The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulnerability. Attackers can upload PHP files disguised with image extensions and then rename them back to .php using the plugin's built-in rename functionality, bypassing all upload restrictions.
The AIT CSV Import/Export WordPress plugin through version 3.0.3 allows unauthorized arbitrary file uploads without file type validation. The upload handler in upload-handler.php is accessible without authentication, enabling remote attackers to deploy PHP webshells and achieve code execution on the WordPress server.
The Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and restore-info.json. Unauthenticated attackers can discover and download complete site backups containing the database, wp-config.php with credentials, and all uploaded files.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upload_handle() function due to missing file type validation, allowing unauthenticated attackers to upload malicious files and potentially achieve remote code execution. With a CVSS score of 9.8, network-accessible attack vector, and no authentication requirement, this vulnerability poses an immediate and severe threat to any WordPress installation using the affected plugin.
A buffer overflow vulnerability in A vulnerability (CVSS 8.8). Risk factors: public PoC available.
CVE-2025-7465 is a critical remote buffer overflow vulnerability in Tenda FH1201 firmware version 1.2.0.14 affecting the HTTP POST request handler's fromRouteStatic function. An authenticated attacker can exploit improper input validation on the 'page' parameter to achieve remote code execution with full system compromise (confidentiality, integrity, and availability impact). A public proof-of-concept exploit exists and the vulnerability may be actively exploited in the wild.
A critical buffer overflow vulnerability exists in Tenda FH1201 wireless router firmware version 1.2.0.14, located in the HTTP POST handler for wireless safety settings. An authenticated attacker can remotely exploit this vulnerability by sending a crafted request with an oversized 'mit_ssid' parameter to the /goform/AdvSetWrlsafeset endpoint, achieving remote code execution with complete system compromise (confidentiality, integrity, and availability). A public proof-of-concept exploit is available, and this vulnerability meets CISA KEV criteria for active exploitation in the wild.
CVE-2025-7506 is a critical stack-based buffer overflow vulnerability in Tenda FH451 router firmware version 1.0.0.9, exploitable via the HTTP POST parameter 'page' in the /goform/Natlimit endpoint. An authenticated remote attacker can achieve complete system compromise (code execution, data exfiltration, denial of service) without user interaction. Public exploit code is available, indicating active disclosure and likely exploitation in the wild.
CVE-2025-7505 is a critical stack-based buffer overflow vulnerability in Tenda FH451 v1.0.0.9 affecting the HTTP POST request handler's L7 protocol filter functionality. An authenticated attacker can remotely exploit this vulnerability by manipulating the 'page' parameter to achieve arbitrary code execution with full system compromise (confidentiality, integrity, and availability impact). Public exploit code has been disclosed and the vulnerability meets CISA KEV criteria for active exploitation risk.
The Friends plugin for WordPress versions up to 3.5.1 contains a PHP Object Injection vulnerability in the query_vars parameter that allows authenticated subscribers and above to inject malicious serialized objects through unsafe deserialization. While the plugin itself lacks a known gadget chain (POP chain), successful exploitation depends on the presence of vulnerable code in other installed plugins or themes; if such a chain exists, attackers can achieve arbitrary file deletion, data exfiltration, or remote code execution, but exploitation requires knowledge of the site's SALT_NONCE and SALT_KEY values.
CVE-2025-5199 is a local privilege escalation vulnerability in Canonical Multipass up to version 1.15.1 on macOS, where incorrect default file permissions on a Launch Daemon allow an authenticated local attacker to modify files executed with administrative privileges during system startup. An attacker with local user access can escalate to root/administrator level through file manipulation, presenting a high-impact privilege escalation risk on affected macOS systems.
CVE-2023-38036 is a critical unauthenticated buffer overflow vulnerability in Ivanti Avalanche Manager prior to version 6.4.1 that allows remote attackers to cause denial of service or achieve arbitrary code execution without authentication. With a CVSS score of 9.8 and network-based attack vector, this vulnerability has significant real-world exploitability risk and affects all organizations deploying vulnerable Avalanche Manager instances.
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
A critical SQL injection vulnerability exists in 1000projects ABC Courier Management version 1.0 affecting the /add_dealerrequest.php endpoint, where the 'Name' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it an active threat.
