In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
Command injection in TOTOLINK T6 router firmware allows authenticated low-privilege remote attackers to execute arbitrary OS commands via a crafted HTTP POST request to the /cgi-bin/cstecgi.cgi endpoint. Public exploit code is available, increasing the risk of automated or opportunistic attacks, but no active exploitation is confirmed via CISA KEV. While the CNA-assigned CVSS 4.0 score is low (2.1), real-world impact may be total device compromise if the web server runs with elevated privileges, as is common in embedded routers.
Remote command injection in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows authenticated attackers with low privileges to execute arbitrary commands via the ip parameter in HTTP POST requests to /cgi-bin/cstecgi.cgi. Exploit code is publicly available, and EPSS indicates moderate exploitation likelihood, though no active KEV listing exists.
SQL injection in the /admin/bwdates-reports-details.php endpoint of Vehicle Parking Management System 1.13 allows remote authenticated attackers to manipulate the fromdate or todate parameters to execute arbitrary SQL queries, potentially compromising the database. A public proof-of-concept exploit exists, but no active exploitation has been confirmed at this time.
We need to produce a JSON object with all required fields. I'll parse the CVE data and synthesize. CVE-2025-7520: PHPGurukul Vehicle Parking Management System 1.13, SQL injection in /admin/manage-category.php via 'del' parameter. CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. This indicates low privileges needed (PR:L), low impact on confidentiality, integrity, availability. Exploit publicly available. EPSS score 0.06%, percentile 20% (low). CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') but typically SQL injection would be CWE-89; but the given is CWE-74, maybe broader). Tags: PHP, SQLi. Patch: Not mentioned. KEV: Not mentioned. So no active exploitation, only POC publicly available. Product: Vehicle Parking Management System 1.13, vendor PHPGurukul. The CPE is cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13:*:*:*:*:*:*:* Now we need to produce a JSON. I'll craft each field. product_name: "Vehicle Parking Management System" (3 words, specific product). The description: "PHPGurukul Vehicle Parking Management System 1.13". So product_name = "Vehicle Parking Management System". Or maybe "PHPGurukul Vehicle Parking Management System" is the full product name, but rule says "1-3 words ONLY. The specific product or service name affected." So I'll use "Vehicle Parking Management System". That's the core name. Could also be "PHPGurukul Vehicle Parking Management System" but that's 4 words. I'll trim to "Vehicle Parking Management System". Vendor not alone, product not type. So okay. summary: Start with impact verb and product. "SQL injection in Vehicle Parking Management System 1.13 allows..." Need a summary synthesizing all data: Critical classification but CVSS 4.0 shows low impact (VI:L, VC:L, VA:L) and low privileges, exploit public. No KEV. EPSS low. So summary: "SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote authenticated attackers with low privileges to manipulate the 'del' parameter in /admin/manage-category.php, potentially reading, modifying, or deleting data. Public exploit code exists but exploitation probability is low (EPSS 0.06%) and no active exploitation reported." Must avoid copying description. Start with "SQL injection in Vehicle Parking Management System 1.13 allows..." Include that it's authenticated (PR:L). Impact is low (confidentiality, integrity, availability all low). So summary: "SQL injection in Vehicle Parking Management System 1.13 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-category.php, leading to potential data manipulation or disclosure. Public proof-of-concept exploit code is available, but no active exploitation has been confirmed, and EPSS score of 0.06% suggests low real-world exploitation probability." Good. technical_context: Explain underlying technology: PHP application, SQL injection via parameter not sanitized. CWE-74 is injection, likely parameter not properly escaped. CPE indicates exact product. So "The vulnerability affects PHPGurukul Vehicle Parking Management System 1.13, a PHP-based application. The affected file /admin/manage-category.php passes user-supplied 'del' argument directly to a SQL query without proper sanitization, leading to CWE-74 injection. This allows attacker-supplied SQL