Authenticated command injection in EndRun Technologies Sonoma D12 GPS Network Time Server firmware (build 6010-0071-000, Ver 4.00) lets a low-privileged user inject OS commands that run on the underlying appliance, yielding arbitrary code execution, privilege escalation, information disclosure, and denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:L/S:C) shows a network-reachable, low-complexity flaw whose scope change lets a foothold on the management interface compromise the whole device. A third-party advisory (xdiv-sec) documents the issue; there is no public exploit identified and no CISA KEV listing at time of analysis, and EPSS is a modest 1.58% (73rd percentile).
Unrestricted file upload in Tipray Data Leakage Prevention System 1.0 allows unauthenticated remote attackers to upload arbitrary files via the uploadWxFile.do endpoint. A publicly available exploit exists, but the EPSS score of 0.06% and low CVSS impact ratings suggest limited real-world exploitation probability. No vendor patch is available.
We need to produce a JSON object with specific fields. Let's analyze the input carefully. Input: - CVE ID: CVE-2025-11341 - Description: "A security flaw has been discovered in Jinher OA up to 2.0. This affects an unknown function of the file /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx/?type=SystemUserInfo&style=1. Performing manipulation results in xml external entity reference. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited." - CVSS Score: 5.5 (looks like a score, but vector is CVSS v4.0. I'll use that.) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-610 Externally Controlled Reference to a Resource in Another Sphere (probably XML External Entity) - EPSS Score: 0.03% (percentile 10%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* (version up to 2.0) - Tags: XXE, Jinher Oa - References: three VulDB links, one GitHub issue. Potential for KEV? No mention of KEV in input, so not in KEV. So exploitation status: "publicly available exploit code exists" because POC/Exploit says publicly available, but no KEV confirmation. So "publicly available exploit code exists". We'll note that. Now fields: product_name: "Jinher OA" (up to 2.0). Product name is "Jinher OA". So "Jinher OA" (1-3 words). I'll just use "Jinher OA". summary: 2-3 sentence plain-language synthesis. Do not copy description. Start with impact verb and product. E.g. "XML External Entity (XXE) injection in Jinher OA up to version 2.0 allows unauthenticated remote attackers to read local files or perform server-side request forgery via crafted XML input to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx". The description says "xml external entity reference", remote exploitation possible. Exploit publicly released. EPSS low. No KEV. So summary: "An XML External Entity (XXE) injection vulnerability in Jinher OA (up to version 2.0) allows unauthenticated attackers to exfiltrate local files or perform SSRF by sending crafted requests to /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx. Exploit code is publicly available, but EPSS suggests low exploitation probability." Actually EPSS 0.03% is very low, but exploit publicly available. So mention POC available. Start with "XML External Entity (XXE) injection in Jinher OA allows unauthenticated remote attackers to...". Yes. technical_context: Mention the underlying technology: Jinher OA is an office automation platform likely using ASP.NET (from the .aspx path). The vulnerability is CWE-610, XXE. The attack vector is remote, via HTTP request to a specific page. The CPE is cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*, indicating all versions up to 2.0. The vulnerability arises from parsing untrusted XML with external entity processing enabled. The file path suggests a WebDesign.aspx page that processes XML. Use educational tone. risk_assessment: Use provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N with impacts VC:L/VI:L/VA:L (confidentiality, integrity, availability all low). EPSS 0.03%, very low exploitation probability. No KEV. POC publicly available. CVSS score 5.5 (medium). So risk: low threat activity but easy attack, so moderate risk if exposed. Check conflicting signals: CVSS indicates network vector, unauthenticated, low impact. EPSS suggests rare active exploitation. So while exploit is available, it's not widely targeted. So risk is limited to specific exposed instances. No conflicting. affected_products: Write paragraph: "Jinher OA versions up to 2.0, as identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The specific vulnerable endpoint is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx?type=SystemUserInfo&style=1. Vendor advisory may be available from VulDB (links provided)." But we need to avoid bullet points, just narrative. So: "Jinher OA versions up to and including 2.0 are affected. The known vulnerable file is /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx with specific parameters. The vendor advisory is tracked by VulDB (https://vuldb.com/?id.327226)." remediation: No patch version given. No mention of fixed version. So we need to suggest compensating controls. Since no patch, recommend: "Upgrade to a version beyond 2.0 if available, or apply input validation to disable XML external entity processing. As an immediate mitigation, restrict network access to the vulnerable endpoint or implement a web application firewall (WAF) rule to block XXE payloads. Disabling DTD processing in the XML parser configuration, if possible, would prevent exploitation." No exact version, so say: "No vendor-released patch has been confirmed; mitigate by disabling XML external entity processing or restricting access to the vulnerable aspx page." We'll craft. exploit_scenario: Realistic attack: An attacker sends a specially crafted HTTP request to the vulnerable endpoint containing a malicious XML payload with an external entity that points to a local file (e.g., /etc/passwd) or an external server to exfiltrate data. Since no authentication is required (PR:N), remote unauthenticated exploitation is possible. POC available. exploitation_conditions: The CVSS vector shows AV:N, so network accessible. PR:N so no authentication needed? Vector says PR:N, so unauthenticated. UI:N, so no user interaction. No specific conditions in description beyond the endpoint URL. It says "Performing manipulation results in xml external entity reference." No mention of special configuration. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Jinher OA up to 2.0, provided the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint is accessible over the network." The file path is specific, so it must be accessible. No limiting factors like authentication, so it's wide open. So: "No authentication or user interaction is required; the vulnerable endpoint must be reachable over the network. The attack works with default configurations." That's enough. attack_chain: Follow kill chain: Remote attacker discovers vulnerable endpoint → Sends crafted XML request with external entity → XML parser processes entity, allowing file read or SSRF → Impact (Confidentiality/Integrity/Availability low). We'll use: "Send crafted HTTP POST request to vulnerable endpoint → XML parser resolves external entity → Exfiltrate sensitive file contents or perform SSRF". Steps: Access → Delivery (HTTP request with XML) → Exploit (XXE) → Execution (entity resolution) → Impact (file read/SSRF). I'll construct a chain of 4 steps: "Send crafted XML payload to WebDesign.aspx → Trigger XML external entity processing → Access arbitrary local files via entity resolution → Use exfiltrated data or trigger SSRF for further access". That's 4. Good. confidence_notes: We know exploit code is publicly available (GitHub issue referenced). The CVSS vector provided is from VulDB likely, but NVD hasn't published yet? The CVE is from VulDB. NVD references include the GitHub link as exploit. No vendor confirmation, just VulDB report. So: "Exploit code confirmed publicly available via GitHub. Affected product and version range confirmed by CPE from VulDB. No official vendor advisory or patch identified; patch status unknown. CVSS vector from VulDB indicates network-accessible, unauthenticated attack with low impact." We'll state what's missing. prevalence: Jinher OA is an office automation platform, likely Chinese product. How widely deployed? I'm not sure. It might be niche. I'll estimate low or medium? I'm leaning low because it's not a globally known product. Possibly used in some Chinese enterprises. I'll go with "low" and basis: "niche Chinese OA platform, limited enterprise deployment". Might be unknown but I'll pick low. prevalence_basis: "niche Chinese OA platform, limited global footprint." That's within 12 words. assessed_cvss_vector: We're supposed to provide our own CVSS 3.1 vector, not copy the given 4.0 one. Given the description: remote, unauthenticated, XXE. Attack vector: Network (AV:N). Attack Complexity: Low (AC:L) because just sending crafted request. Privileges Required: None (PR:N) because no authentication mentioned. User Interaction: None (UI:N) because no user involved. Scope: Unchanged? XXE can sometimes lead to scope change if exfiltrating data from a different system, but typically file read is on the same system, so Scope U. Confidentiality Impact: Low (C:L) as described in VC:L. Integrity Impact: Low (I:L). Availability Impact: Low (A:L). So vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's consistent. I'll output that as my assessed CVSS 3.1 vector. assessed_cvss_rationale: "Remote network exploitation without authentication or user interaction, with low confidentiality, integrity, and availability impacts from file read and SSRF." assessed_cvss40_vector: They already gave one, but I'll produce my own assessment consistent with the 3.1 vector. For 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. I'll use that. Now assemble JSON. Ensure all fields are strings. No arrays, no nesting. Use double quotes. Make sure the summary does not say "A vulnerability..." but start with "XML External Entity (XXE) injection in Jinher OA...". Yes. technical_context: mention CWE-610 and that it's an XML parsing issue with external entity processing. Use CPE to point to affected product. "The vulnerability is an XML External Entity injection (CWE-610) in the Jinher OA web application, which likely uses an ASP.NET XML parser that defaults to enabling external entity resolution. The vulnerable endpoint processes user-supplied XML in a POST request, and by crafting a malicious XML document with an external entity pointing to a local file or internal resource, an attacker can read sensitive files or initiate SSRF. The CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:* captures all versions up to 2.0." risk_assessment: "CVSS 4.0 scores this as 5.5 Medium, with network attack vector, low complexity, no privileges or user interaction required, and low impact on all three CIA metrics. The EPSS estimate of 0.03% suggests very low likelihood of active exploitation in the wild, despite the public availability of exploit code. No CISA KEV entry indicates no known active exploitation campaigns. Overall, this is a straightforward XXE vulnerability but with limited post-exploitation impact, making it a moderate priority for organizations using the affected product." affected_products: "Jinher OA versions up to and including 2.0, identified by CPE cpe:2.3:a:jinher:jinher_oa:*:*:*:*:*:*:*:*. The vulnerability is located in the /c6/Jhsoft.Web.module/eformaspx/WebDesign.aspx endpoint with specific parameters. The report is available at VulDB (https://vuldb.com/?id.327226)." remediation: "Apply the vendor patch if available (no specific version identified in the advisory). As a workaround, disable XML external entity processing in the application's XML parser configuration, or restrict network access to the vulnerable .aspx file using a WAF or firewall rules. Disabling DTD resolution entirely may break legitimate functionality if required by the application; test thoroughly before deploying." exploit_scenario: "An unauthenticated remote attacker sends a specially crafted HTTP POST request to the vulnerable /c6/Jhsoft.Web
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter of the findSingConfigPage.do endpoint, potentially leading to unauthorized database access. Public exploit code is available but no active exploitation has been confirmed (not in CISA KEV), and the EPSS score is a low 0.03%, indicating limited immediate risk. The vendor has not responded to disclosure and no patch is available.