CVE-2025-7483 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /users/forgot-password.php endpoint's email parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant concern.
CVE-2025-7480 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, located in the /users/signup.php file where the email parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, though no KEV or EPSS data is referenced in the provided intelligence.
CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.
CVE-2025-7476 is a critical SQL injection vulnerability in code-projects Simple Car Rental System 1.0 affecting the /admin/approve.php endpoint's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, elevating real-world risk despite the CVSS 7.3 score suggesting moderate impact.
CVE-2025-7475 is a critical SQL injection vulnerability in code-projects Simple Car Rental System version 1.0, located in the /pay.php file where the 'mpesa' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. The vulnerability has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk in real-world deployments.
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
CVE-2025-7469 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the product addition functionality (/pages/product_add.php). An unauthenticated remote attacker can manipulate the 'prod_name' parameter to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely in the near term.
CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
A remote code execution vulnerability in all (CVSS 8.8). High severity vulnerability requiring prompt remediation.
The Nokri - Job Board WordPress Theme contains a critical privilege escalation vulnerability (CVE-2025-1313) affecting all versions up to 1.6.3, where authenticated Subscriber-level users can change arbitrary user email addresses without proper identity validation. This allows attackers to reset administrator passwords and achieve complete account takeover, resulting in full WordPress site compromise. With a CVSS score of 8.8 and low attack complexity requiring only valid subscriber credentials, this vulnerability poses significant real-world risk to WordPress installations using this theme.
CVE-2025-24294 is a Denial of Service vulnerability in DNS packet parsing libraries (specifically the resolv library) caused by insufficient validation of decompressed domain name lengths. An attacker can send a crafted DNS packet with a highly compressed domain name that, when decompressed, consumes excessive CPU resources without limit, causing the parsing thread to become unresponsive. The vulnerability affects any application using the vulnerable resolv library and has a CVSS score of 7.5 (high severity); real-world exploitation probability and active exploitation status cannot be confirmed without EPSS score and KEV data.
CVE-2024-41169 is an unauthenticated information disclosure vulnerability in Apache Zeppelin's raft server protocol that allows remote attackers to enumerate and view server resources, including sensitive directories and files, without authentication. Versions 0.10.1 through 0.12.0 are affected. The vulnerability has a CVSS score of 7.5 (High) with a network-accessible attack vector and no authentication requirements, making it trivially exploitable by unauthenticated remote actors.
A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_recv_handler/s1ap_recv_handler/recv_handler of the component SCTP Partial Message Handler. The manipulation leads to reachable assertion. The attack needs to be approached locally. The patch is named cfa44575020f3fb045fd971358442053c8684d3d. It is recommended to apply a patch to fix this issue.
CVE-2023-39338 is a security vulnerability (CVSS 6.8) that allows the user. Remediation should follow standard vulnerability management procedures.
IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-incomingvehicle.php. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed by CISA KEV. The attack is launched remotely, with an EPSS likelihood of 0.06%, indicating very low exploitation probability despite a critical severity rating.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged authenticated remote attackers to inject arbitrary SQL via the 'del' parameter of /admin/manage-outgoingvehicle.php. This can lead to unauthorized data access or manipulation. A publicly available exploit exists, but no active exploitation (CISA KEV) is confirmed.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers to manipulate database queries via the 'vid' parameter in the /users/print.php endpoint. The vulnerability is publicly disclosed with exploit code available, though no active exploitation in the wild has been confirmed. It requires low-privilege authentication for exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System version 1.13 allows authenticated low-privileged attackers to manipulate database queries via the 'del' parameter in the admin panel's user management page. Exploit code is publicly available, but no active exploitation has been reported, and the EPSS score (0.06%) indicates a low likelihood of widespread exploitation.
