We need to produce a JSON object with the specified fields. All fields must be plain text strings, not arrays or objects. We synthesize from the given data: CVE-2025-11604. Given input: CVE ID: CVE-2025-11604 Description: A vulnerability was determined in projectworlds Online Ordering Food System 1.0. This issue affects some unknown processing of the file /all-orders.php. This manipulation of the argument Status causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSS Score: 5.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-74 EPSS Score: 0.03% (percentile 9%) POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Online Food Ordering System References: several URLs. KEV status not mentioned. So we assume not in KEV. POC publicly available. So exploitation status: "publicly available exploit code exists". Now, we need to craft the JSON. First field: product_name: "Online Ordering Food System" but must be 1-3 words. It's "Online Food Ordering System" from tags? The CPE product is "online_food_ordering_system". So product name: "Online Food Ordering System". Exactly. summary: Not copy description. Original synthesis. Must start with impact verb and product. Suggested: "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to manipulate the Status parameter in /all-orders.php, leading to unauthorized data access or modification." Mention no active exploitation detected, POC exists, low EPSS. "SQL injection in Projectworlds Online Food Ordering System 1.0 allows remote attackers to inject malicious SQL via the Status parameter in /all-orders.php, potentially reading or altering database contents. The vulnerability has a publicly available exploit, but no active exploitation has been confirmed by CISA, and EPSS estimates a low 0.03% probability of exploitation." technical_context: Underlying technology: PHP application, likely using MySQL. The vulnerability is SQL injection (CWE-89, but given CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). That's a generic injection, but SQLi is specifically CWE-89. However, the CWE provided is CWE-74. We'll mention it. Root cause: improper sanitization of user input in the Status parameter leading to SQL injection. Affected product from CPE: projectworlds online_food_ordering_system version 1.0. The issue is in /all-orders.php. "Projectworlds Online Food Ordering System 1.0 is a PHP-based web application. The vulnerability exists in the /all-orders.php script, where the 'Status' argument is directly incorporated into an SQL query without proper sanitation, falling under CWE-74. This allows injection of arbitrary SQL commands via the affected parameter." risk_assessment: Compare CVSS vector (provided as CVSS:4.0, but we need to translate to 3.1 for analysis? We can interpret: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L ... This is low impact on confidentiality, integrity, availability. So a successful attack yields limited impact. EPSS 0.03% very low. No KEV. POC exists. SSVC: exploitation is "poc" (public proof of concept), not actively exploited; automatable? Probably automatable because it's a simple URL parameter injection, but we need to check CVSS AT:N so automatable. Technical impact: low (limited C/I/A). So it's a low risk, not a priority. CVSS gives base score 5.5 (medium) but real-world risk is minimal. Mention conflicts: none. "CVSS:4.0 vector indicates network attack with low impact on confidentiality, integrity, and availability, resulting in a medium base score (5.5). However, EPSS predicts only a 0.03% chance of exploitation, placing it in the 9th percentile — well below the threshold for active concern. No CISA KEV listing exists. While a public proof-of-concept exploit lowers the barrier to exploitation, the limited technical impact and low prevalence of this niche application keep real-world risk low. The SSVC decision would lean towards 'Track' rather than 'Act', as no active exploitation has been observed and impact is limited." affected_products: "Projectworlds Online Food Ordering System version 1.0 is affected (CPE: cpe:2.3:a:projectworlds:online_food_ordering_system:1.0). No vendor advisory or fix information is available from the references provided; the vulnerability is reported via VulDB (id 327926)." remediation: "No vendor patch is available at this time. As a workaround, implement input validation and parameterized queries for the Status parameter in /all-orders.php to neutralize SQL injection. Additionally, restrict access to the administrative or order management interface to trusted users, and consider web application firewall (WAF) rules to block SQL injection attempts. These mitigations may require code-level changes or external filters, with potential disruption if incorrectly configured." exploit_scenario: "An attacker sends a crafted HTTP request to the /all-orders.php endpoint with a maliciously modified Status parameter, injecting SQL commands. This could extract sensitive data from the application's database or manipulate order statuses. Since a public exploit is available, an unauthenticated remote attacker with network access could easily reproduce the attack." exploitation_conditions: The CVE description says: "This manipulation of the argument Status causes sql injection." No specific authentication or configuration mentioned. CVSS vector is AV:N/PR:N/UI:N, so remote unauthenticated. But we must note that it's a specific file /all-orders.php, likely part of an admin or backend interface. Maybe it requires some access? However, per CVSS PR:N so unauthenticated. We'll