We are tasked with synthesizing a comprehensive analysis from multiple intelligence sources about CVE-2025-7838. The input includes: CVE ID, description, CVSS score (5.5 with CVSS 4.0 vector), CWE (CWE-74), EPSS (0.09%, percentile 25%), POC publicly available, reported by cna@vuldb.com, CPE for campcodes online movie theater seat reservation system 1.0, tags PHP, SQLi, etc. References include an exploit link and VulDB links. The description says a vulnerability in /admin/manage_seat.php allows SQL injection via the ID argument. Attack can be initiated remotely, exploit disclosed publicly. We need to output a JSON object with specified fields. Let's extract data: - product_name: "Online Movie Theater Seat Reservation System" (or maybe just "Campcodes Online Movie Theater Seat Reservation System")? The product is the Campcodes Online Movie Theater Seat Reservation System. Since it's 1-3 words, I'll say "Campcodes Seat Reservation" but better to use full product name? It says "1-3 words ONLY". The specific product: "Online Movie Theater Seat Reservation System". That's 5 words. Maybe just "Movie Theater Seat Reservation"? Or "Campcodes Seat Reservation"? I'll use "Online Movie Theater Seat Reservation System" but that's too long. "Campcodes Movie Theater Seat Reservation System"? That's 4 words. We'll pick something like "Campcodes Seat Reservation" or "Movie Seat Reservation System". I'll go with "Campcodes Seat Reservation" to be concise, but to be precise, the product is named "Online Movie Theater Seat Reservation System". The vendor is Campcodes. So perhaps "Online Movie Theater Seat Reservation System" as product name (despite length, maybe accepted). The instruction says "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description." So I'll use "Campcodes Seat Reservation" but it might not be the exact name. The CPE is campcodes:online_movie_theater_seat_reservation_system:1.0. The product_name should be something like "Online Movie Theater Seat Reservation System". That is 4 words? Actually "Online Movie Theater Seat Reservation System" is 4 words? Online-Movie-Theater-Seat-Reservation-System, hyphenated as product name. I'll go with "Online Movie Theater Seat Reservation System" as the standard product name. It's acceptable though the guideline says 1-3 words, but it's a product name. Better to stick to "Movie Theater Seat Reservation System". I'll use "Movie Theater Seat Reservation System" (three words: Movie, Theater, Seat, Reservation, System? That's five if you count each as word. Actually "Movie Theater" is two words, "Seat Reservation System" is three, total 5. So maybe "Campcodes Seat Reservation" (two words). I'll check the examples: "Apache Tomcat", "WordPress", "Linux Kernel". So two words. So I'll craft something: "Smartphone System" but doesn't fit. Could say "Seat Reservation System". That's three. The product_name is intended to identify the product uniquely, so I'll use "Online Movie Theater Seat Reservation System" (as it's the full name). I'll keep that. I'm going to output "Online Movie Theater Seat Reservation System" for product_name. It might be flagged, but it's the product. Alternatively, "Campcodes Seat Reservation" could work. I'll decide on "Campcodes Seat Reservation System" (that's 3 words: Campcodes, Seat, Reservation, System? That's four words. Campcodes is one word. So "Campcodes Seat Reservation" is actually two words: Campcodes, Seat, Reservation? That's three. Campcodes (vendor), Seat Reservation System (product). So "Campcodes Seat Reservation" might be ambiguous. The product is the Seat Reservation System by Campcodes. I'll use "Online Movie Theater Seat Reservation System" and hope it's fine. The field says "1-3 words ONLY", so I'll need to find a way. Perhaps "Movie Seat Reservation"? That's generic. I'll use "Online Movie Theater Seat Reservation System" as a single identifier phrase, but if it's strictly enforced, it might violate. I'll take the risk and use "Online Movie Theater Seat Reservation System". I'll shorten to "Movie Theater Seat Reservation". That is 4 words... Movie, Theater, Seat, Reservation - 4 words. So "Movie Theater Seat System"? Not good. I'll go with "OnlineMovieTheaterSeatReservation" as one word? No. I'll use "Seat Reservation System" (3 words) and rely on context from CPE. The field says product_name, so it's expected to be a name, and "Online Movie Theater Seat Reservation System" is a typical product name for Campcodes. I'll keep it as "Online Movie Theater Seat Reservation System" and break the rule if necessary. I'll just go with "Campcodes Seat Reservation". It's a compromise. I'll set product_name: "Campcodes Seat Reservation" proceed. summary: "SQL injection in Campcodes Online Movie Theater Seat Reservation System allows remote attackers to manipulate the ID parameter in /admin/manage_seat.php, potentially reading, modifying, or deleting database content. This vulnerability affects version 1.0, with publicly available exploit code and no known patch. EPSS score is low (0.09%), indicating lower immediate exploitation probability, but the public PoC increases risk." I need to synthesize. Do NOT copy description. Start with impact: "SQL injection in /admin/manage_seat.php of Campcodes Online Movie Theater Seat Reservation System 1.0 lets remote attackers inject arbitrary SQL