We need to produce a JSON object with all required fields based on the CVE-2025-11316 data. The data includes CVSS 4.0 vector, but we need to produce an assessed CVSS 3.1 vector and rationale, and an assessed CVSS 4.0 vector consistent with our assessment. Also, we need to synthesize from the description, EPSS, POC/exploit, tags, CPE, CWE, references. There is no KEV mention, so KEV is not active. The exploit has been publicly disclosed, so POC/Exploit is publicly available. We'll note that. The vendor didn't respond. No patch info available. So remediation should mention no vendor patch, suggest compensating controls if possible (but we need specific conditions). The description: "A vulnerability was determined in Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 1.0. Affected by this issue is the function findCategoryPage of the file findCategoryPage.do. Executing manipulation of the argument tenantId can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized." So SQL injection in tenantId parameter. Remote. No auth mentioned. The CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/... So the base metrics imply network vector, low attack complexity, no attack requirements, no privileges, no user interaction, low impact on vulnerable system, no scope change. So the base score would be: CVSS 4.0 base formula: use AV:N (0.2), AC:L (0.1), AT:N (0.1) -> Attack Vector weight: 0.2 * 0.1 * 0.1? Actually need to compute properly, but we'll produce a vector consistent with the input, but we are to give our own independent assessment. Since we have little else, we might adopt the same vector as the provided CVSS 4.0 for vulnerable system metrics (VC/VI/VA=L), and SC/SI/SA=N. So our assessed CVSS 4.0 vector could be: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. The E:P is from the exploit maturity, not base. So we'll output base onl
SQL injection in Tipray DLP version 1.0 allows remote attackers to manipulate database queries through the 'sort' parameter in the findSingConfigPage.do endpoint. The vulnerability has a publicly available exploit, but EPSS indicates very low exploitation probability and no active exploitation confirmed by CISA KEV. Successful exploitation may lead to low-impact loss of confidentiality, integrity, or availability.
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote attackers to manipulate the sort parameter in findRolePage.do, potentially leading to unauthorized database read or modification. Public exploit code is available, but no actively exploited incidents are reported and the exploitation probability (EPSS 0.03%) is very low. The vendor has not responded to the disclosure and no patch is confirmed.
SQL injection in Tipray Data Leakage Prevention System allows remote unauthenticated attackers to inject malicious SQL via the sort parameter in findModulePage.do, compromising database confidentiality and integrity. Exploit code is publicly available, but the EPSS probability is very low (0.03%), indicating limited exploitation likelihood due to the product's niche footprint.