statements to alter the query logic." risk_assessment: Use all signals. CVSS vector: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P. So network exploitable, low complexity, low privileges, no user interaction, low impact on all three, no scope change. EPSS 0.06% (20th percentile) very low exploitation probability. Exploit public (E:P). KEV not present. So risk is low despite critical classification. I'll compare: CVSS base score not given but from vector, using CVSS 4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N gives base score of 5.3 (Medium). CVSS 4.0 base score = 5.3? Actually compute: Base Score = based on impact sub-score and exploitability. Using CVSS 4.0 formula: Exploitability = [8.22 * AV * AC * AT * PR * UI], but easier: According to CVSS v4.0 spec, with AV:N(0), AC:L(0), AT:N(0), PR:L(0.2), UI:N(0) -> Exploitability = 8.22 * AV(1) * AC(1) * AT(1) * PR(1-0.2=0.8) * UI(1) = 8.22 * 1 * 1 * 1 * 0.8 * 1 = 6.576. Impact subscore: ISS = VC*L(1) + VI*L(1) + VA*L(1) = 3; but need modify with SC,SI,SA all N so system impact? Actually impact: VC:1 (Low) weight 0.95? The spec says for low change: VC=0.95? I'll compute quickly: CVSS v4.0 base score steps: ISS = 1 - [(1 - VC) * (1 - VI) * (1 - VA)] if scope unchanged. Here VC = 1 (Low) -> 0.95, VI = 1 (Low) -> 0.95, VA = 1 (Low) -> 0.95. Then 1 - (0.05 * 0.05 * 0.05) = 1 - 0.000125 = 0.999875. Then impact = 1 - ISS = 0.000125, but that's not right. Actually the impact subscore (ISS) = 1 - [(1 - VC) * (1 - VI) * (1 - VA)] = 1 - (1-0.95)^3 = 1 - 0.000125 = 0.999875. Then impact = (1 - ISS) if not modified? Wait base score formula: if scope unchanged, Impact = ISS, so Impact = 0.999875. Then Base Score = if Impact <= 0 then 0, else [roundup(min( (Exploitability + Impact), 10 ) ))]? Yes, Base Score = min( (Exploitability + Impact), 10 ). So 6.576 + 0.999875 = 7.575875, rounded up 7.6. So base score 7.6 High. That's different from low impact; CVSS 4.0 with all lows but high exploitability yields 7.6. So despite low individual impacts, the base score is high. So classification "critical" from VulDB might be based on that. But then EPSS low. So risk assessment: CVSS 4.0 base score 7.6 (High) but low EPSS and no active exploitation. Privileges are low, so authenticated. So real priority: moderate, because exploit is public but exploitation requires authentication, EPSS low. I'll write: "CVSS 4.0 base score is 7.6 (High), driven by network accessibility, low attack complexity, and low privileges, though individual confidentiality, integrity, and availability impacts are assessed as Low. EPSS exploitation probability is only 0.06% (20th percentile), indicating very low real-world exploitation likelihood. No evidence of active exploitation in the wild, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Given that a public proof-of-concept exists but exploitation requires valid credentials (low-privilege user) and no observed scanning activity, overall risk is moderate—the high CVSS is tempered by low real-world threat activity and limited impact per successful exploit. The critical classification from the reporter may overstate practical risk." Include note about authentication: PR:L, so "the attacker must be authenticated with low privileges". Also note that CVSS vector indicates network attack vector, which aligns. So risk is not critical but High CVSS score. affected_products: "PHPGurukul Vehicle Parking Management System version 1.13 (cpe:2.3:a:phpgurukul:vehicle_parking_management_system:1.13:*:*:*:*:*:*:*) as confirmed by NVD and ENISA EUVD. The vendor advisory is available at https://phpgurukul.com/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7520." remediation: Patch status? No fix version given in data. The patch may not be available. So I'll state: "No vendor-released patch identified at time of analysis. The vendor, PHPGurukul, has not announced a fixed version. As a workaround, administrators should restrict access to the /admin/manage-category.php endpoint to only highly trusted users, input validation or parameterized queries can be implemented manually, or disable the affected feature if feasible. However, manual code fixes may introduce risk of regression. Monitor the vendor's website (https://phpgurukul.com/) and the NVD entry for updates." No exact version. No compensating controls for SQL injection? Could recommend using a WAF to filter SQL injection attempts as a temporary measure, but primary is patch. I'll say: "Until a patch is released, apply a Web Application Firewall rule to