We need to generate a JSON object with multiple fields, each a plain text string. The CVE is CVE-2025-7489, a SQL injection in PHPGurukul Vehicle Parking Management System 1.13. The description says: "A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13 and classified as critical. This issue affects some unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used." Data provided: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (likely the base vector without temporal, but it's included in the CVSS field). EPSS: 0.06% (low). No KEV status, so not actively exploited. POC publicly available. CWE-74 (improper neutralization of special elements in output used by a downstream component ('Injection')), but specific to SQL injection? The CWE-74 is a broad parent. Possibly the description says SQL injection. Tags: PHP, SQLi. So it's a classic SQLi. Product: PHPGurukul Vehicle Parking Management System 1.13. That's a PHP application for vehicle parking management. The vulnerability is in the admin section: /admin/search-vehicle.php with searchdata parameter. So authenticated? The CVSS 4.0 vector includes PR:L (privileges required low). So it requires some low privilege, likely admin login. So it's authenticated SQL injection. The exploit is disclosed. EPSS 0.06% very low. We need to fill fields: - product_name: "Vehicle Parking Management System" (3 words). "PHPGurukul Vehicle Parking Management System" is longer, but I'll pick the product name: "Vehicle Parking Management System". Or better "PHPGurukul Vehicle Parking Management System"? Only 3 words. Maybe "Vehicle Parking Management" (3 words) but that's too generic. The CPE product is php_file_manager? Actually CPE: cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13. So product name is "Vehicle Parking Management System". That's 4 words: Vehicle, Parking, Management, System. I can use "Vehicle Parking Management System" (4 words). The instruction says "1-3 words ONLY." So I must condense. Options: "Vehicle Parking Management" (3 words) but that might miss "System". Could be "PHPGurukul Parking Management" but that's 3 words. The vendor is PHPGurukul. I'll use "Parking Management System" (3 words) but that might be ambiguous. Better: "Vehicle Parking System" (3 words). That's short, but the official name is "Vehicle Parking Management System". I'll use "Vehicle Parking Management System" as 4 words? The instruction is strict: "1-3 words ONLY." So maybe "PHPGurukul Parking System"? Not exactly. The important thing is to uniquely identify. I'll use "Vehicle Parking Management" (3 words: Vehicle, Parking, Management). That's acceptable. I'll go with "Vehicle Parking Management System" actually violates the word count. Let's count: "Vehicle" (1), "Parking" (2), "Management" (3), "System" (4). So 4 words. So I'll use "PHPGurukul Parking Mgmt" not consistent. I'll follow the instruction strictly: 1-3 words only. I'll pick "PHPGurukul Vehicle Parking" (3 words) but that's not the product name. The product name is "Vehicle Parking Management System". I'll try "PHPGurukul Parking System" (3 words). Might work. However, the CPE says "vehicle_parking_management_system". The product name is "Vehicle Parking Management System". I'll output "Vehicle Parking Management" (3 words). That accurately denotes the software. I'll use "Vehicle Parking Management". That's fine. - summary: Start with specific impact verb and product. It's SQL injection, remote, authenticated low-privilege user can perform SQL injection on search parameter. POC publicly available. EPSS very low. So summary: "Authenticated SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged remote attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-vehicle.php, potentially leading to data exfiltration or manipulation." And mention exploit public, low EPSS risk. Not actively exploited. Use original synthesis: "Authenticated SQL injection in PHPGurukul Vehicle Parking Management System 1.13 enables remote low-privileged attackers to inject SQL via the searchdata parameter of the admin search-vehicle endpoint, potentially leading to data theft or tampering. Public exploit code is available, but EPSS indicates a low exploitation probability (0.06%) and no active exploitation has been reported." - technical_context: "The vulnerability resides in a PHP-based web application using the MySQL database. The /admin/search-vehicle.php endpoint likely constructs SQL queries by concatenating unsanitized user input from the 'searchdata' parameter, corresponding to CWE-89 (SQL Injection). The affected product, per CPE cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13, is a vehicle parking management system by PHPGurukul. The root cause is improper neutralization of special elements in SQL queries, allowing attackers to modify query logic." I'll mention CWE-74 but map to SQL injection. - risk_assessment: Using CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So network exploitable, low user interaction, low