We are tasked with generating a comprehensive JSON analysis for CVE-2025-11311. I need to synthesize the provided data: CVE description, CVSS 4.0 vector, CWE-74, EPSS (0.03%, low), POC/exploit publicly available (from tags), CPE for Tipray Data Leakage Prevention System 1.0, references, and no KEV mentioned. I must produce JSON with specified fields. First, I'll extract key info: - Product: Tipray Data Leakage Prevention System (DLP) version 1.0, by 厦门天锐科技股份有限公司. - Vulnerability: SQL injection in function findTenantPage of file findTenantPage.do, argument sort leads to SQLi. Remote attack possible. - CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - though typically SQLi is CWE-89, but it's labeled CWE-74, which is broader injection. I'll mention root cause as SQL injection, but CWE-74 might be a misclassification. I can note that it's an injection vulnerability leading to SQL command execution. - CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So network attack, low complexity, no privileges, no user interaction, vulnerable component likely the database with low impacts on confidentiality, integrity, availability. No subsequent impact. Exploit code maturity: Proof-of-concept (E:P). So it's an unauthenticated SQLi with low impact. - EPSS: 0.03% (very low exploitation probability), 9th percentile. So unlikely to be widely exploited, but POC exists. - No KEV: Not in CISA Known Exploited Vulnerabilities catalog. So no evidence of active exploitation. - Exploit availability: "The exploit has been disclosed publicly and may be used." So POC public. "Tags: SQLi, Data Leakage Prevention System" confirms. - CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0 indicates the specific product version. - References: includes a GitHub link to a vuln report, vuldb.com entries. The vendor did not respond. Now, I'll craft each field. product_name: "Data Leakage Prevention System" (3 word
SQL injection in Tipray Data Leakage Prevention System 1.0 allows remote unauthenticated attackers to extract or manipulate database content via the findFileServerPage.do endpoint. A publicly available exploit exists, but no vendor patch is available. EPSS score is low (0.03%), indicating limited current exploitation activity, though public availability may increase risk.
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to inject SQL via the 'editid' parameter in /visitor-detail.php, potentially exfiltrating or modifying database information. Public exploit code is available, but EPSS score of 0.03% indicates low likelihood of exploitation.
We need to produce a JSON analysis. The input provides CVE details, description, CVSS score (5.5) but that appears to be a CVSS v4.0 vector with base score likely computed from it? The given vector shows AV:N/AC:L/AT:N/PR:N/UI:N... so base score might be 5.5 but let's compute: CVSS 4.0 base metrics: AV:N/AC:L/AT:N/PR:N/UI:N impact to vulnerable system: VC:L/VI:L/VA:L (low on all), subsequent system: SC:N/SI:N/SA:N. The base score formula for CVSS 4.0: from spec, with SC:N/SI:N/SA:N, it's impact to VC,VI,VA only. The base score = max(impact score, exploitability score). Impact sub-score (ISS) = 1 - [(1-VC)*(1-VI)*(1-VA)] = 1 - (0.78*0.78*0.78)=1-0.474552=0.525448? wait VC=L=0.22? Actually CVSS 4.0 uses the same values as CVSS 3.1 for impact subscore? The CVSS 4.0 base score calculation: Exploitability (ESS) = something. But the base score as given is 5.5, which can be derived from that vector. So I'll accept that as the assessed score by NVD? The vector provided is a CVSS 4.0 vector, not 3.1. We need to produce our own assessed CVSS 3.1 and 4.0 vectors. I'll assess independently. Description: SQL injection in code-projects Online Course Registration 1.0, file /admin/manage-students.php, parameter ID. Remote. Public exploit exists. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but SQL injection is CWE-89 typically. CWE-74 is generic, but could be mapping. EPSS 0.03%, low. POC available. Not in KEV. Unknown patch status from input. We need to produce all fields. Product name: "Online Course Registration Site" (from CPE product) or "Online Course Registration"? The description says "code-projects Online Course Registration 1.0". CPE: fabian:online_course_registration_site:1.0. The vendor is "code-projects"? Actually "code-projects" is the website domain. The CPE product is "online_course_registration_site". So product name: "Online Course Registration Site 1.0" (maybe just "Online Course Registration Sit
SQL injection in code-projects Student Crud Operation 3.3 via the `ID` parameter of `delete.php` allows remote unauthenticated attackers to perform mass deletion of records, impacting data integrity and service availability. Public exploit code is available, but the vulnerability carries very low exploitation probability (EPSS 0.03%) and is not listed in CISA KEV. This is a niche application with minimal real-world footprint.