commands via the ID parameter, enabling data manipulation or extraction. Public exploit code exists, and while EPSS suggests low exploitation probability, the lack of authentication for the vulnerable endpoint heightens risk." I'll craft a summary. Mention that the file is an admin panel but authentication not mentioned? CVSS says PR:N (no privileges required), UI:N, so unauthenticated. So it's unauthenticated SQL injection on the admin page, likely accessible without authentication. So summary: "Unauthenticated SQL injection in the /admin/manage_seat.php endpoint of Campcodes Online Movie Theater Seat Reservation System 1.0 allows remote attackers to manipulate database queries via the ID parameter. Publicly available exploit code and no patch increase the urgency of mitigation. EPSS probability is low at 0.09%, but unauthenticated access and ease of exploitation warrant high attention." technical_context: "The vulnerability is a SQL injection (CWE-89) in a PHP-based web application (Campcodes Online Movie Theater Seat Reservation System). The affected file /admin/manage_seat.php likely uses user-supplied input in SQL queries without proper sanitization, allowing injection of malicious SQL statements. The CPE identifier cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:* confirms the exact affected product version. Given the PHP tag, the application likely uses MySQL or similar, and the admin panel might be accessible without authentication (PR:N per CVSS 4.0), leaving the database exposed to remote attacks. The CWE-74 is generic injection, but this is specifically SQL injection." risk_assessment: "The risk is significant due to unauthenticated remote access (CVSS 4.0: AV:N/PR:N/UI:N) and SQL injection, which can lead to data breach or modification. However, the CVSS score is only 5.5 (Medium) in the 4.0 scale, with low impact metrics (VC:L/VI:L/VA:L) suggesting limited confidentiality, integrity, and availability impact. This seems contradictory: a SQL injection often allows full database control, but the vector only shows low impact, perhaps due to the assessor's conservative estimate. EPSS score 0.09% indicates only a 0.09% chance of exploitation in the next 30 days, which is low, but percentile 25% shows it's above just 25% of all CVEs—above average but still low. POC is publicly available, but KEV status is not mentioned, so no confirmed active exploitation. The SSVC decision framework would note: exploitation exists (PoC), automatable (yes, remote unauthenticated), technical impact could be high (depending on database privileges). But careful: CVSS indicates low impact, which could mean the SQL injection might be limited, e.g., only reading some data or the database user has restricted privileges. However, given typical PHP apps, SQL injection often leads to full compromise. So risk is moderate to high. The low CVSS score may be misleading. I'll note the discrepancy: "CVSS 4.0 vector shows low impact across confidentiality, integrity, availability, which may underestimate the real-world impact of SQL injection; typical exploitation could lead to full database disclosure. The EPSS score is low, but public PoC makes exploitation accessible to script kiddies. Combined with unauthenticated access, organizations using this product should consider it a high risk until a patch is available." I'll state the missing info: no KEV, no vendor patch, no advisory. So "No vendor advisory or patch identified; only third-party disclosure with PoC. The risk assessment is based on public disclosure, not vendor confirmation." affected_products: "Campcodes Online Movie Theater Seat Reservation System version 1.0 (CPE: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*). No other versions are reported affected. The product appears to be a free or open-source project from Campcodes; no official advisory link was provided in the references." remediation: "No vendor patch has been released. As an immediate mitigation, restrict access to the /admin directory by IP whitelisting or implementing authentication if not already in place (note: CVSS indicates PR:N, so likely no authentication, but verify). Alternatively, disable the vulnerable manage_seat.php or apply input sanitization to the ID parameter to filter SQL metacharacters. Consider migrating away from unsupported software, as Campcodes products are often unmaintained. Given the exploit is public, apply web application firewall rules to block malicious SQL injection patterns targeting this endpoint." exploit_scenario: "An attacker sends a crafted HTTP request to /admin/manage_seat.php?ID=[payload] to inject SQL commands. This could leak usernames, passwords, or other sensitive data from the database, or modify database contents to manipulate seat reservations. Since the endpoint likely lacks authentication, the attack can be performed by anyone with network access to the web server." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Campcodes Online Movie Theater Seat Reservation System 1.0. The vulnerable endpoint /admin/manage_seat.php is accessible without authentication (PR:N per CVSS 4.0) and processes the ID parameter unsanitized. If the application is deployed with access controls (e.g., .htaccess) that restrict the admin directory, exploitation would require bypassing those controls, but the default configuration appears wide open." attack_chain: "Send crafted HTTP GET request with malicious ID parameter → Trigger SQL injection in manage_seat.php → Execute arbitrary SQL queries on backend database → Exfiltrate or modify data" confidence_notes: "CVSS vector, EPSS, and PoC are sourced from NVD/VulDB. No vendor advisory or patch confirmed; the product is from Campcodes, a source of many vulnerable applications often without official support. Active exploitation not reported by CISA KEV. Impact assessed as low by the CVSS 4.0 vector, but the actual database privileges may elevate the risk. All details based on third-party disclosure; vendor confirmation missing." prevalence: "low" (since this is a niche PHP application from a vendor that produces many small, often unsupported systems, unlikely widely deployed). prevalence_basis: "Niche application from Campcodes, likely minimal enterprise deployment." assessed_cvss_vector: I need to create an independent CVSS 3.1 vector. Based on the description: network attack, no authentication required (though admin path might suggest some? But CVSS 4.0 says PR:N, so assuming no auth), low complexity, no user interaction, no scope change? The SQL injection might affect the database, which is a different component? Could be scope changed if the database is a separate system, but typically SQL injection is within the application's security scope. So I'll set S:U. Confidentiality: potentially high (data exfiltration), Integrity: high (modify DB), Availability: could be high if I can drop tables, but low if I can't. The CVSS 4.0 vector's low impact likely because they assume limited database user privileges. But typical SQL injection in PHP apps uses application's DB user, which often has full privileges. I'll be more realistic: given unauthenticated SQL injection, the impact can
XML External Entity (XXE) processing vulnerability in Jinher OA 1.1 allows unauthenticated remote attackers to read local files or perform server-side request forgery via the XmlHttp.aspx endpoint. Public exploit code is available, though no active exploitation has been reported and EPSS indicates low exploitation probability.
XML External Entity (XXE) injection in Jinher OA 1.2 allows unauthenticated remote attackers to read arbitrary files and potentially exfiltrate data via the ProjectScheduleDelete.aspx endpoint. Exploit code is publicly available, but the EPSS exploitation probability remains low (0.07%) and the vulnerability is not known to be actively exploited.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/giving.php, leading to arbitrary SQL execution. The vulnerability is publicly disclosed with exploit code available (EPSS 0.07%), but there is no indication of active exploitation in CISA KEV. Attackers can use this to extract or modify donation records and other database contents.
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/offering.php. The vulnerability is remotely exploitable without authentication, and a publicly available exploit exists. However, EPSS indicates a low probability of widespread exploitation (0.07%), suggesting limited real-world impact despite disclosure.
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/Tithes.php. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed. EPSS indicates a very low (0.07%) likelihood of real-world exploitation.
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Let's extract data from the input: - CVE: CVE-2025-7830 - Description: Vulnerability in code-projects Church Donation System 1.0, file /reg.php, argument mobile leads to SQL injection. Remote attack, exploit disclosed. - CVSS Score: 5.5 (but vector is CVSS 4.0, not 3.1) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/... - CWE: CWE-74 (Injection, broader than SQL injection? Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but often used for injection in general; SQL injection is CWE-89, but they used CWE-74. We'll note that.) - EPSS: 0.07% (percentile 20%) - low risk of exploitation - POC/Exploit: Publicly available - Reported by cna@vuldb.com - CPE: cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:* - Tags: SQLi, PHP, Church Donation System - References: - code-projects.org (vendor/product site) - github.com/n0name-yang/myCVE/issues/6 (exploit) - vuldb.com/?ctiid.316934 - vuldb.com/?id.316934 - vuldb.com/?submit.616886 We need to produce a synthesis. No KEV, so not actively exploited per CISA. POC is publicly available. EPSS low. Product name: "Church Donation System" (3 words). Should be specific. Summary: No "A vulnerability...", start with impact verb. E.g., "SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the mobile parameter in reg.php." Mention exploit available, EPSS low. Since it's a simple SQL injection, impact is data manipulation/extraction. The CVSS 4.0 vector indicates low impact on confidentiality, integrity, availability (VC:L/VI:L/VA:L), so likely limited to injection context, maybe not high-severity data breach but still critical rating. We'll describe that. Technical context: PHP application, SQL injection in the mobile parameter. CWE-74 injec
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /login.php. The vulnerability has a publicly available exploit but no confirmed active exploitation. EPSS score is low (0.07%), indicating limited exploitation probability in the wild.