privileges required, impacts low confidentiality, integrity, availability (all low) on the vulnerable system only. CVSS score 2.1? Wait, NVD gave CVSS score 2.1, but with vector that rates low impact? Score is 2.1 (Low). EPSS 0.06% very low. KEV not listed, so not actively exploited. Public exploit available but that hasn't translated into high exploitation. So risk is low despite being "critical" classification in description (vuldb may have classified critical). Real risk seems low because it requires authentication and low impact, but SQL injection could lead to data compromise. I need to assess using SSVC: exploitation status: no active exploitation; automatable: likely automatable (simple request); technical impact: partial (low impacts per CVSS). So a low priority. I'll state: "While the vulnerability is critical per the vendor, CVSS 4.0 scores it at 2.1 (Low) due to low impacts and required low privileges. EPSS confirms low exploitation probability. No KEV listing. The attack requires authentication, limiting exposure to users with valid credentials. Overall real-world risk is low, but organizations using this system should still patch given public exploit availability." I'll compare signals. - affected_products: "PHPGurukul Vehicle Parking Management System version 1.13 is confirmed affected. No other versions are listed. Vendor advisory not available. References include the NVD entry and a GitHub exploit report." I'll list the version. - remediation: "Upgrade to a patched version if available; as of now, no official fix has been released. As a workaround, implement input validation (prepared statements) on the searchdata parameter in /admin/search-vehicle.php, or apply a web application firewall rule to block SQL injection patterns. Disabling the vulnerable search feature may be a temporary measure. Monitor vendor site (https://phpgurukul.com/) for patches." I need to be specific: exact version not given, so "no vendor-released patch identified". The references are exploit and vuldb pages, no patch. So remediation: "No vendor-released patch identified. As an immediate mitigation, modify the application code to use parameterized queries, or restrict access to the admin panel to trusted IP addresses. Alternatively, disable the search-vehicle.php endpoint until a fix is available. Follow vendor updates at https://phpgurukul.com/." - exploit_scenario: "A low-privileged attacker with access to the admin dashboard submits a malicious SQL payload via the searchdata parameter in the search-vehicle.php page, causing the application to execute unintended SQL commands, leading to extraction of sensitive data from the database." POC is publicly available, so note that. Attack vector is network, requires authentication. - exploitation_conditions: Need specific conditions from description. It says "unknown processing of the file /admin/search-vehicle.php. The manipulation of the argument searchdata leads to sql injection." So exploitation requires access to /admin/search-vehicle.php, which implies an authenticated session (admin), as the path is /admin/. Also low privileges required per CVSS vector (PR:L). So condition: "Requires authentication to the administrative panel of PHPGurukul Vehicle Parking Management System, and access to the search-vehicle functionality. The vulnerability is present in default deployments without input sanitization on the searchdata parameter." So I'll write: "The vulnerable endpoint /admin/search-vehicle.php is only accessible after authentication; therefore an attacker must have valid credentials (low-privilege admin) to exploit. No other special configuration is needed—the flaw exists in the default code handling the searchdata parameter." So limiting factor: authentication. - attack_chain: Steps: 1) Gain low-privilege admin access to the vehicle parking management system (e.g., default credentials or credential theft). 2) Send a crafted HTTP request to /admin/search-vehicle.php with searchdata containing SQL injection payload. 3) The back-end PHP script concatenates the payload into an SQL query without sanitization. 4) The database executes the malicious SQL, returning manipulated results or exfiltrating data. So chain: "Obtain low-privilege admin credentials → Access /admin/search-vehicle.php → Inject SQL payload via searchdata parameter → Manipulate database queries → Exfiltrate or modify data." Use arrow notation. So: "Authenticate to admin panel → Craft malicious searchdata payload → Inject SQL query via search-vehicle.php → Database executes malicious query → Extract sensitive data." That's 5 steps. - confidence_notes: "NVD confirmed the vulnerability with CVSS 4.0 vector and CWE-74. The exploit is publicly available on GitHub. No CISA KEV listing, and no vendor advisory found. Affected product version is exactly 1.13 per CPE; other versions unknown. Authenticated requirement inferred from CVSS vector PR:L." So: "Confirmed: vulnerability exists per NVD and VulDB; public exploit