Laravel Livewire v3 through v3.6.3 contains a critical remote code execution vulnerability (CVE-2025-54068, CVSS 9.8) that allows unauthenticated attackers to execute commands through improper hydration of component property updates. KEV-listed with EPSS 16%, this vulnerability affects one of the most popular PHP frameworks, potentially compromising thousands of Laravel applications using Livewire for reactive server-side rendering.
Remote code execution in Island Lake Consulting's WebBatch prior to version 2025C allows remote attackers to run arbitrary code by supplying a crafted URL. Rated CVSS 9.8 with an unauthenticated network vector (PR:N/UI:N), the flaw stems from code injection (CWE-94) in the product's URL handling, giving full confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-interaction profile makes it a high-priority patch candidate.
SQL injection in PHPGurukul Land Record System 1.0 via the editid parameter of edit-property.php allows remote attackers to execute arbitrary SQL queries. Exploit code is publicly available, though no active exploitation is reported (not in CISA KEV). The vulnerability has a low real-world exploitation probability (EPSS 0.07%) and limited impact.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
Heap buffer overflow in 7-Zip's RAR5 handler writes zeroes beyond allocated heap memory, causing memory corruption and denial of service in versions prior to 25.0.0. Local attackers can trigger this vulnerability by crafting malicious RAR5 archive files. Publicly available exploit code exists, making this a moderate-priority local vulnerability despite its network-isolated attack surface.
Weak cryptography in Brocade Active Support Connectivity Gateway (ASCG) versions prior to 3.3.0 exposes local communications on internal ports 9000 and 8036 to potential decryption and tampering. Local attackers with no privileges can compromise confidentiality and integrity of data transmitted through these internal service ports. No public exploit identified at time of analysis. EPSS data not available, but the local attack vector (AV:L) limits remote exploitation risk despite the 8.6 CVSS score.
JSON Web Token exposure in Brocade Active Support Connectivity Gateway (ASCG) prior to version 3.3.0 enables high-privileged local attackers to extract unencrypted authentication tokens from log files, leading to unauthorized access and session hijacking. This CWE-532 (insertion of sensitive information into log file) vulnerability requires local access with high privileges but presents low attack complexity. EPSS data not provided; no confirmed active exploitation (not present in CISA KEV); no public exploit code identified at time of analysis. The CVSS 4.0 score of 7.1 reflects significant confidentiality and integrity impact within the vulnerable component scope.
Server-side request forgery (SSRF) in thinkgem JeeSite up to version 5.12.0 allows authenticated remote attackers to manipulate the Source argument in the UEditor Image Grabber component (ActionEnter.java), enabling arbitrary HTTP requests from the vulnerable server with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and a patch has been released by the vendor.
Open redirect vulnerability in JeeSite up to version 5.12.0 allows unauthenticated remote attackers to redirect users to arbitrary external websites via a crafted redirect parameter in the Site Controller select function. The vulnerability requires user interaction (clicking a malicious link) but carries low integrity impact through browser-based redirection. Publicly available exploit code exists, and a patch is available from the vendor; however, the EPSS score of 0.11% indicates low real-world exploitation probability despite public disclosure.
Unrestricted file upload in code-projects Online Ordering System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /admin/edit_product.php, enabling remote code execution. The vulnerability affects the admin product editing functionality and has publicly available exploit code; however, the low CVSS score (2.1) and minimal EPSS percentile (26%) indicate limited real-world exploitation despite authenticated access requirements.
Cross-site request forgery (CSRF) vulnerability in code-projects E-Commerce Site version 1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users via a crafted request. The vulnerability requires user interaction (e.g., clicking a malicious link) and affects the integrity of user sessions. Publicly available exploit code exists, though the EPSS score of 0.06% indicates low real-world exploitation probability relative to the attack surface.
SQL injection in Patient Record Management System 1.0 via the itr_no parameter in /xray_form.php allows authenticated remote attackers to execute arbitrary SQL queries with low confidentiality, integrity, and availability impact. The vulnerability requires valid user credentials (PR:L) but can be exploited remotely over the network. Public exploit code is available, though real-world exploitation risk remains low given the EPSS score of 0.04% and limited scope of impact (local scope only, no confidentiality/integrity/availability impact to the system itself).
Stored cross-site scripting (XSS) in Scada-LTS up to version 2.7.8.1 allows authenticated remote attackers to inject malicious scripts via the Username parameter in the usersProfiles.shtm file, with user interaction required to trigger payload execution. The vulnerability has a very low CVSS score (2.0) due to authentication and user interaction requirements, but public exploit code is available and vendor has confirmed remediation in version 2.8.0.
Stored cross-site scripting (XSS) in Scada-LTS up to 2.7.8.1 allows authenticated users to inject malicious scripts via the Username parameter in the users.shtm file, enabling session hijacking or credential theft when administrators view affected user profiles. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, resulting in low integrity impact. Public exploit code exists, though active exploitation has not been confirmed beyond disclosure. The vendor confirmed remediation in version 2.8.0.
Reflected XSS in Beakon Learning Management System SCORM v5.4.3 allows an authenticated remote attacker to inject arbitrary JavaScript into a victim's browser session via the unsanitized `url` parameter of the SCORM loader endpoint. The PoC published on PacketStorm demonstrates direct cookie theft using a `javascript:alert(document.cookie)` payload, confirming the vulnerability is exploitable without specialized tooling. No patch has been identified at time of analysis; no public exploit identified at time of analysis beyond the published PoC, and EPSS at 0.25% (17th percentile) reflects low observed exploitation activity consistent with a niche product.
Reflected cross-site scripting (XSS) in ZCMS 3.6.0 Create Article Page allows authenticated attackers to inject malicious scripts via the Title parameter. The vulnerability requires user interaction (clicking a malicious link) and results in limited impact to integrity, with EPSS score of 0.05% (14th percentile) indicating minimal real-world exploitation probability despite public disclosure.