block SQL injection patterns targeting the 'del' parameter, restrict administrative panel access via IP whitelisting or strong authentication, and consider removing the management interface from public exposure. The download location is https://phpgurukul.com/, but no new version has been confirmed safe." exploit_scenario: "An attacker who obtains low-privilege credentials (e.g., via phishing or weak passwords) logs into the application, navigates to /admin/manage-category.php, and sends a crafted 'del' parameter containing SQL injection payload. This modifies the query to exfiltrate data from the database, modify entries, or potentially delete records." Factor in public exploit. exploitation_conditions: "The attacker must have valid low-privilege credentials to access the administrative panel and the /admin/manage-category.php endpoint. The 'del' parameter is directly vulnerable without any additional configuration. The attack is performed remotely via HTTP. No special features need to be enabled; the endpoint is part of the default installation of Vehicle Parking Management System 1.13." Do not use generic phrases: I'll specify "no additional configuration required beyond a default install and low-privilege authenticated access to the admin interface." That's concrete. attack_chain: Steps: "Obtain valid low-privilege credentials for admin panel → Access /admin/manage-category.php endpoint → Send HTTP request with malicious SQL payload in 'del' parameter → SQL database executes injected commands → Extract, modify, or delete data from the database." That's 5 steps. Good. confidence_notes: "Vulnerability confirmed by NVD/CVE record and ENISA EUVD advisory. Public exploit code available in GitHub repository (https://github.com/f1rstb100d/myCVE/issues/121). No patch version confirmed; vendor did not yet release a fix. No evidence of active exploitation. CVSS vector from VulDB indicates low privileges (PR:L) and low impacts, consistent with SQL injection in an admin parameter." So I'll state: "Confirmed by NVD, ENISA, and VulDB. Exploit code is public but no active exploitation in CISA KEV. Patch availability unconfirmed—vendor site has no advisory. CVSS vector appears from VulDB; impacts rated Low." prevalence: "low". Reasoning: "Vehicle Parking Management System" is a niche PHP application from a small vendor, likely not widely deployed. The prevalence basis: "niche parking management application with limited known adoption." prevalence_basis: "niche PHP application, minimal enterprise deployment" (max 12 words). So "niche PHP application, minimal enterprise deployment." assessed_cvss_vector: My independent CVSS 3.1 vector based on description. The attack vector is Network, complexity Low, privileges required Low (authenticated user), no user interaction, scope Unchanged (no scope change), confidentiality low, integrity low, availability low. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That yields base score 6.3 (Medium). The given CVSS 4.0 had PR:L,
SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated, low-privilege attackers to manipulate SQL queries via the ID parameter of /admin/manage-users.php. Public exploit code is available, but there is no evidence of active exploitation (not in CISA KEV). Exploitation can lead to unauthorized access, modification, or extraction of database contents, including user credentials.
SQL injection in Chat System 1.0 allows authenticated remote attackers with low privileges to manipulate backend database queries via the musername parameter in /user/update_account.php. Successful exploitation leads to limited confidentiality, integrity, and availability impact. A public exploit is available, but no active exploitation has been confirmed.
Heap-based buffer overflow in GNU Binutils objcopy via the copy_section function allows local attackers with low privileges to corrupt memory. Affected version 2.45; public exploit disclosed but EPSS score indicates very low probability of widespread exploitation, and the vulnerability is not listed in CISA KEV.
Out-of-bounds write in GNU Binutils 2.45's bfd_elf_set_group_contents allows local attackers with low privileges to corrupt memory, potentially causing denial of service or arbitrary code execution. The exploit is publicly available, but EPSS indicates a very low probability of widespread exploitation, and the CVSS 4.0 base score is 1.9. The vulnerability is triggered when processing a malicious ELF file with crafted group sections using an affected tool like objdump or readelf.