actively exploited. No response from vendor, so patch status unknown. Affected products: i-Educar version 2.9.0 (CPE: cpe:2.3:a:portabilis:i-educar:2.9.0). No other versions known. Vendor did not respond, so no advisory from vendor. References only VulDB and EUVD. Remediation: No patch from vendor. VulDB suggests no response. Workarounds: disable the component editing page? Or restrict access to authenticated users? But PR:L already required, so the fix would be output encoding of "Nome" parameter. Since no patch, recommend input validation/sanitization and output encoding in the application layer, or use web application firewall to block XSS payloads. Compensating controls: Restrict access to the module to trusted users? Not good because low-privileged user could exploit against higher-privileged user. So use WAF, or update to newer version if available (but not provided). The advisory URL vuldb.com/?id.315024 may have info, but we'll say no vendor patch; implement custom fix. Trade-off: WAF may miss obfuscated payloads; custom fix requires code change. Exploit scenario: Authenticated low-privileged attacker crafts a malicious URL with JavaScript payload in the "Nome" parameter and tricks an admin user into clicking it, stealing session cookies or performing actions in the context of the victim's browser. POC available. Exploitation conditions: Must have a valid low-privilege account on the i-Educar instance, and the victim user must visit the crafted URL with the "Nome" parameter while authenticated. User interaction is required (passive, i.e., victim clicks link). No specific feature enablement beyond default installation. Attack chain: Authenticate as low-privilege user (optional if unauthenticated? Actually PR:L means need to be authenticated. So step: Obtain credentials or access as low-privilege user? But the attacker might be authenticated, but the victim is the target. Attack chain: Authenticated user crafts XSS payload -> Delivers malicious link to victim admin -> Victim opens link while authenticated -> XSS executes in victim's browser -> Impact: script execution in victim's session. So chain: Authenticate as low-privilege user → Craft XSS payload in “Nome” parameter → Send crafted URL to victim → Victim clicks link while authenticated → XSS executes in victim’s browser → Steal session or perform actions. But CVSS vector says PR:L for attack privileges, so attacker needs low privileges. So step 1: Attacker logs in with low-privilege account. The crafted URL involves the "edit" page which typically may require some privileges? But PR:L means attacker with low privilege can craft exploit? That doesn't require logging in to construct URL; anyone can craft the URL, but the vulnerable endpoint /module/ComponenteCurricular/edit?id=ID presumably requires authentication to access, so the victim must be authenticated, but the attacker doesn't need to be authenticated to create the URL. However, the CVSS PR:L indicates "privileges required" for the attack to succeed, meaning the attacker must have some privileges. This is ambiguous: For stored XSS, PR may be low if attacker needs to login to store payload. For reflected, usually PR:N. Here, CVSS:4.0 has PR:L. So likely the attacker needs to be authenticated to access the feature that allows crafting the link? No, the attacker might need to be logged in to the application to cause the victim to be affected? In reflected XSS, the vulnerable parameter is in URL, and the victim just needs to be logged in when clicking. The attacker does not need to be logged in. Yet PR:L in CVSS means "the attacker must possess some privileges to exploit". That suggests perhaps the vulnerable endpoint requires authentication to render the page with the parameter. So the victim must be authenticated, but the attacker doesn't need to be. However, in CVSS v3.1 and v4.0, PR is about the attacker's privileges, not the victim's. So if exploiting the vulnerability requires the attacker to be authenticated (e.g., to access the edit page), then PR:L. I think that's the case: The vulnerable file /module/ComponenteCurricular/edit?id=ID is likely accessible only to authenticated users. But if the attacker can craft a URL that a logged-in user clicks, and the attacker doesn't need to be authenticated, it would be PR:N. However, the CVSS vector says PR:L, so I'll trust that the exploitation requires the attacker to be authenticated (i.e., low-privilege user can craft the URL that includes the XSS payload, and then send to victim). But that seems odd: you could still send a crafted URL without being authenticated; it's just the exploitation of the XSS on the victim requires the victim to be authenticated. The PR metric is "Privileges Required" for the attacker. If the vulnerable component is the web application, and the attacker can only deliver the payload if they have an account (e.g., stored XSS), then PR:L. For reflected, typically PR:N. The description says "manipulation of the argument Nome leads to cross site scripting. It is possible to launch the attack remotely." It doesn't mention authentication requirement. The CVSS vector was provided by VulDB, so they set PR:L. So I'll go with that: exploitation requires low privileges. Attack chain then: Attacker logs in with low-privilege account → Constructs malicious URL with XSS payload in Nome parameter → Sends link to higher-privileged victim → Victim, already authenticated, clicks link → XSS payload executes → Impact. Simplified chain: Authenticate as low-privilege user → Craft XSS payload → Deliver link to victim → Victim opens link → XSS executes → Impact. Will use that. Confidence notes: Confirm: VulDB disclosed, NVD entry, CWE-79, POC available on GitHub, no vendor response. So confirmed that it's XSS, no patch, and no active exploitation. Missing: Vendor advisory, whether a fix exists. Inferred: Patch status unknown. Confidence moderate. Prevalence: i-Educar is a Brazilian school management software. It's a niche product deployed in educational institutions, primarily in Brazil. I'd say low, maybe medium? But it's not ubiquitous. Likely low deployment footprint worldwide. Prevalence: low. Justification: "Brazilian school management software, limited global deployment". So prevalence_basis: "niche school management system, mainly in Brazil". Assessed CVSS vector: I'll provide my own CVSS 3.1 base vector given the vulnerability: reflected XSS, network vector, low complexity, no privileges required? but the CVSS 4.0 says PR:L, so for 3.1 I'd set PR:L as well. So AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N (scope changed because XSS can affect victim's browser context outside of application? Actually for reflected XSS, scope is usually unchanged because the vulnerable component and impacted component are the same application. But if the XSS executes in victim's browser, it can be considered scope unchanged (the impact is on the same vulnerable component as the victim's session). NVD's CVSS 3.1 examples for reflected XSS often show scope unchanged. I'll use S:U/C:N/I:L/A:N. That would be: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. But some use C:L/I:L for content spoofing? The CVSS 4.0 VI:L only, no confidentiality. For 3.1, I:L alone. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N. Rationale: Requires authentication (low priv) and user interaction; only impacts integrity of displayed content. Not actively exploited. That's consistent. CVSS 4.0 vector: The provided vector is for the assessment? It says "CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X". We are to provide our own assessed vector consistent with 3.1. I'll produce a CVSS 4.0 base vector (no temporal/environment), using AT:N as default. So for the same assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. That matches the given vector (excluding the E:P and X's), so I'll just output the base vector. Actually the given vector includes E:P and all X's. I'll strip to base: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Rationale: consistent with assessed 3.1 vector. Now, produce JSON. Ensure strings, not arrays. Use the product name "i-Educar". Summary: "Cross-site scripting in Portabilis i-Educar 2.9.0 Curricular Components Module allows authenticated remote attackers to inject arbitrary web script via the 'Nome' parameter. A public proof-of-concept exploit exists, but no active exploitation has been confirmed." I'll incorporate that. Technical context: "The vulnerability resides in the PHP-based i-Educar web application's Curricular Components Module editing page (file /module/ComponenteCurricular/edit). It stems from insufficient output encoding of the 'Nome' parameter, classified as CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Only version 2.9.0 is confirmed affected per CPE: cpe:2.3:a:portabilis:i-educar:2.9.0." Risk assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N) indicates a low-severity flaw requiring authenticated low privileges and user interaction to inject script that modifies the victim's view. The EPSS score of 0.03% indicates a very low probability of exploitation. While exploit code is publicly available, it is not listed in CISA KEV, and there are no reports of active exploitation. The impact is limited to content spoofing or session hijacking in the victim’s browser, with no direct system compromise. The vendor has not responded, leaving patch availability unknown. Overall risk is low." Affected products: "Portabilis i-Educar version 2.9.0 (CPE: cpe:2.3:a:portabilis:i-educar:2.9.0). No other versions are confirmed vulnerable. The vendor was contacted but did not respond. No official advisory or patch version is available. Reference: VulDB entry 315024." Remed
Cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated attackers to inject arbitrary web script via the 'Função' parameter in the Function Management module. A public exploit is available, but EPSS indicates low exploitation probability (0.03%). The vendor has not responded to disclosures.
Cross-site scripting in Portabilis i-Educar 2.9.0’s Course Module allows authenticated low-privilege users to inject malicious scripts via the ‘Curso’ parameter, potentially compromising other users’ sessions or data. A publicly available proof-of-concept exists, but exploitation requires user interaction and is not known to be actively exploited (EPSS score 0.03%).
Cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated low-privilege attackers to inject arbitrary web scripts via the 'Escola' parameter in the school module. Publicly available exploit code exists, but the vendor has not responded and no patch is available. EPSS score is low (0.03%), indicating low exploitation likelihood.
Cross-site scripting vulnerability in Portabilis i-Educar 2.9.0 allows a remote, authenticated attacker with low privileges to inject arbitrary web script via the Benefício parameter of the Student Benefits Registration page. When a victim views the maliciously crafted request, the script executes in the victim's browser, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Cross-site scripting in Best Salon Management System 1.0 allows authenticated administrators to inject JavaScript via the Admin Name field on the admin profile page, with a publicly available proof-of-concept exploit. While the attack requires high privileges, a crafted payload could execute in another admin's browser when viewing the profile, leading to session token theft or interface manipulation.
Stored cross-site scripting in Best Salon Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the 'Tax Name' parameter on the Update Tax page. The injected script executes when another user views the affected page, potentially enabling session hijacking or phishing attacks. Exploit code is publicly available, but no active exploitation has been confirmed; EPSS indicates a very low likelihood of widespread exploitation.
Cross-site scripting (XSS) in Best Salon Management System 1.0 allows a high-privileged attacker to inject malicious scripts via the search-appointment.php endpoint. An unauthenticated victim user passively interacting with the injected content may suffer low integrity impact in their browser session. The vulnerability has a publicly available proof-of-concept but is not known to be actively exploited.
Cross-site scripting in Best Salon Management System 1.0's Update Staff Page allows authenticated admin-level attackers to inject malicious scripts via the /panel/edit_plan.php endpoint. A publicly available exploit exists, but the EPSS score is negligible (0.04%) and no active exploitation has been reported. The vulnerability requires high privileges and user interaction, limiting its real-world severity.
Cross-site scripting in Best Salon Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Staff Name field on the edit-staff page. A remote attacker with admin access can store a payload that executes in the browser of another admin who views the staff listing, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Stored cross-site scripting in Best Salon Management System 1.0 enables authenticated high-privilege attackers to inject arbitrary JavaScript via the 'Name' parameter on the edit-customer-detailed.php page. The flaw has public exploit code but no active exploitation per CISA KEV, and EPSS indicates a very low exploitation probability (0.04%).
Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the schedule syncing function of watches.
Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the file preview function.
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster [splunk.secret](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/install-splunk-enterprise-securely/deploy-secure-passwords-across-multiple-servers) key. This exposure could happen if you have a Search Head cluster and you configure the Splunk Enterprise `SHCConfig` log channel at the DEBUG logging level in the clustered deployment. <br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. <br><br>See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities), [Deploy a search head cluster](https://help.splunk.com/en/splunk-enterprise/administer/distributed-search/9.4/deploy-search-head-clustering/deploy-a-search-head-cluster), [Deploy secure passwords across multiple servers](https://help.splunk.com/en/splunk-enterprise/administer/manage-users-and-security/9.4/install-splunk-enterprise-securely/deploy-secure-passwords-across-multiple-servers) and [Set a security key for the search head cluster](https://help.splunk.com/splunk-enterprise/administer/distributed-search/9.4/configure-search-head-clustering/set-a-security-key-for-the-search-head-cluster#id_2c54937a_736c_47b5_9485_67e9e390acfa__Set_a_security_key_for_the_search_head_cluster) for more information.
BoyunCMS up to version 1.21 on PHP7 is vulnerable to deserialization via the db_host parameter in the installation
Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affects the following routes: /verify-email, /reset-password/:token, /delete-user/callback, /magic-link/verify, /oauth-proxy-callback. This vulnerability is fixed in 1.2.10.
Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.
