Unauthenticated SQL injection in ABC Courier Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'From' parameter of /report.php. Exploit code is publicly available, but active exploitation has not been confirmed. The product is a niche academic project with low deployment footprint, limiting real-world impact.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.
SQL injection in the admin edit_product.php page of the code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries. A publicly available exploit increases risk, though EPSS score is low (0.07%) and no active exploitation has been confirmed in CISA KEV. Attackers can extract or modify data with low impact on confidentiality, integrity, and availability.
SQL injection in code-projects Online Ordering System 1.0 via the Name parameter in /admin/product.php allows remote unauthenticated attackers to execute arbitrary SQL commands. Publicly available exploit code exists, but the EPSS score of 0.07% and low impact CVSS 4.0 score indicate a low likelihood of widespread exploitation. No active exploitation has been reported in the wild (not listed in CISA KEV).
SQL injection in Online Ordering System version 1.0 allows remote attackers to inject arbitrary SQL via the ID parameter of the /admin/delete_member.php endpoint. Public exploit code is available, but the EPSS exploitation probability is low (0.07%), and CISA KEV does not list this vulnerability.
SQL injection in code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'un' parameter in /admin/user.php. A publicly available exploit exists, but no active exploitation has been reported (CISA KEV is absent), and EPSS indicates a very low exploitation probability (0.07%).
SQL injection in code-projects Online Ordering System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in the admin user deletion script. Public exploit code is available, but EPSS indicates a low exploitation probability (0.07%) and no active exploitation is confirmed.
SQL injection in Engeman Web versions up to 12.0.0.2 allows remote attackers to manipulate database queries via the LanguageCombobox cookie on the password recovery page. Exploit code is publicly available, but no active exploitation is reported; EPSS indicates low probability of widespread exploitation.
The D-Link DIR-890L router up to firmware version 111b04 contains a hard-coded credentials vulnerability in the UART interface's rgbin file, allowing attackers with physical access to gain full device compromise. No prior authentication is required, and a proof-of-concept exploit is publicly available. The device is end-of-life and will not receive a patch, and while no active exploitation is known, the vulnerability enables complete takeover once physical access is obtained.
Unsafe deserialization in ChanCMS up to version 3.1.2 allows authenticated remote attackers to trigger deserialization vulnerabilities via the taskUrl parameter in the /collect/getArticle endpoint, potentially leading to code execution. The vulnerability has limited confidentiality, integrity, and availability impact per CVSS 4.0 scoring (2.1 score). Publicly available exploit code exists, and the vendor has released patched version 3.1.3.
Server-side request forgery in ChanCMS up to version 3.1.2 allows authenticated attackers to conduct SSRF attacks via the targetUrl parameter in the /cms/collect/getPages endpoint. The CVSS score of 2.1 reflects low confidentiality and integrity impact on the vulnerable component itself, but the publicly disclosed exploit and low EPSS score (0.10%, percentile 26%) suggest this vulnerability carries minimal real-world exploitation risk despite active public disclosure.
ChanCMS up to version 3.1.2 permits information disclosure through improper validation of accessKey and secretKey parameters in the /sysApp/find endpoint, allowing authenticated remote attackers to access sensitive data. The vulnerability has a low CVSS score of 2.1 (CVSS:4.0/AV:N/AC:L/PR:L) reflecting limited confidentiality impact and requirement for low-privilege authentication, but publicly available exploit code exists and exploitation probability (EPSS 0.09%) is extremely low, suggesting this is a narrow-scope, low-urgency issue despite public disclosure.
Cross-site request forgery in jerryshensjf JPACookieShop (蛋糕商城JPA版) allows unauthenticated remote attackers to perform unauthorized actions via crafted requests to AdminTypeCustController.java, requiring user interaction. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, the extremely low EPSS percentile (23%) suggests minimal real-world exploitation despite public disclosure.
Reflected cross-site scripting (XSS) in JPACookieShop's GoodsCustController.goodsSearch function allows remote unauthenticated attackers to inject malicious scripts via the keyword parameter, affecting user sessions with minimal complexity. The vulnerability carries a CVSS 2.1 score but requires user interaction (clicking a malicious link), and public exploit code is available. With an EPSS of 0.06% and no confirmed active exploitation in the wild, the real-world risk is low despite the disclosed POC.
Stored cross-site scripting (XSS) in JPACookieShop GoodsController allows authenticated users to inject malicious scripts that execute in other users' browsers, with public exploit code available and CVSS 2.0 reflecting low impact due to required user interaction and authenticated access prerequisites.
Null pointer dereference in GNU Binutils 2.44 BFD Library function bfd_elf_get_str_section causes denial of service when processing malformed ELF files locally. The vulnerability requires local access with limited privileges (PR:L) and publicly available exploit code exists, though EPSS scoring (0.04%, 12th percentile) indicates low real-world exploitation probability despite public disclosure.
Memory leak in GNU Binutils 2.44 DWARF section handler allows local authenticated users to consume memory resources, potentially leading to denial of service. The vulnerability exists in the process_debug_info function of binutils/dwarf.c and is triggered during DWARF debug information parsing. Publicly available exploit code exists, and a vendor patch has been released.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /manage_user.php, with publicly available exploit code disclosed. Despite a critical classification, the CVSS 4.0 vector reflects low impact (confidentiality, integrity, availability all limited) and EPSS score of 0.06% suggests minimal real-world exploitation probability.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the parameter 's' in /parcel_list.php, with publicly available exploit code disclosed. Despite a critical classification in the original report, the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact constrained by the requirement for prior authentication (PR:L) and absence of scope escalation; EPSS scoring of 0.06% indicates low real-world exploitation probability despite public POC availability.