Authentication bypass in ProjectsAndPrograms School Management System allows unauthenticated remote attackers to access protected functions without credentials. A publicly available exploit exists, but no evidence of active exploitation has been confirmed through CISA KEV. The vulnerability has a low EPSS score (0.17%), indicating a low probability of widespread automated exploitation.
Unrestricted file upload in Oranbyte School Management System allows remote attackers to upload arbitrary files, including PHP shells, to the server via the /assets/uploadSllyabus.php endpoint. The vulnerability requires no authentication and has a publicly available exploit, but the low EPSS score (0.06%) suggests limited active exploitation. Attackers can achieve code execution if the uploaded file is accessible and executable.
We need to produce a JSON object with the specified fields. Let's analyze the provided data: CVE: CVE-2025-11659 Description: "A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. Affected by this vulnerability is an unknown functionality of the file /assets/uploadNotes.php. This manipulation of the argument File causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." CVSS Score: 5.5, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-284 (Improper Access Control) EPSS: 0.06% (percentile 19%) POC: Publicly available (exploit published) KEV? Not mentioned in input, so assume NO. Tags: PHP, Authentication Bypass, File Upload, School Management System CPE: cpe:2.3:a:oranbyte:school_management_system:1.0:*:*:*:*:*:*:* (vendor: oranbyte? Actually "ProjectsAndPrograms" might be the project name? The CPE says vendor "oranbyte", product "school_management_system", version 1.0. However, description says "ProjectsAndPrograms School Management System". Possibly the product is by ProjectsAndPrograms? The CPE suggests Oranbyte as vendor. I'll use the product name as "School Management System" and vendor as Oranbyte/ProjectsAndPrograms perhaps. For product_name field: 1-3 words ONLY. "School Management System" fits. Could also be "ProjectsAndPrograms SMS"? Best to stick with "School Management System". The description mentions "ProjectsAndPrograms School Management System", so the primary product is that system. I'll use "School Management System" as product_name, or maybe "ProjectsAndPrograms SMS"? Actually the field requires specific product; "School Management System" is generic but the name includes "ProjectsAndPrograms". I'll do "ProjectsAndPrograms School Management System" is 4 words, but I can shorten to "School Management System"? The instruction says 1-3 words. I'll use "School Management System" - it's clear and includes the product type. For prevalence: School management systems are somewhat niche but deployed in educational institutions. It might be low or medium. Given it's a specific web app, not ubiquitous. Probably "low" prevalence. Prevalence basis: "niche school management software, limited footprint". Not many large-scale deployments. Now, we need to synthesize. There is no CVSS 3.1 vector provided; only CVSS 4.0 vector. We must provide our own assessed CVSS 3.1 base vector and CVSS 4.0 base vector. The description: unrestricted file upload via /assets/uploadNotes.php, manipulation of argument File, remote exploitation possible. The provided CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. This means no authentication (PR:N), no user interaction (UI:N), low impact to confidentiality, integrity, availability. But unrestricted file upload typically can lead to remote code execution if the uploaded file can be executed, but here the vector indicates only low impacts. Possibly the file upload is to a directory that does not execute scripts, or impact might be denial/storage exhaustion? The CWE is CWE-284 (Improper Access Control) not CWE-434 (Unrestricted Upload of File with Dangerous Type) — interesting. So maybe the file upload is allowed without proper access control, but could be abused to upload arbitrary files, but execution might not be possible. The exploit has been published, so we have POC. We'll note that. Our assessed CVSS 3.1: Assuming the same as 4.0 mapping: AV:N, AC:L, PR:N, UI:N, S:U (no scope change from 4.0), C:L, I:L, A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Base score: 7.3 (High). But the given CVSS 4.0 had base score 5.5 (Medium). In 3.1, such a vector (C:L/I:L/A:L) scores 7.3. There's a discrepancy because 4.0 scores lower for same impacts. I'll assess as per my understanding of the vulnerability. Unrestricted file upload typically could lead to RCE if the file is executable, but the CVSS 4.0 only gives