We need to produce a JSON object with the specified fields. Let's analyze the input. CVE ID: CVE-2025-11315 Description: vulnerability in Tipray Data Leakage Prevention System (天锐数据泄露防护系统) version 1.0. The function findUserPage in findUserPage.do has SQL injection via sort argument. Remote exploitation possible. Exploit made public. Vendor contacted but did not respond. CVSS Score: 5.5 (is that CVSS v4.0? The vector provided is CVSS:4.0, so the score is likely the CVSS v4.0 score 5.5. But the input says "CVSS Score: 5.5" and then "CVSS Vector: CVSS:4.0/..." which is consistent. So it's a medium score. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), but SQL injection is CWE-89. The CWE given is CWE-74, which is a parent of injection. Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" and SQL injection is a child. But the description explicitly says SQL injection. So we'll mention that. EPSS: 0.03% (low), percentile 7%. POC/Exploit: Publicly available Keys: KEV not mentioned, so NOT in KEV. So exploitation: "publicly available exploit code exists" (but not confirmed actively exploited). No mention of KEV in data. So no active exploitation confirmed. Tags: SQLi, Data Leakage Prevention System References: there are NVD links to vuldb and a github POC. CPE: cpe:2.3:a:tipray:data_leakage_prevention_system:1.0:*:*:*:*:*:*:* Now we need to fill each field. product_name: "Tipray Data Leakage Prevention System" is too long? Need 1-3 words. Options: "Tipray DLP", "Tipray Data Leakage Prevention System" is 4 words. "Tipray DLP" might be best, but that's an abbreviation. The product full name is "Data Leakage Prevention System" by Tipray. I'd go with "Tipray DLP" as it's short and recognizable. But the description says "Tipray Data Leakage Prevention System" and "天锐数据泄露防护系统". I'll use "Tipray DLP" as shorthand. Or "Tipray Data Leakage Prevention System" but that's 4 words. Might be "Tipray DLP System"? No. I'll use "Tipray DLP". I think it's fine, "DLP" is common. But the instruction says "1-3 words ONLY." So I'll do "Tipray DLP". Yes. summary: Start with impact verb and product. "SQL injection in Tipray DLP 1.0 allows remote attackers to manipulate database queries via the sort parameter of findUserPage.do." Then add extra: "Exploit code is publicly available, and the vendor has not responded to disclosure. EPSS score is 0.03%, indicating low exploitation likelihood, but the vulnerability is easy to exploit." So original synthesis, not copying description. I'll craft a concise 2-3 sentences. technical_context: Explain: the vulnerability is in findUserPage.do endpoint, likely a web-based user management page that uses unsanitized sort parameter for sorting user results, leading to SQL injection (CWE-89, subset of CWE-74). The product is a Data Leakage Prevention System, typically deployed in enterprise environments to monitor/block data exfiltration. The affected product is version 1.0, as per CPE. CWE-74 indicates injection in output, but SQL injection suggests improper neutralization of input before SQL query. So I'll explain. risk_assessment: CVSS v4.0 base score 5.5 (medium), vector with AV:N/AC:L/AT:N/PR:N/UI:N, so network attack, low complexity, no privileges, no user interaction. Impact to vulnerable system: L/L/L (confidentiality, integrity, availability all low). No impact to subsequent system. EPSS 0.03% (very low exploitation probability). No KEV. POC public. So risk: low-medium. SSVC: exploitation: public PoC, no active exploitation; automatable: likely automatable (UN:N), technical impact: limited (low impact on each). So decision may be "track" or "remediate" depending on context. Compare signals: CVSS medium, EPSS very low, public PoC, vendor unresponsive, so no patch. So it's a low-risk vulnerability but could be easily exploited if exposed. But exposure of DLP system may be internal, so network vector might be internal network only. So risk is limited. I'll state: "CVSSv4.0 scores 5.5 (Medium), indicating limited impact. EPSS of 0.03% suggests exploitation is unlikely, but public exploit code exists. No active exploitation reported. The attack requires network access to the DLP web interface, which is likely internal-only, reducing external risk." affected_products: CPE specifies Tipray Data Leakage Prevention System:1.0. So: "Tipray Data Leakage Prevention System version 1.0 is affected. The vendor has not released a patch or advisory. No CPE for other versions, but 1.0 is explicitly affected." Add references to vuldb etc. remediation: No vendor patch. So suggest: "No vendor-released patch identified. As a temporary workaround, restrict network access to the DLP management interface to trusted administrators only. Validate and sanitize sort parameter input using parameterized queries if source code is accessible. Consider deploying a web application firewall rule to block SQL injection attempts against findUserPage.do." Mention side effects: restricting access may limit legitimate remote administration. Note that patch version is unknown. So remediation paragraph. exploit_scenario: "An attacker sends a specially crafted HTTP request to the findUserPage.do endpoint with a malicious sort parameter containing SQL payload. This allows extraction of database contents or manipulation of data, potentially bypassing data protection policies." Given public PoC. exploitation_conditions: Need to extract exact prerequisites. The vulnerability is in the findUserPage function accessed via the web endpoint, and requires the sort parameter to be manipulated. No authentication mentioned? The CVSS vector says PR:N (no privileges required). So remote unauthenticated exploitation, but the DLP interface might not be exposed to the public internet, often internal. The condition: "Access to the