Server-side request forgery in ssrfcheck npm package versions before 1.2.0 enables attackers to bypass IP blocklist validation and craft requests to multicast IP addresses (224.0.0.0/4). The vulnerability stems from an incomplete denylist that fails to classify reserved multicast address space as invalid, allowing network-accessible exploitation with no authentication required. Public exploit code exists (Snyk gist, CVSS E:P) with EPSS indicating moderate exploitation probability. Vendor patch available in version 1.2.0 via GitHub commit 9507b49.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.
Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.
Session hijacking in PHPGurukul Car Washing Management System v1.0 allows attackers to retain or reuse a doctor account session because the /doctor/change-password.php component fails to invalidate existing sessions after a credential change, publicly available exploit code exists (per the referenced GitHub PoC), though EPSS estimates only a 0.50% exploitation probability and the issue is not on CISA KEV. No public exploit identified as actively used in the wild; the flaw affects only the single unpatched v1.0 release of this niche PHP application.
Session hijacking in PHPGurukul Car Rental Project v3.0 stems from the /carrental/update-password.php endpoint failing to invalidate existing sessions after a password change, allowing an attacker who has captured or been handed a valid session identifier to retain authenticated access even after the victim resets credentials. Publicly available exploit code exists (GitHub), but the issue is not in CISA KEV, and EPSS is modest at 0.40% (32nd percentile), indicating no evidence of widespread automated exploitation. Confidence is reduced by conflicting source metadata (see confidence notes).
Session hijacking in PHPGurukul Online Course Registration v3.1 stems from the /crm/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who has captured or replayed a victim's session identifier retain authenticated access even after the credential is rotated. Publicly available exploit code exists (GitHub), but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.40% (32nd percentile), indicating limited observed exploitation. The issue chiefly threatens confidentiality of the affected user's CRM account.
Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.
Session hijacking in PHPGurukul Blood Bank & Donor Management System v2.4 stems from the /bbdms/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who obtains or captures a valid session token retain authenticated access even after the victim rotates credentials. Publicly available exploit code exists (GitHub, VasilVK), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.32% (24th percentile), indicating no evidence of widespread automated exploitation. The issue primarily threatens confidentiality of donor and blood-bank records in this niche PHP application.
Session hijacking in PHPGurukul Small CRM v3.0 stems from improper session invalidation in /crm/change-password.php, where existing session tokens are not revoked after a password change, letting an attacker who obtains or retains a valid session ID continue accessing the victim's authenticated account. Public exploit code exists (GitHub PoC by VasilVK), though there is no confirmed active exploitation (not in CISA KEV) and EPSS probability is low at 0.32% (24th percentile). Impact is primarily confidentiality of CRM data with limited integrity effect.
SQL injection in Ncvav Virtual PBX Software versions prior to 09.07.2025 allows remote unauthenticated attackers to manipulate backend database queries, leading to full compromise of confidentiality, integrity, and availability. The flaw was reported by Turkey's national CSIRT (USOM) and carries a critical CVSS 9.8 score, though no public exploit identified at time of analysis and no EPSS data is currently available.
OS command injection in Vaelsys VaelsysV4 (versions up to 5.1.0 and 5.4.0) allows remote unauthenticated attackers to execute arbitrary operating system commands via the xajaxargs parameter passed to the execute_DataObjectProc function in /grid/vgrid_server.php. The attack is fully remote, requires no authentication per the CVSS 4.0 PR:N metric, and a public proof-of-concept exploit is confirmed available on GitHub, raising the urgency of remediation. No active exploitation has been confirmed by CISA KEV at time of analysis, though an EPSS at the 75th percentile reflects non-trivial exploitation probability relative to the broader CVE population.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Online Ordering System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL code via the firstname parameter in signup.php. The vulnerability is publicly known and exploit code is available. EPSS exploitation probability is low (0.07%), and no active exploitation in the wild has been reported.
Authenticated OS command injection in the PowerStick Wave Dual-Band Wifi Extender V1.0 lets a user with valid credentials run arbitrary commands as root via the /cgi-bin/cgi_vista.cgi endpoint. Because the device firmware runs its web management logic with root privileges, successful exploitation yields complete takeover of the extender. The single NVD reference is a public researcher gist that very likely contains proof-of-concept detail, though the flaw is not listed in CISA KEV and EPSS risk is modest (0.66%, 47th percentile).
Privilege escalation in Beamsec PhishPro before version 7.5.4.2 allows authenticated low-privileged users to abuse privileged API calls, resulting in full confidentiality, integrity, and availability compromise (CVSS 8.8). The root cause is CWE-648 (Incorrect Use of Privileged APIs), meaning the application exposes or incorrectly gates privileged API operations that low-privileged users can invoke directly. No public exploit exists at time of analysis, and EPSS sits at 0.25% (49th percentile), but the network-accessible, low-complexity attack path warrants prioritized remediation for any internet-facing PhishPro deployment.