low impact for C/I/A, so maybe the upload destination does not allow execution, and the only impact is storage consumption or phishing? The exploit might allow uploading arbitrary files, but reading them might not provide sensitive data if they can't be accessed. It says "unrestricted upload" but not "arbitrary file upload leading to code execution". So low impacts plausible. I'll assess CVSS 3.1 as AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, but I need to justify. In CVSS 3.1, low confidentiality could be that uploaded files may be readable by attacker if they know the path (but file names might be predictable). Low integrity because attacker can upload files (overwrite maybe). Low availability because disk space can be filled. So that's plausible. So I'll set that. Now, exploitation conditions: "Remote exploitation is possible" and "unknown functionality" but the file is /assets/uploadNotes.php. No authentication mentioned. The script uploads notes, maybe intended for authenticated users but lacks access control? CWE-284 suggests improper access control, so maybe the endpoint is unprotected, allowing anyone to upload. So condition: The file upload endpoint /assets/uploadNotes.php is accessible without authentication. Possibly it's a default exposed script. I'll state: "The /assets/uploadNotes.php endpoint in ProjectsAndPrograms School Management System does not enforce authentication or authorization checks, allowing any unauthenticated user to upload arbitrary files via the 'File' argument." That's specific. The description says "unknown functionality" but the endpoint is given. So I'll use that. Attack chain: Remote attacker sends crafted HTTP POST request to /assets/uploadNotes.php with a malicious file → File is uploaded to server without validation → Attacker may access uploaded file for unauthorized actions or cause denial of service. No execution step, given low impact. So: "Access vulnerable endpoint" → "Craft malicious file payload" → "Upload file via HTTP POST" → "Gain unauthorized access to server resources or disrupt service". I'll make it a 4-step: "Access /assets/uploadNotes.php without authentication" → "Deliver crafted file via 'File' parameter" → "Exploit unrestricted upload to store file on server" → "Execute optional follow-on actions like unauthorized data access or disk exhaustion". That's realistic. Remediation: The product uses rolling release, no version numbers provided. So we can't say upgrade to a specific version. Input data says patch available? The patch field in input not explicitly given, but the description says "This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided." So maybe there is an update but unspecified. From references, the GitHub issue (#4) might contain a fix? Possibly a commit hash? The commit 6b6fae5426044f89c08d0dd101c7fa71f9042a59 is the "up to" point. There might be a later commit that fixes it, but not specified. I'll note that vendor has not published a specific patched version, but an update may be available via the rolling release. Suggest removing or restricting access to uploadNotes.php, implementing access controls, file type validation. So: "No specific patched version is available due to the product's rolling release model. Implement access controls on /assets/uploadNotes.php to require authentication, validate file types, and sanitize file names. Consider removing the endpoint if not needed. Monitor vendor updates." That's actionable. Confidence notes: Confirmed by NVD, CVE from VulDB, POC publicly available. No KEV. EPSS very low (0.06%). No vendor advisory with specific fix. The exact fix commit unknown. So I'll note: "Exploit publicly available, confirmed by NVD and VulDB. No vendor patch version specified; product uses rolling release, making versioning ambiguous. CISA KEV not listed, and EPSS indicates low exploitation probability in the wild." That's specific. Now, construct the summary: "Remote file upload in ProjectsAndPrograms School Management System through /assets/uploadNotes.php allows unauthenticated attackers to upload arbitrary files to the server, leading to potential data exposure or denial of service. Public exploit code exists, but no active exploitation reported; low EPSS score suggests limited real-world impact." Technical context: "The vulnerability resides in the PHP-based School Management System, specifically in the uploadNotes.php script that handles file uploads via the 'File' parameter. CWE-284 (Improper Access Control) indicates a missing authorization check, allowing anyone to access the endpoint without authentication. The affected product is identified