findUserPage.do endpoint of the Tipray DLP web interface (version 1.0). No authentication mentioned; the vector suggests unauthenticated access. The attack does not require user interaction." So I'll state: "No special conditions — remote unauthenticated exploitation against the default configuration of Tipray DLP 1.0. The sort parameter of findUserPage.do is directly reachable. No authentication required, as per CVSS vector." Might add that the web interface may be internal, but that's a deployment condition, not a product condition. attack_chain: I'll craft a chain: Recon (identify DLP endpoint) → Craft SQL injection payload in sort parameter → Send HTTP request to findUserPage.do → Trigger SQL injection in backend database → Extract data or modify database. Something like: "Discover findUserPage.do endpoint → Inject SQL payload via sort parameter → Database executes malicious query → Exfiltrate sensitive data or compromise database". Keep 3-7 steps. I'll do 4 steps: "Identify DLP web interface → Send crafted HTTP request with SQL payload in sort parameter → Backend executes unsanitized SQL query → Extract or manipulate database contents". That covers access, exploit, impact. confidence_notes: "Public exploit code confirmed via GitHub PoC (reference). Affected version 1.0 confirmed by CPE; no vendor advisory. No patch version known. CVSSv4.0 vector provided, indicating unauthenticated remote access (PR:N). EPSS data available. No KEV listing." prevalence: The product is a Data Leakage Prevention System by a Chinese vendor (Tipray/厦门天锐科技股份有限公司). DLP systems are typically used in enterprises, but not as widespread as general web servers. Tipray is not a globally dominant vendor; likely a niche product in Chinese market. So prevalence: "low" or "medium"? I'd say "low" because it's a specific vendor's DLP product, likely not as widely deployed as something like Symantec DLP or Forcepoint. So "low". Prevalence_basis: "niche vendor's DLP appliance, likely limited enterprise footprint". So "low" and "niche vendor, limited deployment scope". assessed_cvss_vector: My own independent assessment. The description says remote exploitation, SQL injection. Attack vector: Network (AV:N), Attack Complexity: Low (AC:L) because sort parameter is directly injectable. Privileges Required: According to CVSS v4.0 vector, PR:N. Need to decide PR honestly. The description doesn't mention authentication; the GitHub PoC might show no auth. So PR:N seems plausible. User Interaction: None (UI:N). Scope: The CVSS v4.0 vector says S:N (no scope change). In CVSS 3.1, scope is separate, but SQL injection typically doesn't change scope unless accessing other database, but generally it's the same vulnerable component (the web app) so S:U. Confidentiality, Integrity, Availability: SQL injection can allow reading, modifying, deleting data. So impact ratings: C:L I:L A:L? Actually SQL injection often leads to high impact if full database access, but the vector says L/L/L. That's a low impact. I'll go with low impact as the vector indicates limited impact. The description doesn't specify that the injection can read sensitive data or execute commands; it's a generic SQL injection. I'd say C:L, I:L, A:L. So CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. I'll craft vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a base score of 6.5? Actually CVSS 3.1 score for that vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L: 6.5 (Medium). But the given CVSSv4.0 score is 5.5, which is lower. I'll stick with the assessed vector based on my judgment, not copy. So S:U, C:L I:L A:L. So vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: "Remote unauthenticated access with low complexity; SQL injection yields partial data disclosure and modification." So assessed_cvss_vector string. assessed_cvss40_vector: Convert to CVSS 4.0. With AV:N AC:L AT:N PR:N UI:N, VC:L VI:L VA:L, SC:N SI:N SA:N. So: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's consistent with the input vector minus subsequent system impact? The provided vector had VC:L VI:L VA:L and SC:N SI:N SA:N. So my assessed CVSS4.0 vector is identical to the one in input, but I'm assessing. So I'll output that. But it says "Your OWN independent ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." The input vector is exactly that: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... but with extra temporal/environmental placeholders. I'll just output the base: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's a copy? It's based on the description, so it's okay if it matches, I'm not copying an external score but my assessment yields the same. I'll just state that vector. Rationale for CVSS 3.1: "Requires no privileges or user interaction; SQL injection yields partial data access and modification." Now assemble JSON. I'll be careful with all the rules. The CWE-74 mentioned, but SQL injection is CWE-89. I'll mention in technical_context. Check "prevalence_basis": "niche vendor DLP appliance, limited deployment scope" (12 words max). So "niche vendor, limited enterprise footprint" 4 words okay. assessed_cvss_rationale: for 3.1: "
Authenticated OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets a privileged remote user inject arbitrary operating-system commands that run outside the vulnerable component, yielding full device takeover, denial of service, privilege escalation, and disclosure of sensitive timing/configuration data. Because Network Time Servers act as an authoritative time source for entire environments, compromise can cascade into time-manipulation attacks against downstream systems (logging, certificates, Kerberos). This is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documents the flaw; EPSS is modest at 1.63% (73rd percentile).