Local privilege-context memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) arises from a use-after-free in crypt_message() when SMB3 encryption is offloaded to asynchronous hardware crypto accelerators. The prior CVE-2024-50047 fix removed async AEAD handling on the assumption all crypto is synchronous; when crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the request buffer (creq) is freed by kvfree_sensitive() while the accelerator is still using it, causing kernel crashes (NULL pointer dereferences) and potential memory corruption. Affects kernels carrying the CVE-2024-50047 backport through 6.16-rc4; no public exploit identified at time of analysis and EPSS is low (0.28%).
Out-of-bounds write in the Linux kernel's Industrial I/O (IIO) backend debugfs interface allows a local user with write access to corrupt kernel memory by one byte beyond an 80-character buffer. The flaw affects 6.16 release-candidate kernels (rc1-rc6): after simple_write_to_buffer truncates an oversized write to the buffer size, a NUL string terminator is written at the (already maxed-out) offset without a bounds check. It is fixed upstream and has no public exploit identified at time of analysis; EPSS is very low (0.15%, 5th percentile).
Denial-of-service (kernel panic) in the Linux kernel's libwx network driver - the shared base module for Wangxun txgbe/ngbe Ethernet controllers - arises from a duplicate page_pool_put_full_page() call in the Rx path that double-frees page-pool pages, corrupting the free list and crashing the host (CWE-415). It affects 6.16 release-candidate kernels (rc1-rc6) on systems using Wangxun NICs and is triggered by ordinary received network traffic rather than a crafted payload. There is no public exploit identified at time of analysis and EPSS is very low (0.15%); the issue is a pre-release regression fixed upstream before the 6.16 final release.
Use-after-free in the Linux kernel's IIO FXLS8962AF/FXLS8964AF accelerometer driver (fxls8962af_fifo_flush) lets a race between FIFO-flush interrupt handling and buffer-mode teardown dereference a freed/NULL active_scan_mask, crashing the kernel. Affects systems running a vulnerable kernel (notably 6.16-rc1 through rc6 and backport-affected stable branches) that use the NXP fxls8962af IIO accelerometer. A vendor fix is available; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Local privilege escalation and memory corruption in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) source-routing subsystem, affecting the 6.16-rc development series. The rpl_do_srh_inline() function in net/ipv6/rpl_iptunnel.c dereferences a stale pointer to the IPv6 header after skb_cow_head() may have freed the underlying buffer, producing a use-after-free (CWE-416) that a local attacker can trigger by sending IPv6 packets through an RPL lightweight-tunnel route. No public exploit is identified at time of analysis and EPSS is very low (0.15%), consistent with a bug found via internal KASAN selftesting rather than in-the-wild abuse.
Use-after-free in Linux kernel TLS implementation allows local authenticated users to achieve high confidentiality, integrity, and availability impact through memory corruption. The vulnerability, triggered by aggressive TCP SKB compaction in net-next, causes TLS to operate on freed socket buffers when checking decrypt state. A vendor patch is available across multiple kernel versions (6.1-rc2 through 6.1-rc5 and later stable branches). No active exploitation confirmed, but CWE-416 use-after-free bugs are frequently targeted due to their code execution potential. EPSS data not provided.
A vulnerability in the Linux kernel's HID (Human Interface Device) core subsystem allows local attackers with low privileges to bypass input validation checks when interacting with HID devices. The flaw occurs because certain code paths directly call low-level transport driver functions instead of using the hid_hw_raw_request() function, which performs critical buffer and length validation. With an EPSS score of only 0.01% and no known exploitation in the wild, this represents a local privilege escalation risk primarily concerning systems with untrusted local users.
Denial of service in the CPython standard-library 'tarfile' module allows remote attackers to hang any Python application that parses attacker-supplied tar archives. A maliciously crafted archive containing a header with a negative block offset causes the TarFile extraction and member-enumeration APIs (getmembers, extractall, iteration) to enter an infinite loop and deadlock, consuming the thread indefinitely. Rated CVSS 7.5 (availability-only); no public exploit is identified at time of analysis, EPSS is low at 0.61%, and it is not on CISA KEV, but the fix is upstream in CPython.
Session hijacking in PHPGurukul e-Diary Management System v1.0 stems from the /edms/change-password.php endpoint failing to invalidate existing sessions after a password change, so a previously captured session identifier remains valid and grants continued authenticated access. Remote attackers who obtain a victim's session token can therefore retain or take over the account even after the legitimate user rotates their password. There is no CISA KEV listing and no confirmed active exploitation; a GitHub reference (VasilVK/CVE) tracking this CVE likely contains a proof-of-concept or write-up, though PoC status is not explicitly confirmed in the source data, and EPSS is low at 0.55% (42nd percentile).
Denial of service in GNOME GLib on Windows platforms occurs when an application uses GLib's process-spawning functions with excessively long command lines, causing the spawn operation to fail or crash the host process and disrupt availability. The flaw affects the GLib library's Windows command-line handling and impacts any Windows application that links GLib and passes attacker-influenced long argument strings to a child process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; despite Red Hat tags mentioning RCE/Code Injection, the CVSS impact metrics confirm availability-only impact (C:N/I:N/A:H).