A security vulnerability in BoyunCMS (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-7102, using all provided data. The output must be a JSON object with specific fields, all plain text strings. We must cross-reference and analyze beyond paraphrasing. I'll go through each field and construct the content. First, review the input data: - CVE ID: CVE-2025-7102 - Description: BoyunCMS up to 1.4.20 has a vulnerability in file application/update/controller/Server.php, manipulation of argument phone leads to SQL injection. Remote attack possible. Exploit disclosed publicly. - CVSS Score: 2.1? But the vector is CVSS:4.0? The vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X That's a CVSS 4.0 vector with low impact (VC:L/VI:L/VA:L), scope unchanged, PR:L (low privileges required), UI:N (no user interaction), AV:N (network). The CVSS score 2.1 is likely a typo or from CVSS 3.1? Actually the vector is 4.0 base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, which would score higher than 2.1. But we'll use the vector as provided? The vector is given, but the "CVSS Score: 2.1" might be an error. However, for our assessed vectors we'll do our own independent assessment. We'll later produce an assessed CVSS 3.1 and 4.0 vector based on analysis. - CWE: CWE-74, which is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – too broad, SQL injection is more specific. But we'll reference the CWE. - EPSS: 0.05%, percentile 14%. Low probability of exploitation. - KEV status: Not mentioned; likely NO (not in KEV). No KEV data in input. So we assume not actively exploited. - POC: "The exploit has been disclosed to the public and may be used." So publicly available exploit exists. - Tags: PHP, SQLi. - no patch info provided explicitly; patch availability is unknown. - Reported by cna@vuldb.com (VulDB). - CPE: cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:* (asterisk indicates all versions). EUVD lists many BoyunCMS versions 1.4.0 to 1.4.20, so up to that. - References: note-hxlab.wetolink.com/share/sEjaSsXWRNz1 (likely POC/exploit), vuldb.com entries. No vendor advisory. Only NVD page via EUVD. So the product is BoyunCMS, a content management system. Not widely known, likely low prevalence. The vulnerability is SQL injection via the 'phone' parameter in application/update/controller/Server.php. The description says "manipulation of the argument phone leads to sql injection". So it's an injection in a parameter presumably used in an SQL query without proper sanitization. The attack can be initiated remotely, requires low privileges (PR:L from CVSS 4.0), no user interaction. So authenticated but low-privileged user could exploit it. Risk assessment: CVSS 4.0 vector indicates low impact (low on CIA) but CVSS score provided is 2.1 (which seems inconsistent). If we compute CVSS 4.0 base score manually: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L -> Base score around 4.3 maybe? But VC:L/VI:L/VA:L is low, so it's not critical despite being declared critical. The EPSS is very low (0.05%), POC exists but no active exploitation (KEV absent). So real-world risk is relatively low. However, SQL injection can sometimes lead to greater impact if chained, but as described it's low impact. We'll craft a summary, technical context, etc. Ensure not to copy description verbatim. Start summary with specific impact verb: "SQL injection in BoyunCMS". Then explain: what, who, what attacker can do, mention POC, no active exploitation, low EPSS. Technical context: BoyunCMS is a PHP-based CMS. The vulnerability is in the update controller, file Server.php, specifically the phone argument. Based on CWE-74 (injection), likely a parameter used in SQL query without parameterization. The input is handled unsafely, leading to SQL injection. The product CPE indicates all versions up to 1.4.20 affected. No known patch. Risk assessment: Compare signals. CVSS 4.0 vector shows network attack, low complexity, low privileges, low impact on CIA. EPSS extremely low. No KEV, so not actively exploited. POC exists, so threat actors could potentially use it. But impact is limited per CVSS (only low impacts). So real risk is moderate for systems where an authenticated low-privileged user could be malicious. But overall, it's a low severity vulnerability despite being declared critical by source. Affected products: BoyunCMS versions 1.4.0 through 1.4.20 (assuming all 1.4.x). EUVD lists many specific versions, but effectively all 1.4.x. Mention CPE. No vendor advisory links, just the NVD/EUVD page. So no official advisory. References include exploit notes. Remediation: No patch available. Workarounds: restrict access to the update endpoint, disable update controller if possible, or sanitize input via a WAF/mod_security rule. Recommend upgrading when fix available. But the source doesn't provide fix. So we say no vendor-released patch identified. Suggest monitoring VulDB for updates. Exploit scenario: An authenticated attacker with low privileges sends a crafted request to the update functionality, manipulating the phone parameter to inject SQL commands, potentially extracting or modifying data. Exploitation conditions: The attacker must have low-privileged access (as per PR:L). The vulnerable endpoint is the update controller's server.php, specifically the phone argument. The attack is remote over network. So likely requires that the update feature is enabled and accessible. Since it's BoyunCMS, likely admin area? Update functionality may be restricted. So it's not default anonymous access, needs authentication. So condition: authenticated user with low privileges can access the update functionality in BoyunCMS. Attack chain: Access update controller with