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets an authenticated high-privileged operator inject shell commands into the appliance's underlying OS, escaping the management application to run arbitrary code as the device. Because the appliance is a hardened timing source, successful exploitation yields full compromise: code execution, denial of service, privilege escalation, and disclosure of sensitive data. No public exploit is identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; the EPSS score is moderate at 1.63% (73rd percentile) and the CVE is not on CISA KEV.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject shell commands that the appliance executes, enabling arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data. The NVD CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N) and a third-party technical advisory (xdiv-sec) has been published, but there is no public exploit identified at time of analysis and the flaw is not on CISA KEV. EPSS is modest at 1.20% (64th percentile), indicating no observed mass exploitation to date.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, Ver 4.00) lets remote attackers inject operating-system commands into the appliance, enabling arbitrary code execution, privilege escalation, disclosure of sensitive data, and disruption of the device's timing service. A third-party advisory (xdiv-sec) documents the issue, but no public exploit was identified at time of analysis and it is not listed in CISA KEV; EPSS is modest at 1.20% (64th percentile). Because this device supplies authoritative time to dependent infrastructure, compromise can cascade beyond the appliance itself.
OS command injection in EndRun Technologies' Sonoma D12 GPS Network Time Server (firmware 6010-0071-000, version 4.00) lets remote attackers inject operating-system commands through the appliance's management interface, exposing sensitive information and, per the CVSS integrity rating, allowing manipulation of the device. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 8.2) indicates network-reachable, low-complexity exploitation, and an independent security-research advisory (xdiv-sec) documents the flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is 1.00% (59th percentile), signaling low measured exploitation activity so far.
OS command injection in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets remote attackers inject operating-system commands and extract sensitive information from the appliance. The flaw is reachable over the network without authentication per the published CVSS vector, and a third-party security advisory (xdiv-sec) documents the issue. No public exploit identified at time of analysis, and EPSS probability is low (1.00%, 59th percentile).
Cross-site request forgery in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets a remote attacker forge state-changing web requests that a logged-in operator's browser executes, chaining into arbitrary code execution, denial of service, privilege escalation, and disclosure of sensitive data on the appliance. Any organization relying on this GPS-disciplined NTP appliance for time synchronization is affected. No public exploit identified at time of analysis, though an independent research advisory (xdiv-sec) documenting the flaw has been published.
Cross-site scripting in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0076-000, version 4.00) lets an attacker inject script into the appliance's web management interface, executing in the browser of an authenticated operator who views the malicious content and enabling theft of session data and sensitive configuration information. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R) indicates a remote, low-complexity attack that requires low-privilege access to inject and victim interaction to trigger. No public exploit identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; EPSS is low at 0.28% (20th percentile).
Cross-site scripting in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets an attacker inject script into the device's web management interface to steal sensitive information such as session data or configuration from an authenticated operator. Exploitation requires a low-privileged authenticated context and victim interaction (a user must load the malicious content), and there is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documenting the flaw is publicly available. EPSS is low at 0.28% (20th percentile), and the issue is not listed in CISA KEV.
Cross-site scripting in EndRun Technologies Sonoma D12 GPS Network Time Server firmware 6010-0071-000 Ver 4.00 allows a remote unauthenticated attacker to inject and execute malicious scripts in the context of an authenticated user's browser session against the device's web management interface. Exploitation requires the attacker to trick an administrator into interacting with a crafted URL or page, after which the scope crosses into the victim's browser context, enabling session theft or credential harvesting. No public exploit confirmed at time of analysis, and EPSS of 0.22% (13th percentile) signals low automated exploitation activity.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated fromdate and todate parameters in /admin/sales-reports-detail.php. The vulnerability has low real-world impact (CVSS 2.1, EPSS 0.04%) despite public exploit availability, as it requires valid admin authentication and yields only limited data disclosure without full database manipulation capability.
Command injection in IdeaCMS up to version 1.8 allows high-privileged remote attackers to execute arbitrary system commands via manipulation of the 网站名称 (website name) parameter in the Website Name Handler component. The vulnerability exists in app/common/logic/admin/Config.php and requires high-privilege credentials but has publicly available exploit code and carries notable risk given the vendor's non-responsiveness to early disclosure.
Authorization bypass in Logo Cloud (all versions before 0.67) allows an authenticated high-privilege user to manipulate user-controlled key parameters to access resources outside their authorization scope via forceful browsing, resulting in high confidentiality impact alongside limited integrity and availability effects. The flaw is a classic Insecure Direct Object Reference (IDOR) pattern (CWE-639) made exploitable over the network without user interaction. No public exploit code exists and the EPSS score sits at 0.05% (17th percentile), indicating very low observed exploitation probability; however, the data-exposure risk for affected deployments warrants prompt patching to version 0.67.
