Denial of service in D-Link DI-8400 router firmware 16.07.26A1 allows authenticated remote attackers with low privileges to crash the device's jhttpd service by sending a crafted request to the usb_paswd.asp endpoint with a malicious share_enable parameter, triggering a null pointer dereference. Public exploit code is available, but no active exploitation has been reported and EPSS probability is low (0.21%).
SQL injection in PHPGurukul Local Services Search Engine Management System 2.1 allows remote attackers to manipulate database queries through the `editid` parameter of `/admin/changeimage.php`. The flaw is a classic CWE-74 injection vulnerability where unsanitized user input is passed directly into a database query, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains low at 0.07% (20th percentile), suggesting limited active targeting at this time. No CISA KEV listing exists.
Stored Cross-Site Scripting in the Educenter WordPress theme Circle Counter Block allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages, executing when users visit affected content. The vulnerability stems from insufficient input sanitization in the circle-counter.php block component (versions up to 1.6.2) and affects all users viewing injected pages. CVSS 6.4 (medium) reflects the requirement for authenticated access and limited scope; no public exploit code or active exploitation has been confirmed at time of analysis.
Remote SQL injection in 1000 Projects ABC Courier Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /getbyid.php. Exploit code is publicly available and has been disclosed, though the EPSS exploitation probability is low (0.06%). The flaw could lead to unauthorized data access, modification, or database compromise.