available. Inferred: authentication required from CVSS PR:L. Unknown: whether other versions are affected, and if a vendor patch exists." - prevalence: PHPGurukul's Vehicle Parking Management System is a niche PHP project from a small vendor, likely not widely deployed. It's not a major enterprise product. So prevalence: low. Justification: "small-scale PHP application, niche parking management system." - prevalence_basis: "niche parking management software from a small developer" (max 12 words). "niche PHP parking management software, limited installations." - assessed_cvss_vector: Based on description and conditions, I'll provide a 3.1 vector. AV:N since remote, AC:L because SQL injection usually low complexity, PR:L (authenticated low-privilege), UI:N, S:C? No scope change? The SQL injection would impact the database, but likely no scope change. CVSS 4.0 had VC:L, VI:L, VA:L, SC:N. For 3.1: If no scope change, S:U, C:L/I:L/A:L. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That's a base score 6.5? Actually low impact all, base score would be 4.3? Let me compute: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L gives score 4.3 (Medium). But NVD gave CVSS 4.0 score 2.1. But this is my independent assessment. I'll justify: "Low-privilege attack via network, no user interaction, low impact on confidentiality, integrity, availability; no scope change." So vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L". Rationale: "Requires low-privilege authentication (PR:L) but easy exploitation, limited impact on data." - assessed_cvss40_vector: Convert to CVSS 4.0. Use AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI
SQL injection in PHPGurukul Vehicle Parking System 1.13 allows authenticated remote attackers to manipulate database queries via the 'viewid' parameter in /admin/view-outgoingvehicle-detail.php. Successful exploitation can result in unauthorized reading or modification of data, though only low-level impacts are expected. Public exploit code exists, but active exploitation is not confirmed.
We need to produce a JSON object with all the required fields. Let's break down the input data: - CVE ID: CVE-2025-7481 - Description: "A vulnerability was found in PHPGurukul Vehicle Parking Management System 1.13. It has been classified as critical. This affects an unknown part of the file /users/profile.php. The manipulation of the argument firstname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well." - CVSS Score: 2.1 (but that seems to be CVSS 3.1? Actually the CVSS vector is 4.0, so the score 2.1 is likely CVSS 4.0 base score? The CVSS vector is 4.0 with E:P, base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That yields base score 5.1? Wait, CVSS 4.0 base formula: for VC:L/VI:L/VA:L, SC:N/... the base score is 5.1? Let's check: typical CVSS 4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N gives base 5.1. But the input says CVSS Score: 2.1. This might be the environmental score? Or maybe they computed the base incorrectly. But we'll note that the provided CVSS vector is there. The score 2.1 might be the temporal or something. Since it's given, we can use it but we'll also reassess and provide our own vectors. We are to provide assessed_cvss_vector and assessed_cvss40_vector. - CWE: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). Actually CWE-74 is general injection. SQL injection is typically CWE-89, but they gave 74. - EPSS: 0.06% (percentile 17%) - low. - POC/Exploit: Publicly available (from references GitHub issue, likely POC). Not in KEV, so no active exploitation. - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13:*:*:*:*:*:*:* (so only version 1.13, no range given) - Tags: PHP, SQLi - ENISA EUVD ID, Affected versions list same. - References: exploit link github.com/f1rstb100d/myCVE/issues/111, phpgurukul.com, vuldb.com/?id.316131, etc. Now, we need to synthesize. The product name: "PHPGurukul Vehicle Parking Management System" but product_name field says "1-3 words ONLY" and "The specific product or service name affected." So the product is "Vehicle Parking Management System". But vendor is PHPGurukul. So product_name should be "Vehicle Parking Management System"? Or maybe "PHPGurukul VPMS"? Since the requirement: "Not the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So primary product: "Vehicle Parking Management System" (3 words). Possibly we can include "PHPGurukul" as part? It says 1-3 words only, so it's okay to use "PHPGurukul Vehicle Parking Management System" but that's 4 words. "Vehicle Parking Management System" is 4 words. Actually "Vehicle Parking Management System" is 4 words. So maybe just "Parking Management System"? But to be precise, I'd use "Vehicle Parking Management System" (4 words) but the rule says 1-3 words ONLY. So we need to shorten: maybe "PHPGurukul VPMS" (2 words), but VPMS isn't standard. Or "PHPGurukul Parking" (2 words). However the description says "PHPGurukul Vehicle Parking Management System 1.13". The most specific 1-3 word