by CPE cpe:2.3:a:oranbyte:school_management_system:1.0, but the rolling release model means version numbers are not consistently applied." Educational. Risk assessment: "CVSS 4.0 rates this as 5.5 Medium, with network attack vector, low impact to confidentiality, integrity, and availability. EPSS probability of exploitation is very low (0.06%), suggesting it is not targeted in the wild. No KEV listing indicates CISA does not consider it actively exploited. POC is public but exploitation requires the upload endpoint to be reachable; impact limited to file upload, not code execution, reducing real-world risk. This is a moderate-risk vulnerability that may be prioritized lower than critical RCE flaws." That compares and contrasts. Exploit scenario: "An attacker sends an HTTP POST request to /assets/uploadNotes.php with a malicious file, such as a PHP webshell, if the server configuration permits execution of uploaded scripts; otherwise, the attacker may upload large files to exhaust disk space, causing denial of service." Realistic. Exploitation conditions (specific): "The /assets/uploadNotes.php endpoint must be accessible via the web (typically at the application's base URL). No authentication is required. The attacker needs network access to the target server. The impact is limited by the server's configuration: if uploaded files cannot be executed (e.g., stored outside web root or restricted by .htaccess), confidentiality and integrity impacts are low, mainly denial of service by storage exhaustion." Prevalence: "low" because it's a niche school management system, not widely deployed. Prevalence basis: "niche educational software, limited deployment footprint". Good. Assessed CVSS 3.1 vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" and rationale: "No authentication or user interaction required; impact limited to low due to file upload without execution capability." For CVSS 4.0, I'll keep the same as provided, but with my own? The instruction says: "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So I need to map my assessed 3.1 to 4.0. My 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In CVSS 4.0 that maps to AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the provided vector, so I'll output that. Provided CVSS 4.0 has no scope change and low impacts, so consistent. So assessed_cvss40_vector = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". Rationale for 4.0: "Same as provided vector: network accessible, no privileges, low impacts on vulnerable system, no subsequent system impact." I'll use that. Now combine all. Ensure no arrays, everything string. Product name: "School Management System" (capitalized). CPE says oranbyte:
Unrestricted file upload in OranByte School Management System allows remote attackers to upload arbitrary files via the /assets/changeSllyabus.php endpoint without authentication. Successful exploitation can lead to code execution and full server compromise. Exploit code is publicly available, though no active exploitation is confirmed.
Unrestricted file upload in Oranbyte School Management System allows remote unauthenticated attackers to upload arbitrary files via /assets/createNotice.php, potentially leading to remote code execution. Public exploit code exists; no patch version identified as the product uses a rolling release model, and exploitation probability (EPSS 0.06%) is low despite public exploit availability.
Unrestricted file upload in ProjectsAndPrograms School Management System allows remote attackers to upload arbitrary files via the /assets/editNotes.php endpoint. An attacker can send a specially crafted request to execute malicious code on the server. A publicly available proof-of-concept exists, but no active exploitation has been confirmed.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate the serv_id parameter in /booking.php, potentially gaining unauthorized access to the database or modifying data. A public exploit is available, though EPSS assigns a low exploitation probability (0.03%). No active exploitation is reported.
Use-after-free in the Linux kernel xfrm subsystem allows a local low-privileged user to crash the kernel via improper SPI=0 handling introduced by commit 94f39804d891. The regression causes xfrm_alloc_spi to insert states with SPI value 0 (the sentinel for 'no SPI assigned') into the byspi hash table, while __xfrm_state_delete skips cleanup of those entries on deletion, leaving dangling pointers that produce a UAF on next byspi traversal. No public exploit code exists and EPSS probability is 0.17% (7th percentile), indicating no active exploitation pressure.
