Unauthenticated SQL injection in ABC Courier Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'From' parameter of /report.php. Exploit code is publicly available, but active exploitation has not been confirmed. The product is a niche academic project with low deployment footprint, limiting real-world impact.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.
SQL injection in the admin edit_product.php page of the code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries. A publicly available exploit increases risk, though EPSS score is low (0.07%) and no active exploitation has been confirmed in CISA KEV. Attackers can extract or modify data with low impact on confidentiality, integrity, and availability.
SQL injection in code-projects Online Ordering System 1.0 via the Name parameter in /admin/product.php allows remote unauthenticated attackers to execute arbitrary SQL commands. Publicly available exploit code exists, but the EPSS score of 0.07% and low impact CVSS 4.0 score indicate a low likelihood of widespread exploitation. No active exploitation has been reported in the wild (not listed in CISA KEV).
SQL injection in Online Ordering System version 1.0 allows remote attackers to inject arbitrary SQL via the ID parameter of the /admin/delete_member.php endpoint. Public exploit code is available, but the EPSS exploitation probability is low (0.07%), and CISA KEV does not list this vulnerability.
SQL injection in code-projects Online Ordering System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the 'un' parameter in /admin/user.php. A publicly available exploit exists, but no active exploitation has been reported (CISA KEV is absent), and EPSS indicates a very low exploitation probability (0.07%).
SQL injection in code-projects Online Ordering System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in the admin user deletion script. Public exploit code is available, but EPSS indicates a low exploitation probability (0.07%) and no active exploitation is confirmed.
SQL injection in Engeman Web versions up to 12.0.0.2 allows remote attackers to manipulate database queries via the LanguageCombobox cookie on the password recovery page. Exploit code is publicly available, but no active exploitation is reported; EPSS indicates low probability of widespread exploitation.
The D-Link DIR-890L router up to firmware version 111b04 contains a hard-coded credentials vulnerability in the UART interface's rgbin file, allowing attackers with physical access to gain full device compromise. No prior authentication is required, and a proof-of-concept exploit is publicly available. The device is end-of-life and will not receive a patch, and while no active exploitation is known, the vulnerability enables complete takeover once physical access is obtained.