product name: "Vehicle Parking System"? "Vehicle Parking Management System" has 4 words. So "Parking Management System" (3 words) but drops "Vehicle". I'll use "Vehicle Parking System"? But that might not be exact. The product's name is "Vehicle Parking Management System". Since it's from PHPGurukul, maybe "PHPGurukul VPMS". Let's look at CPE: product: vehicle_parking_management_system. So the product name is "vehicle_parking_management_system". In natural words, "Vehicle Parking Management System". The requirement: "1-3 words ONLY." So I cannot use 4 words. So I'll use "Vehicle Parking Management". Or "Parking Management System". I'll go with "Parking Management System" (3 words) but it loses "Vehicle". Or "Vehicle Parking System". That's 3 words and captures the essence. I'll pick "Vehicle Parking System". But the official name is longer. The note says "the specific product or service name affected". So I'd better use "Vehicle Parking Management System" but that's 4 words; maybe the rules aren't strict? The prompt says "1-3 words ONLY". So I must respect it. Could be "PHPGurukul VPMS" if we treat VPMS as an acronym. Better: "Vehicle Parking System" (3 words) is acceptable. I'll use "Vehicle Parking System". The CPE confirms the product name. However, to be precise, I could use "Vehicle Management System"? That's also 3 words but drops Parking. I'll stick with "Vehicle Parking System". But that's not the exact name; the exact name is "Vehicle Parking Management System". I think the requirement is strict; I'll choose "Parking Management System" (3 words) as it's a subset. Or "PHPGurukul VPMS" if I treat VPMS as one word. But the prompt warns "NOT the vendor alone", so I can't use "PHPGurukul". So I'll use "Vehicle Parking Management" (3 words) dropping "System". So product_name: "Vehicle Parking Management". That's 3 words and identifies the product. Summary: "Remote SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows attackers to extract sensitive data." Must not copy description. Start with impact verb and product: "SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote authenticated attackers (or unauthenticated? Wait, CVSS vector shows PR:L, so requires low privileges. So authenticated). The exploitation condition: an attacker with low privileges (probably a regular user) can manipulate the 'firstname' parameter in the /users/profile.php endpoint to inject SQL commands. This can lead to unauthorized access to database contents. A public exploit is available, though no active exploitation is confirmed. EPSS score is low (0.06%)." Technical_context: Explain the underlying technology: PHP application with SQL injection via user input 'firstname' parameter in profile update functionality. The vulnerability resides in the profile.php file, likely not properly sanitizing the firstname input before constructing SQL queries. CWE-74 indicates injection flaw, specifically SQL injection. Use CPE to identify exact product. So: "The vulnerability is an SQL injection flaw in the profile update logic of PHPGurukul Vehicle Parking Management System 1.13. The affected file /users/profile.php handles user profile edits, where the 'firstname' parameter is directly incorporated into an SQL query without proper sanitization, leading to CWE-74 (improper output neutralization). The application is built with PHP, and exploitation is possible via HTTP requests. The CPE identifier confirms only version 1.13 is affected." Risk_assessment: "CVSS 4.0 score of 2.1 indicates low severity, but the base metrics (AV:N, AC:L, PR:L, UI:N, VC:L/VI:L/VA:L) suggest a more moderate impact. The EPSS probability of 0.06% indicates very low exploitation likelihood in the wild. KEV is absent, and while a public exploit exists, there is no evidence of active exploitation. The attack requires a low-privileged account (PR:L), making it less accessible than unauthenticated attacks. Overall, this is a low-priority vulnerability with limited real-world risk given the niche product and authentication requirement. However, if the system handles sensitive parking data, unauthorized SQL queries could lead to data breach. The severe score discrepancy: the provided CVSS 4.0 base score should be 5.1 based on the vector, but the listed score is 2.1, possibly due to environmental metrics or error. We assess risk as moderate for organizations using this unmaintained software." Mention that there's conflicting CVSS. I'll state: "The CVSS 4.0 vector provided (AV:N/PR:L/VC:L/VI:L/VA:L) yields a base score of 5.1, but the advisory lists 2.1 — likely due to environmental modifiers. The EPSS (0.06%) suggests very low exploitation likelihood." So risk is not high. Affected_products: "PHPGurukul Vehicle Parking Management System version 1.13 is affected. The CPE identifier is cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13. The vendor's website is phpgurukul.com. An advisory is available at vuldb.com/?id.316131." Remediation: "No vendor-released patch has been