low-privilege credentials → Craft SQL injection payload in 'phone' parameter → Send request to update endpoint → Malicious SQL queries executed → Low-impact data disclosure/manipulation. Confidence notes: Confirm that exploit is publically disclosed (via note-hxlab link). No vendor fix confirmed. Vulnerable version range from EUVD (up to 1.4.20). EPSS score low. CVSS vector from VulDB. No KEV listing. No vendor advisory found, so patch status unconfirmed. Prevalence: BoyunCMS is an obscure CMS, likely Chinese? Very niche. So prevalence = rare or low. I'll put "rare". Basis: "niche Chinese CMS, minimal enterprise footprint". Assessed CVSS vector: Our independent assessment. The provided CVSS 4.0 gives AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L. For CVSS 3.1 mapping, we need to assess AV:N (because remote), AC:L (no special conditions beyond authentication), PR:L (low privileges), UI:N, scope unchanged? The injection likely affects same component, no scope change. For impact: VC:L (low confidentiality), VI:L (low integrity), VA:L (low availability). So we'd produce CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we must consider if confidentiality, integrity, availability are all low? The description doesn't specify, but the 4.0 vector gave those. So we'll use same. Rationale: "Low-privileged user can inject SQL via phone parameter; no user interaction, network vector." But we could argue AC might be low because SQL injection might be trivial. So that's fine. CVSS 4.0 vector: The same as given, but we'll output based on our assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. No temporal/environmental modifiers. That's consistent. Now construct the JSON. Fields: product_name: "BoyunCMS" summary: "SQL injection in BoyunCMS up to version 1.4.20 allows authenticated low-privileged attackers to manipulate the 'phone' argument in the update controller, leading to potential unauthorized data access or modification. Exploit code is publicly available, but no evidence of active exploitation in the wild. EPSS probability is very low (0.05%), and impact is limited per CVSS scoring, though the vulnerability is labeled critical by the reporter." (ensure starts with impact verb: "SQL injection in BoyunCMS...") technical_context: "BoyunCMS is a PHP-based content management system. The vulnerability resides in the update module at application/update/controller/Server.php, where user-supplied input for the 'phone' parameter is directly incorporated into an SQL query without proper sanitization, as indicated by CWE-74 (Injection). The affected product (cpe:2.3:a:boyuncms_project:boyuncms) includes all versions up to 1.4.20, as confirmed by EUVD enumeration. This typical SQL injection flaw can be exploited by injecting malicious SQL statements through the input field, enabling database query manipulation." risk_assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-accessible flaw requiring low privileges and no user interaction, with only low impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low likelihood of exploitation. Despite being tagged critical by the reporter, the actual CVSS base score computed from the 4.0 vector is moderate, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV). Public exploit code exists, but there is no evidence of active exploitation. This combination of signals suggests that while the flaw is real and exploitable, it poses limited immediate risk, especially given its low impact and the need for authenticated access. Defenders should prioritize based on exposure of the CMS's update functionality to low-privileged users." affected_products: "BoyunCMS versions 1.4.0 to 1.4.20 are affected, as detailed by EUVD (e.g., 1.4.0, 1.4.13, 1.4.20, etc.). The CPE designation cpe:2.3:a:boyuncms_project:boyuncms:* confirms all versions prior to a fix are vulnerable. No official vendor advisory has been published; the primary reference is the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7102 and VulDB at https://vuldb.com/?id.315016." remediation: "No vendor-released patch is currently available. As a temporary mitigation, restrict access to the update endpoint (Server.php) to trusted users only, or disable the update module if not needed. Apply strict input validation for the 'phone' parameter using a web application firewall (WAF) rule to block SQL injection patterns. Monitor the VulDB entry (https://vuldb.com/?id.315016) for a fix and upgrade promptly once a patched version is released. Note that disabling the update feature may break update functionality, so weigh operational needs." exploit_scenario: "A low-privileged authenticated attacker crafts a request to the BoyunCMS update endpoint containing a SQL injection payload in the 'phone' parameter. Successful exploitation could allow extraction of database contents or modification of data within the CMS database, depending on the injected query." exploitation_conditions: "Exploitation requires network access to the BoyunCMS instance and authentication with low privileges (as indicated by CVSS PR:L). The vulnerable endpoint is application/update/controller/Server.php, which must be exposed and accessible. No special configuration beyond the default CMS deployment is needed, but the attacker must have valid credentials with sufficient permission to use the update feature. The attack does not require user interaction."
Server-side request forgery in BoyunCMS up to version 1.4.20 allows remote authenticated attackers to issue arbitrary server-side HTTP requests through the payment component's curl processing. Public exploit code is available, though no active exploitation has been confirmed and the EPSS score remains low at 0.04%.