SQL injection in code-projects Online Course Registration 1.0 allows high-privileged remote attackers to manipulate the coursecode parameter in /admin/edit-course.php, potentially extracting or modifying database contents. CVSS 4.0 reflects limited scope (only confidentiality/integrity impact to database layer with no system scope expansion), but the vulnerability requires administrative authentication (PR:H), significantly constraining real-world risk despite public exploit availability and 0.03% EPSS indicating minimal spontaneous exploitation likelihood.
Reflected cross-site scripting (XSS) in CmsEasy up to version 7.7.7 allows authenticated remote attackers to inject malicious scripts via manipulation of the PHP_SELF argument in the URL handler component (lib/inc/view.php). The vulnerability requires user interaction (clicking a malicious link) and user login to trigger, resulting in limited integrity impact. Publicly available exploit code exists, though EPSS score remains low at 0.03%, reflecting the significant prerequisites (authentication and user click required) that limit real-world exploitation potential. The vendor has not responded to disclosure attempts.
Path traversal in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0076-000 Ver 4.00) exposes sensitive files to authenticated network attackers. The flaw resides in the device's web interface, where insufficiently validated path input allows an attacker to escape the intended directory root and read arbitrary files from the underlying filesystem. No public exploit code or active exploitation has been confirmed at time of analysis, but a third-party security researcher advisory exists at xdiv-sec.github.io detailing the issue.
Open redirect in Logo Cloud before version 2025.R6 enables phishing and forceful browsing attacks against authenticated users who click attacker-crafted URLs. The CVSS vector (PR:L/UI:R) confirms the attacker requires low-privilege access and victim interaction, making this a social-engineering-dependent vulnerability. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating negligible opportunistic exploitation activity at time of analysis.
Stored or persistent cross-site scripting in Logo Cloud versions before 1.18 allows a high-privileged authenticated attacker to inject malicious scripts into web pages served by the application. Successful exploitation can result in limited confidentiality, integrity, and availability impact within the application's scope. No public exploit code exists and EPSS sits at the 14th percentile (0.04%), indicating this is not actively targeted in the wild at time of analysis.
Improper output encoding in Logo Cloud before version 2.57 enables phishing attacks by allowing injected or unescaped content to be rendered in the application context. The CVSS vector (PR:H/UI:R) narrows the realistic threat to authenticated high-privilege users who can introduce malicious output that is then presented to other users without proper sanitization. No active exploitation is confirmed - no CISA KEV listing and an EPSS score of 0.03% (10th percentile) both signal this is low-priority in the broader threat landscape.
Weak password requirements in Mangati NovoSGA up to version 2.2.12 allow remote attackers to bypass password policy validation during user account creation via manipulation of the Senha/Confirmação da senha (password/password confirmation) parameters on the /novosga.users/new endpoint. The vulnerability is difficult to exploit (CVSS AC:H) and offers only low confidentiality impact, but public exploit code is available and enables brute-force attacks against weak user credentials. EPSS score of 0.04% (percentile 12%) indicates limited real-world exploitation likelihood despite CVE publication.
Unrestricted file upload in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to upload arbitrary files via the uploadFile function in UploadController.java, potentially enabling remote code execution or system compromise. The vulnerability has publicly disclosed exploit code available. Despite a low CVSS score of 2.1 reflecting limited direct impact scope, the presence of public exploits and authentication bypass tags suggests practical exploitation risk in environments where attacker access is feasible.
Authorization bypass in zhuimengshaonian wisdom-education up to version 1.0.4 allows authenticated remote attackers to manipulate the subjectId parameter in WrongBookController.java to access unauthorized resources. The vulnerability has a low CVSS score (2.1) due to limited confidentiality impact and requirement for prior authentication, but publicly available exploit code exists and the attack vector is entirely network-accessible.
SQL injection in nahiduddinahammed Hospital-Management-System-Website allows authenticated remote attackers to execute arbitrary SQL queries via the ai parameter in /delete.php, with public exploit code available. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite network accessibility, as exploitation requires valid user authentication and produces only limited confidentiality impact. The vendor has not responded to disclosure attempts.
Command injection in D-Link DI-7100G C1 firmware up to version 20250928 allows remote authenticated attackers to execute arbitrary commands via the iface parameter in the /msp_info.htm?flag=qos endpoint of the jhttpd component. The vulnerability requires high-level administrative privileges and publicly available exploit code exists, but EPSS score of 0.06% indicates exploitation is unlikely in real-world scenarios due to the privilege requirement.
Stored cross-site scripting (XSS) in Langley FCU Online Banking System via the First Name field on the Add Customer Page (/customer_add_action.php) allows high-privileged authenticated users to inject malicious scripts affecting other users. The CVSS score of 1.9 reflects the high privilege requirement (PR:H) and user interaction dependency (UI:P), limiting real-world risk despite public exploit availability. No active exploitation has been confirmed in CISA KEV at time of analysis.