identified. The vendor PHPGurukul has not issued a fix. As a workaround, implement parameterized queries in the profile.php file to sanitize 'firstname' and other input parameters. Alternatively, restrict access to the /users/profile.php endpoint to trusted users only, or disable the profile editing feature temporarily. Input validation and application-layer web application firewall rules to block SQL injection patterns can mitigate risk until a patch is available. Since the product appears unmaintained, consider migrating to a supported alternative." Exploit_scenario: "An attacker with a low-privileged user account (e.g., a regular vehicle owner) sends a crafted HTTP POST request to /users/profile.php with a malicious 'firstname' value containing SQL commands. The database executes the injected query, allowing the attacker to extract usernames, passwords, or parking records." Exploitation_conditions: "The attacker must have a valid low-privileged account on the vehicle parking management system. No special configuration is required besides the default installation; the profile editing feature is presumably enabled by default. The injection occurs in the 'firstname' parameter when updating profile information." Attack_chain: "Authenticate as low-privileged user → Access /users/profile.php → Submit crafted firstname parameter with SQL payload → Database executes injected query → Exfiltrate sensitive data or modify records." Could be more kill chain: Recon (identify target) → Authenticate → Exploit → Execution → Impact. So: "Reconnaissance to obtain user credentials → Authenticate as regular user → Send malicious POST to profile.php → SQL injection alters database queries → Exfiltrate data or escalate privileges." Confidence_notes: "Exploit publicly disclosed via GitHub (f1rstb100d/myCVE/issues/111). No CISA KEV indication. Affected versions confirmed by NVD and ENISA EUVD. CVSS score discrepancy noted: vector-based base score is 5.1, but advisory lists 2.1. Vendor patch availability is not confirmed — PHPGurukul website does not list a fix." Prevalence: Given that it's a niche product from PHPGurukul, likely low. I'll say "low". Basis: "niche parking management software, not widely deployed." Prevalence_basis: "Niche vehicle parking system, small deployment footprint." That's under 12 words. Assessed_cvss_vector: Our own independent CVSS 3.1 vector. Since the vulnerability is SQL injection, remote, low privileges, no user interaction. Impact: confidentiality (L), integrity (L), availability (L). CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. So vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That's a base score of 6.3 (medium). But wait, the description says "manipulation of the argument firstname leads to sql injection", typical SQL injection can sometimes read arbitrary data, so confidentiality might be high. But CVSS vector provided has VC:L, VI:L, VA:L, so we might align that. We'll set C:L/I:L/A:L. So vector CVSS:3.1/AV:N/AC:L/PR
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows an authenticated attacker with low privileges to execute arbitrary SQL commands via the viewid parameter of /users/view--detail.php. A publicly available exploit exists, but no active exploitation has been reported in CISA KEV and EPSS probability is very low (0.06%).
Unrestricted file upload in Code-projects Simple Car Rental System 1.0 allows authenticated administrators to upload malicious files via /admin/add_cars.php, potentially leading to remote code execution. A public proof-of-concept exploit exists, but no active exploitation has been reported. EPSS score of 0.07% indicates low probability of widespread attacks.
The Modern Events Calendar Lite plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'wp_ajax_mec_load_single_page' AJAX action in all versions up to, and including, 6.3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable on sites with addslashes disabled.
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation leads to null pointer dereference. It is possible to initiate the attack remotely. The identifier of the patch is 619a106ba4c4abed95110f84d5efcd7aee38c7cb. It is recommended to apply a patch to fix this issue.
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
Path traversal vulnerability in SpringBoot_MyBatisPlus up to commit a6a8255 allows remote authenticated attackers to read arbitrary files via the Name parameter in the /file/download endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.05%), indicating low exploitation likelihood.
Unrestricted file upload in SpringBoot_MyBatisPlus through commit a6a8255 allows authenticated remote attackers to upload arbitrary files via the portraitFile parameter at /file/upload. A public exploit exists, but EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed. The impact is rated low by the provided CVSS vector, though typical unrestricted uploads can lead to code execution.
Rejected reason: Not used. No vendor patch available.