SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /pages/settings_update.php. The vulnerability is publicly disclosed with exploit code available, but no evidence of active exploitation exists. EPSS score is low (0.09%), suggesting limited real-world risk despite the critical classification.
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
SQL injection in Chanjet CRM 1.0 via the /mail/mailinactive.php login page component allows remote attackers to execute arbitrary SQL commands, potentially leading to data leakage or modification. A public proof-of-concept is available, though EPSS indicates low exploitation probability, and no active exploitation is confirmed.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'mobile' parameter in /members/add_members.php. Exploit code is publicly available but there is no evidence of active exploitation; EPSS indicates a low 0.07% probability of exploitation. Despite a 'critical' label, impact is limited to low confidentiality, integrity, and availability effects.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands through the fname parameter in /members/edit_Members.php, potentially leading to data exposure or modification. Publicly available exploit code exists, though no evidence of active exploitation has been identified.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'firstname' parameter in /members/edit_user.php. Exploit code is publicly available, though EPSS (0.07%) indicates a low probability of widespread exploitation, and no KEV listing confirms inactive targeting at this time.
Authorization bypass via user-controlled key manipulation in Turtek Software Eyotek exposes sensitive user data to remote attackers without requiring authentication. The vulnerability, classified as CWE-639 (Insecure Direct Object Reference class), permits an attacker to enumerate or substitute trusted identifiers in requests to access resources belonging to other users, resulting in high-confidentiality-impact data disclosure with no integrity or availability effect. Reported by Turkish USOM (iletisim@usom.gov.tr), no public exploit code exists and the EPSS score of 0.20% places this at the 43rd percentile, indicating low current exploitation probability.
Execute arbitrary shortcodes in WordPress sites running WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.2 via Cross-Site Request Forgery targeting site administrators. Unauthenticated attackers can forge requests that bypass nonce validation in the preview function, allowing execution of arbitrary shortcodes if an admin clicks a malicious link. When combined with CVE-2025-7354, this enables Reflected Cross-Site Scripting. EPSS score of 6.1 (moderate CVSS) reflects the UI requirement and need for admin interaction, though real-world risk is elevated due to the attack surface in WordPress admin workflows. No public exploit code or CISA KEV confirmation identified at time of analysis.
SMTP injection in Eclipse Jakarta Mail (and its Angus Mail implementation) prior to version 2.0.2 allows a low-privileged attacker to inject arbitrary SMTP protocol commands by embedding raw carriage return (\r) and line feed (\n) UTF-8 characters into email fields processed by the library. The library fails to sanitize these input terminators before passing data to the SMTP command stream, enabling an attacker with control over email content to inject additional SMTP commands, forge headers, or deliver unsolicited messages through a trusted mail relay. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Authorization bypass in Akbim Software Online Exam Registration allows a highly privileged, remote attacker to access confidential exam registration data belonging to other users by manipulating user-controlled identifier keys. Affected versions are all releases prior to 14.03.2025. No public exploit code has been identified at time of analysis, and EPSS exploitation probability stands at just 0.17%, reflecting low observed threat activity despite the confidentiality severity of the flaw.