OS command injection in Vaelsys VaelsysV4 (versions up to 5.1.0 and 5.4.0) allows remote unauthenticated attackers to execute arbitrary operating system commands via the xajaxargs parameter passed to the execute_DataObjectProc function in /grid/vgrid_server.php. The attack is fully remote, requires no authentication per the CVSS 4.0 PR:N metric, and a public proof-of-concept exploit is confirmed available on GitHub, raising the urgency of remediation. No active exploitation has been confirmed by CISA KEV at time of analysis, though an EPSS at the 75th percentile reflects non-trivial exploitation probability relative to the broader CVE population.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Online Ordering System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL code via the firstname parameter in signup.php. The vulnerability is publicly known and exploit code is available. EPSS exploitation probability is low (0.07%), and no active exploitation in the wild has been reported.
A race condition in the Linux kernel's MPTCP (Multipath TCP) protocol implementation allows local attackers with limited privileges to trigger a kernel warning and denial of service by causing non-atomic fallback decisions and actions during connection establishment. The vulnerability (CWE-667: Improper Locking) arises from unsynchronized access to fallback state in mptcp_do_fallback() when processing incoming TCP options, enabling a local user to crash the system or hang connections via crafted MPTCP packets. EPSS score of 0.03% indicates low real-world exploitation probability despite moderate CVSS impact severity.
Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.
Uninitialized kernel memory access in the Linux kernel's comedi data acquisition subsystem allows local low-privilege users to crash the system by submitting crafted ioctl instructions targeting subdevice handlers. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate MIN_SAMPLES (16) data elements but only copy the first insn->n elements from user space for write-type instructions, leaving the remainder uninitialized; certain subdevice handlers read beyond insn->n, triggering undefined behavior that results in denial of service. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects very low exploitation probability, consistent with a niche kernel subsystem requiring specialized hardware.
Kernel crash in Linux netfilter nf_conntrack allows local users to cause a denial of service via a race condition during connection tracking garbage collection and entry confirmation. Across multiple Linux kernel stable series through 6.16-rc6, a three-CPU race between conntrack garbage collection, slab memory recycling, and connection confirmation can corrupt an hlist pointer in an nf_conn structure, causing a kernel oops in __nf_ct_delete_from_lists(). No public exploit identified at time of analysis, and EPSS at 0.15% (5th percentile) confirms very low current exploitation probability, though the availability impact is severe - a kernel panic takes down the entire host.
Kernel oops and double-free in Linux SMC networking code causes local denial of service through a struct type confusion between smc_sock and inet_sock. The smc_sock structure hijacks AF_INET/AF_INET6 sk_family without placing inet_sock as its first member, causing downstream INET infrastructure - specifically cipso_v4_sock_setattr() - to misinterpret the smc_sock.clcsk_data_ready function pointer (at offset 784) as an inet_sock.inet_opt IP options pointer and attempt to free read-only text-segment memory. No public exploit exists and EPSS is at the 3rd percentile, but syzbot confirmed reliable reproduction through Smack LSM + CIPSO interactions on affected kernels.
Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.
Memory leak and refcount imbalance in Linux kernel VLAN 0 handling allows local attackers with low privileges to trigger denial of service via kernel panic when toggling the rx-vlan-filter feature at runtime on bonded or team interfaces. The vulnerability affects kernel versions 6.16-rc1 through rc3 and potentially earlier versions; vendor-released patches are available across affected stable branches.
Denial of service in Linux kernel net/sched subsystem allows local authenticated attackers to trigger a kernel panic (BUG_ON) by manipulating HTB qdisc (hierarchical token bucket queue discipline) configuration with nested qdisc classes, causing htb_lookup_leaf to encounter an empty rbtree. The vulnerability requires low privilege and local access; no special user interaction is needed once a malicious qdisc configuration is set up. Vendor-released patches are available across multiple stable kernel series.
A race condition in the Linux kernel's net/sched sch_qfq module allows local authenticated attackers to cause denial of service through NULL pointer dereference or use-after-free errors when concurrent threads modify queue aggregation structures during packet scheduling. The vulnerability requires low privileges and has a low real-world exploitation probability (EPSS 0.02%), though a vendor patch is available.