state: "The vulnerable script /all-orders.php is accessible without authentication, as indicated by the CVSS vector (PR:N). No special configuration is required for exploitation; the SQL injection is triggered by direct manipulation of the Status parameter in an HTTP request. There are no limiting conditions beyond the availability of the target application online." But if the file requires some prior session? Not indicated. So I'll say: "The vulnerability is exploitable remotely without authentication, as indicated by CVSS vector parameters. No specific user interaction or non-default configuration is necessary; the Status parameter in /all-orders.php is directly injectable." attack_chain: "Send HTTP request with SQLi payload to /all-orders.php?Status=... → Database interprets injected SQL → Extract or modify order data". That's 3 steps. More detailed: "Access /all-orders.php endpoint → Inject malicious SQL into Status parameter → Database executes injected query → Attacker reads or alters data". Use "Access → Inject → Execute → Impact" four steps. I'll go with: "Send crafted request to /all-orders.php → Inject SQL payload via Status parameter → Backend database executes injected query → Sensitive data exfiltration or order manipulation". That's three steps with arrows. The field asks for 3-7 short steps separated by " → ". So I'll do: "Send HTTP request with malicious Status parameter → SQL injection into database query → Unauthorized data access or modification." confidence_notes: "Exploit code publicly available on GitHub (Duo-zhen/CVE/issues/4), confirming reproducibility. No vendor advisory or patch information; affected version confirmed by CPE and VulDB entry. No CISA KEV listing, nor independent verification of active exploitation." Also mention that authentication requirements not explicitly confirmed from description but CVSS says PR:N. prevalence: The product is a niche PHP application from Projectworlds, likely used as a learning or demonstration project, not widely deployed in enterprise. So prevalence is low. "low". Justification: "niche PHP demo system, limited real-world deployments". So "low". prevalence_basis: "projectworlds' demo/tutorial-level application, not enterprise-scale" assessed_cvss_vector: My own CVSS 3.1 vector. Given AV:N, AC:L, PR:N, UI:N, S:U (no scope change), Confidentiality Low (limited read), Integrity Low (modify maybe), Availability Low (maybe no DoS but limited). So: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's base score 6.3? Wait actually C:L/I:L/A:L yields score 7.1? Let's compute: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: (N, L, N, N, U) using formula: Impact subscore (ISS) = 1 - (1-C)*(1-I)*(1-A) = 1 - 0.9*0.9*0.9 = 1 - 0.729 = 0.271. Impact = 6.42 * ISS = 6.42 * 0.271 = 1.74. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85? Wait formula: Exploitability = 8.22 * AttackVector * AttackComplexity * PrivilegesRequired * UserInteraction. For AV:N=0.85, AC:L=0.77, PR:N=0.85, UI:N=0.85 => Exploitability = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * 0.4727 ≈ 3.886. Base Score = if Impact subscore <=0, 0; else roundup(min(Impact + Exploitability, 10))? Actually if Scope Unchanged, Base Score = roundup(min(Impact + Exploitability, 10)). 1.74 + 3.886 = 5.626, round up 5.7? Wait rounding rules: round up to one decimal: 5.626 -> 5.7. That's medium. But the provided CVSS 4.0 score is 5.5. So 5.7 is close. However, a more accurate assessment: The given CVSS:4.0 has VC:L/VI:L/VA:L, so impacted components vulnerable system confidentiality, integrity, availability all low. That suggests the SQL injection could read some data, modify some data, and cause limited availability impact (maybe denial of service). So C:L/I:L/A:L is appropriate. So I'll use that vector. I'll justify: "Network-accessible, low complexity, no privileges or user interaction; limited impact on all three CIA dimensions." assessed_cvss_rationale: "Network-accessible, no auth or user interaction required; low impact on confidentiality, integrity, and availability." assessed_cvss40_vector: The provided vector is already CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N . I can use that exact vector as my assessment, as it is consistent. But the instruction says "Your OWN independent CVSS 4.0 base vector" – I can reuse the same one if I agree. I'll keep it because it accurately reflects the vulnerability: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So I'll output that. assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale: "Matches the provided vector, reflecting remote unauthenticated access with limited impact on the vulnerable system." Now, put together all fields. All must be strings, no arrays. Let's craft each field accurately. product_name: "Online Food Ordering System" summary:
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in SourceCodester Best Salon Management System 1.0 allows unauthenticated remote attackers to manipulate the ServiceId parameter in /panel/add_invoice.php, potentially accessing or modifying database contents. Public proof-of-concept code is available, though EPSS indicates low exploitation probability (0.03%) and no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers to compromise the application database via the editid parameter in /panel/edit-appointment.php. Publicly available exploit code exists, and the vulnerability can be triggered without authentication. EPSS score is 0.03%, indicating low exploitation probability despite the easy remote attack vector.