Session hijacking in PHPGurukul Doctor Appointment Management System v1.0.0 stems from improper session invalidation in /doctor/change-password.php, where doctor account sessions are not terminated after a password change. A publicly available exploit code exists (GitHub, VasilVK), but there is no public exploit identified as actively exploited and it is not in CISA KEV. EPSS is low at 0.41% (33rd percentile), indicating limited real-world exploitation interest to date.
A race condition in the Linux kernel's MPTCP (Multipath TCP) protocol implementation allows local attackers with limited privileges to trigger a kernel warning and denial of service by causing non-atomic fallback decisions and actions during connection establishment. The vulnerability (CWE-667: Improper Locking) arises from unsynchronized access to fallback state in mptcp_do_fallback() when processing incoming TCP options, enabling a local user to crash the system or hang connections via crafted MPTCP packets. EPSS score of 0.03% indicates low real-world exploitation probability despite moderate CVSS impact severity.
Session hijacking in PHPGurukul Bank Locker Management System v1.0 lets remote attackers reuse valid session tokens because the /banker/change-password.php component fails to invalidate existing sessions after a password change. Any session token captured before the change (via a shared machine, network capture, or referrer/log leakage) remains usable, letting an attacker impersonate the banker account. A GitHub reference (VasilVK/CVE) is published for this issue, and EPSS risk is low at 0.34% (27th percentile) with no active exploitation reported.
Unsafe deserialization in ChanCMS up to version 3.1.2 allows authenticated remote attackers to achieve limited confidentiality, integrity, and availability impact via manipulation of the targetUrl parameter in the getArticle function of app/modules/cms/controller/collect.js. The CVSS score of 2.1 reflects constrained impact (low severity across all impact categories), but the low EPSS percentile (71%) and publicly available exploit code indicate real-world risk despite authentication requirement. Upgrading to version 3.1.3 resolves the issue.
Unrestricted file upload in code-projects Online Ordering System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /admin/product.php, potentially enabling remote code execution. Despite a critical severity classification, the CVSS 4.0 score of 2.1 reflects low actual impact due to required authentication and limited scope. Publicly available exploit code exists; however, the 0.10% EPSS score (27th percentile) indicates minimal real-world exploitation likelihood, suggesting this is a low-priority vulnerability in practice.
SQL injection in Projectworlds Online Admission System 1.0 allows authenticated remote attackers to manipulate the 'markof' parameter in /admin.php, leading to database queries with limited confidentiality and integrity impact. The vulnerability has publicly available exploit code, though actual exploitation appears limited given the low EPSS score (0.07%) and requirement for authenticated access, suggesting this affects only deployments where admin credentials are already compromised or accessible.
Cool Mo Maigcal Number App versions 1.0.0 through 1.0.3 on Android contain improper export of application components in AndroidManifest.xml, allowing local authenticated attackers to access sensitive functionality of the com.sdmagic.number component. While CVSS severity is minimal (1.9), publicly available exploit code exists; exploitation requires local device access and authenticated privileges but carries information disclosure impact.
Improper export of Android application components in Lobby Universe Lobby App versions 2.0 through 2.8.0 allows local attackers with user-level privileges to access sensitive functionality via the com.maverick.lobby component. The vulnerability stems from AndroidManifest.xml misconfiguration that exposes internal application activities without proper permission protection, enabling local privilege escalation or information disclosure. Publicly available exploit code exists, though exploitation requires local device access and authenticated user privileges.
Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.
Uninitialized kernel memory access in the Linux kernel's comedi data acquisition subsystem allows local low-privilege users to crash the system by submitting crafted ioctl instructions targeting subdevice handlers. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate MIN_SAMPLES (16) data elements but only copy the first insn->n elements from user space for write-type instructions, leaving the remainder uninitialized; certain subdevice handlers read beyond insn->n, triggering undefined behavior that results in denial of service. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects very low exploitation probability, consistent with a niche kernel subsystem requiring specialized hardware.
Kernel crash in Linux netfilter nf_conntrack allows local users to cause a denial of service via a race condition during connection tracking garbage collection and entry confirmation. Across multiple Linux kernel stable series through 6.16-rc6, a three-CPU race between conntrack garbage collection, slab memory recycling, and connection confirmation can corrupt an hlist pointer in an nf_conn structure, causing a kernel oops in __nf_ct_delete_from_lists(). No public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) confirms very low current exploitation probability, though the availability impact is severe - a kernel panic takes down the entire host.
Kernel oops and double-free in Linux SMC networking code causes local denial of service through a struct type confusion between smc_sock and inet_sock. The smc_sock structure hijacks AF_INET/AF_INET6 sk_family without placing inet_sock as its first member, causing downstream INET infrastructure - specifically cipso_v4_sock_setattr() - to misinterpret the smc_sock.clcsk_data_ready function pointer (at offset 784) as an inet_sock.inet_opt IP options pointer and attempt to free read-only text-segment memory. No public exploit exists and EPSS is at the 3rd percentile, but syzbot confirmed reliable reproduction through Smack LSM + CIPSO interactions on affected kernels.
Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.