CVE-2025-27889 is a security vulnerability (CVSS 3.4). Risk factors: public PoC available.
Remote OS command injection in Netgear D6400 firmware 1.0.0.114 allows authenticated attackers to execute arbitrary commands via the diag.cgi host_name parameter. Public exploit code exists, and the vendor confirmed the vulnerability, but no patch will be issued because the product is end-of-life. EPSS score is low (0.79%) indicating limited likelihood of widespread exploitation despite the exploit's availability.
OS command injection in Tenda O3V2 firmware version 1.0.0.12(3880) via the domain parameter in the /goform/setPingInfo endpoint allows authenticated remote attackers to execute arbitrary commands on the device. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. Despite a low CVSS 4.0 base score of 2.1 assigned by the reporter, the vulnerability is rated Critical by the disclosing source.
Command injection in the httpd component of Tenda O3V2 firmware version 1.0.0.12(3880) allows remote authenticated attackers with low privileges to execute arbitrary operating system commands via the dest parameter of /goform/getTraceroute. Public exploit code is available, though no active exploitation has been confirmed (no CISA KEV entry). The vulnerability has a moderate EPSS score (0.65%), indicating a limited but non-negligible probability of exploitation.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
Cross-site scripting (XSS) in SourceCodester Zoo Management System 1.0 allows authenticated remote attackers to inject arbitrary web script via the 'msg' argument of the animal form template. Exploit code is publicly available, but no active exploitation has been confirmed and the EPSS score indicates very low exploitation probability.
Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.
A security vulnerability in Dradis (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
Cross-site scripting in certain Zoom Clients before version 6.4.5 may allow an authenticated user to conduct a disclosure of information via network access.
An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests.
An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated users with invitation privileges to bypass group-level user invitation restrictions by manipulating group invitation functionality.