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to perform low-impact database manipulation via the /forgot-password.php email parameter. Public exploit code is available, though no active exploitation has been reported (not listed in CISA KEV), and EPSS signals very low real-world exploitation
Hard-coded cryptographic key in express-session component of code-projects Hospital Management System 1.0 allows remote attackers to bypass session security and disclose sensitive information. The vulnerability stems from use of a fixed secret parameter in the session middleware, enabling attackers to forge or predict session tokens. While a public exploit exists, the attack requires high complexity and difficult exploitation, reflected in the low CVSS 2.9 score and minimal EPSS probability (0.19%), suggesting limited real-world risk despite information disclosure impact.
Server-Side Request Forgery (SSRF) in WP Scraper WordPress plugin versions up to 5.8.1 allows authenticated administrators to make arbitrary web requests from the affected server, enabling reconnaissance of internal services, metadata theft on cloud instances, and potential information disclosure. The vulnerability exists in the wp_scraper_extract_content function and requires high-level administrative privileges to exploit, making it a post-authentication lateral movement and reconnaissance vector for compromised administrator accounts.
SQL injection in WP Links Page plugin for WordPress (all versions up to 4.9.6) allows authenticated attackers with Subscriber-level access and above to extract sensitive database information via the unescaped 'id' parameter. The vulnerability stems from insufficient input sanitization and lack of prepared statements, enabling attackers to append arbitrary SQL queries to existing database operations. CVSS 6.5 reflects the high confidentiality impact for authenticated remote exploitation with low attack complexity; no public exploit code or active exploitation has been confirmed at analysis time.
Stored cross-site scripting (XSS) in Stock History & Reports Manager for WooCommerce plugin versions up to 2.2.2 allows authenticated contributors and above to inject arbitrary JavaScript through the 'alg_wc_stock_snapshot_restocked' shortcode attributes due to insufficient input sanitization and output escaping. When an injected page is accessed, the malicious script executes in the context of all visitors' browsers, potentially compromising site users and enabling credential theft, malware distribution, or account takeover. No public exploit code or active exploitation has been confirmed at the time of analysis.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated remote attackers to manipulate database queries with low impact. CVSS 2.1 reflects the low severity due to authentication requirement and limited scope, but a public exploit exists and EPSS percentile of 8% indicates below-average real-world exploitation likelihood despite POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects limited scope (authenticated access required, low impact to CIA triad), but publicly available exploit code exists despite minimal real-world exploitation probability (EPSS 0.03%, 8th percentile).
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/edit-equipmentform.php. The vulnerability requires valid user credentials (privilege level L) but no user interaction. Publicly available exploit code exists, though EPSS indicates very low real-world exploitation probability (0.03%, 8th percentile). Despite the public POC, the CVSS 2.1 score and minimal impact scope (VC:L/VI:L/VA:L with no scope change) suggest limited practical risk in most deployments.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ename parameter in /admin/equipment-entry.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists but real-world risk is minimal due to low EPSS score (0.03%, 8th percentile), limited scope impact, and requirement for authenticated access despite the network attack vector.
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows high-privileged remote attackers to manipulate the mobilenumber parameter in /admin-profile.php, potentially leading to unauthorized database access or modification. The vulnerability requires administrative privileges to exploit and has limited confidentiality and integrity impact; public exploit code is available but real-world exploitation risk remains low due to EPSS score of 0.03% and the administrative access prerequisite.
Unauthenticated attackers can access sensitive information through publicly exposed log files in the Code Quality Control Tool WordPress plugin versions 2.1 and earlier, due to inadequate access controls on the error_logger.php component. The vulnerability allows remote attackers to read potentially sensitive data without authentication or user interaction, presenting a confidentiality risk to WordPress installations using affected versions.
Directory traversal in the Error Log Viewer plugin for WordPress (versions up to 1.1.6) allows authenticated administrators to read arbitrary files on the server via the rrrlgvwr_get_file function. The vulnerability is rooted in insufficient path validation (CWE-22) and has a CVSS score of 4.9 due to high confidentiality impact but limited scope (administrator privilege requirement). No public exploit code or active exploitation has been identified at the time of analysis.
Path traversal vulnerability in MoneyPrinterTurbo up to version 1.2.6 allows authenticated remote attackers to manipulate file upload parameters in the music API endpoint, enabling arbitrary file write operations with limited confidentiality and integrity impact. Publicly available exploit code exists and the vulnerability has low EPSS exploitation probability (0.09%, 26th percentile), suggesting limited real-world weaponization despite proof-of-concept availability.
SQL injection in iPynch Social Network's Search component allows authenticated remote attackers to manipulate queries and access or modify database content with low complexity exploitation. The vulnerability affects the product up to commit b6933b6d7f82c84819abe458ccf0e59d61119541, and public exploit code has been released, though the EPSS score of 0.03% and CVSS base score of 2.1 suggest limited real-world exploitation probability despite the low attack complexity and public availability of proof-of-concept materials.