We need to output a JSON with all fields. Let's analyze the input. CVE ID: CVE-2025-11654 Description: A vulnerability identified in yousaf530 Inferno Online Clothing Store up to commit 827dd42bfbe380e8de76fdc67958c24cf1246208. Affected element: unknown function of /log.php. Manipulation of cemail/password leads to SQL injection. Attack remotely. Exploit publicly available. This product uses rolling releases (no version numbers). Vendor contacted, no response. CVSS Score: 5.5 (but that's likely a severity score, not CVSS base, because vector is CVSS 4.0 with base score? Actually CVSS 4.0 vector is provided: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... The base score from that vector: CVSS 4.0 base calculator: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L -> base score 5.1? Let's compute: The formula for CVSS 4.0 base with all low impacts (L) is: 5.1? Actually check: Base score from CVSS 4.0 spec: AV:N/AC:L/AT:N/PR:N/UI:N -> Exploitability: none of these modify? Actually full formula: Base Score = (Impact + Exploitability) ... I'll compute: Impact Subscore (ISC): VI*VC factor. For VC:L (0.2), VI:L (0.2), VA:L (0.2). Since no scope change, SC/SI/SA=N, so only vulnerability system impacts. With all low, ISC = 1 - [(1 - 0.2) * (1 - 0.2) * (1 - 0.2)] = 1 - (0.8*0.8*0.8)=1-0.512=0.488. Exploitability subscore: 8.4 * AV:N(0.85)*AC:L(0.77)*AT:N(1)*PR:N(0.85)*UI:N(0.85) = 8.4 * (0.85*0.77*0.85*0.85) = 8.4 * (0.85*0.77=0.6545, times 0.85=0.556325, times 0.85=0.47287625) = 8.4 * 0.47287625 = 3.9721605. Since ISC <= 0? No, ISC=0.488>0, Base = Roundup(Min( (Impact+Exploitability), 10))? That's not the formula. The base score is: If ISC <=0, base=0. Else, base = Min( (Impact + Exploitability), 10)?? Actually the spec: Base Score = Min[Roundup( (Impact + Exploitability), 1), 10]? Not exactly, but a lookup table? I recall for 4.0, base score is computed by 0.2 * (Impact + Exploitability) then looking up? Hmm. Let's check online CVSS 4.0 calculator: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N gives base score 5.1, severity medium. So 5.5 is close (maybe rounding). So the provided CVSS vector yields 5.1, but CVSS Score listed is 5.5? That might be a mistake or a different metric. We'll use the provided vector and compute independently. Our assessed_cvss_vector should be our own. But the given vector already is CVSS 4.0, not 3.1. We need to assess CVSS 3.1 vector as well. For 3.1: SQL injection, remote, low complexity, no auth? Description says remote attack, no mention of auth, so PR:N, UI:N? The vector would be AV:N/AC:L/PR:N/UI:N/S:U? Impact: SQL injection can lead to confidentiality (read data), integrity (modify data), availability (maybe denial but not typical). Given typical SQL injection, we can assume C:H/I:H/A:H? But CVSS 4.0 rated VC:L/VI:L/VA:L, so maybe limited impact? The description doesn't specify impact, so we should be conservative. Let's assess: from the 4.0 vector, they considered low impact on all three. Is that reasonable? The vulnerability is in login page /log.php with parameters cemail and password, SQL injection. Successful SQL injection could lead to authentication bypass or data extraction. The product is an online clothing store, likely has user data. So impact could be high: read all customer data, modify orders, etc. So we should rate as high. However, the description lacks detail. I'll assess as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, that's CVSS 3.1 base score 9.8 critical. But if they gave 5.5, that suggests maybe the vulnerability is only a blind SQL injection with limited impact? The CVSS 4.0 gave all low, so maybe the report indicates limited impact. We'll need to rationalize. We are to produce our own independent assessed_cvss_vector and rationale. Since the description says SQL injection without authentication, and SQL injection typically allows full database access, I'd lean towards high impact, but if the vendor didn't fix, we don't have full details. The exploit is publicly available. I'll assess as critical. However, the exploitation conditions: no auth, remote. So I'll set AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That's a plausible assessment. But we need to justify: "SQL injection in login endpoint allows unauthenticated remote attacker to extract, modify, or delete database contents; no user interaction required." This would be CVSS 3.1: 9.8. I'll go with that. The assessed_cvss40_vector: I'll map to CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That yields base score around 9.3? Actually with all high: VC:H(0.56), VI:H(0.56), VA:H(0.56) ISC = 1 - (1-0.56)^3 = 1 - 0.44^3? 