Use-after-free in Linux Kernel traffic control (qdisc) subsystem allows local authenticated attackers to execute arbitrary code, escalate privileges, or cause denial of service. Affects Linux Kernel versions prior to vendor-released patches across multiple stable branches (6.6.x, 6.12.x, 6.15, 6.16-rc1). Triggered when classful qdiscs like DRR and HFSC incorrectly handle child class deactivation during enqueue operations, leaving stale class pointers that can be exploited after deletion. Vendor patches available from kernel.org git stable tree; no active exploitation confirmed (not in CISA KEV), but PoC reproducer exists in public advisory.
Command injection in D-Link DIR-816L firmware up to version 2.06B01 allows authenticated remote attackers to execute arbitrary system commands via the lxmldbc_system function in the Environment Variable Handler component. The vulnerability affects end-of-life hardware no longer receiving vendor support, with public exploit code available and low real-world exploitation probability despite network accessibility, limited only by requirement for valid authentication credentials.
Cross-site request forgery in PHPGurukul Complaint Management System 2.0 allows remote attackers to perform unauthorized actions via crafted requests requiring user interaction. The vulnerability has a low CVSS score of 2.1 due to required user interaction (UI:P) and limited integrity impact, but publicly available exploit code exists, making it actionable for targeted attacks against installations.
Cross-site scripting (XSS) in Campcodes Online Movie Theater Seat Reservation System 1.0 allows authenticated remote attackers to inject malicious scripts via the Firstname or Lastname parameters on the reserve page, requiring user interaction to trigger. The vulnerability has a low CVSS score of 2.0 due to authentication and user interaction requirements, but publicly available exploit code exists and the vulnerability is classified as problematic with potential for phishing or session hijacking attacks.
Reflected cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated remote attackers to inject malicious JavaScript via the visname parameter in bwdates-passreports-details.php, with user interaction required. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.05%, indicating limited real-world weaponization despite disclosure.
Stored cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users to inject malicious scripts via the visname parameter in pass-details.php, which are then executed in the context of other users' browsers. The vulnerability requires user interaction (UI:P) but can be exploited remotely by any authenticated user with access to the HTTP POST request handler. Publicly available exploit code exists, though the low EPSS score (0.05%) and requirement for user interaction and authentication suggest limited real-world exploitation risk.
Stored cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users to inject malicious scripts via the categoryname parameter in /category.php, which are subsequently reflected to other users. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its direct impact to user account compromise or session hijacking of visiting administrators. Public exploit code is available and exploitation probability is low (EPSS 0.05%), suggesting limited real-world weaponization despite public disclosure.
Reflected cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the visname parameter in /bwdates-reports.php, executing arbitrary JavaScript in victim browsers when user interaction occurs. Publicly available exploit code exists; EPSS score of 0.05% indicates low real-world exploitation probability despite public POC availability.
Stored cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated remote attackers to inject malicious JavaScript via the visname parameter in /visitor-detail.php, which is then reflected to other users. The vulnerability requires user interaction (clicking a malicious link) but affects confidentiality and integrity of the application. Exploit code is publicly available on GitHub, though real-world exploitation remains limited (EPSS 0.05%).
Cross-site scripting vulnerability in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the visname parameter in the /manage-newvisitors.php endpoint, exploitable only when the victim user clicks a crafted link. The CVSS score of 1.9 reflects the severe privilege requirement (PR:H), mandatory user interaction (UI:P), and limited impact (integrity only); EPSS exploitation probability is minimal at 0.05%, indicating this poses negligible real-world risk despite publicly available exploit code.