0.44^3=0.085184, so ISC=0.914816. Exploitability same 3.972. Sum = 4.886816? No wait, 0.2*(Impact+Exploitability) maybe? The CVSS 4.0 base score is computed as: if ISC<=0, 0; else base = Min(0.2*(Impact+Exploitability), 10). So 0.2*(0.914816+3.972)=0.2*4.886816=0.9773632, then lookup table? Actually not; I think the formula is: Base = if ISC <=0, 0; else look up in a table based on the integer sum? The spec: Base Score = the value found in the table on page 20 of the CVSS v4.0 specification based on the values of AV/AC/AT/PR/UI to determine the Exploitability value and VC/VI/VA/SC/SI/SA to determine the Impact value. Actually it's a lookup table. For our configuration (AV:N,AC:L,AT:N,PR:N,UI:N,VC:H,VI:H,VA:H,SC:N,SI:N,SA:N) the lookup yields 9.2 or 9.3? I recall from the standard table, with all high impacts and no scope change, base score is 9.2? Let's compute via known online calculators. For AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, base score is 9.3 for medium? Actually 9.3 is critical. So I'll put "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N". The given vector had low impacts, but that might be because the reporter only demonstrated limited impact. We'll go with high, but we can justify. I'll produce that. Other fields: product_name: "Inferno Online Clothing Store" (1-3 words, specific product). summary: synthesize, not copy. Start with impact: "SQL injection in yousaf530 Inferno Online Clothing Store /log.php allows..." Mention actively exploited? No KEV. POC exists ("exploit is publicly available"). So: "Publicly available exploit code exists." EPSS 0.03% low. So summary: "SQL injection in yousaf530 Inferno Online Clothing Store's login endpoint (/log.php) allows unauthenticated remote attackers to inject arbitrary SQL via the cemail or password parameters. Successful exploitation could lead to unauthorized database access, data exfiltration, or authentication bypass. A public proof-of-concept exploit is available, although EPSS indicates low probability of widespread exploitation at this time." technical_context: Underlying technology PHP, SQL injection. Use CWE-74 (Injection) or more specific CWE-89? Provided CWE-74 is a broader classification. Mention PHP and SQL injection. CPE data not provided, but we can infer from product name. So "The vulnerability is a SQL injection (CWE-74, more specifically CWE-89 injection) in the PHP-based Inferno Online Clothing Store's /log.php file. The affected product is a rolling-release e-commerce platform, making precise version identification difficult. The flaw stems from improper sanitization of user-supplied cemail and password parameters before incorporating them into SQL queries." risk_assessment: CVSS vector from reporter is 4.0 with low impact, but based on typical SQL injection potential, we assess higher impact. Compare signals: EPSS 0.03% (low), no KEV, POC available, remote unauthenticated attack. SSVC decision: exploitation status: POC available but not exploited in wild; automatable: yes (SQL injection can be automated); technical impact: high (full database). So priority? "While the provided CVSS 4.0 vector suggests low confidentiality, integrity, and availability impacts, the nature of unauthenticated SQL injection in a login endpoint typically allows full database compromise, leading to high confidentiality and integrity impact. The EPSS score of 0.03% indicates very low probability of exploitation activity, but the existence of a public exploit lowers barriers for opportunistic attacks. In the absence of vendor confirmation, assess as high risk for any organization using this product. Note that CVSS vector in the report conflicts with typical SQL injection impact; confirm impact through independent testing." affected_products: "The affected product is yousaf530 Inferno Online Clothing Store, using the rolling release model up to commit 827dd42bfbe380e8de76fdc67958c24cf1246208. Version information is unavailable due to continuous delivery. No CPE located. The vulnerability is present in the /log.php file." remediation: "No vendor patch is available; the vendor did not respond to disclosure. Since rolling release and no fixed version, users should apply mitigations immediately: (1) Implement input validation and parameterized queries in /log.php to neutralize SQL injection; (2) Deploy a Web Application Firewall (WAF) rule to block malicious SQL injection patterns targeting the cemail and password parameters; (3) Restrict access to /log.php if feasible (though likely the login page must remain public). Note that these are compensating controls and may not fully eliminate risk without code fix. Urgently consider migrating to a supported platform." exploit_scenario: "An attacker sends a crafted HTTP POST request to /log.php with malicious SQL payloads in the cemail or password fields, bypassing authentication or extracting database contents. With publicly available exploit code, even low-skill attackers can automate attacks against vulnerable instances." exploitation_conditions: "No authentication required; remote attackers can send requests directly to the /log.php endpoint. The default installation appears to be vulnerable without special configuration changes. The attack does not require user interaction, making it exploitable via automated scanners. However, the product's limited deployment footprint (see prevalence) reduces the likelihood of widespread opportunistic attacks." attack_chain: "Craft SQL injection payload → Send HTTP request to /log.php → Inject malicious SQL → Extract/modify database" confidence_notes: "Public exploit confirmed via VulDB and GitHub report. Vendor did not respond to