Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files through the photo parameter of /addproduct.php, potentially enabling web shell deployment and full server compromise. The affected product is tracked under CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0, and exploit code is publicly available via GitHub. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.06% (17th percentile), though the presence of a public proof-of-concept combined with an authentication bypass tag elevates realistic risk above what the low EPSS would suggest.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_football.php` endpoint to database manipulation via the unsanitized `pid` parameter, achievable by remote unauthenticated attackers per the CVSS 4.0 PR:N rating. The flaw enables limited read, write, and availability impact against the backend database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains extremely low at 0.03% (8th percentile), consistent with this product's negligible real-world deployment footprint and no CISA KEV listing.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the `/admin/admin_product.php` endpoint to remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (GitHub CVE issue #16), though the EPSS score of 0.01% at the 1st percentile signals negligible observed exploitation probability - consistent with a niche, low-footprint hobbyist application. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin panel endpoint /admin/admin_feature.php to database manipulation via the unsanitized `pid` parameter. The provided CVSS 4.0 vector asserts PR:N (no privileges required), though the /admin/ path suggests authentication may be in play - this discrepancy is noted and should be verified against the actual application. A publicly available proof-of-concept exploit exists on GitHub, though the EPSS score of 0.01% (1st percentile) indicates real-world exploitation attempts remain negligible, consistent with the product's obscure deployment footprint. No vendor-released patch has been identified at time of analysis.
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter in /admin/admin_index.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and minimal skill, and a public proof-of-concept exists on GitHub. Despite this, real-world risk is curtailed by the product's extremely niche deployment footprint, an EPSS of just 0.01% (1st percentile), and absence from CISA KEV - making mass exploitation implausible.
Kernel denial-of-service in the Linux mm/ksm subsystem allows a local low-privileged user to crash or destabilize the kernel by triggering a type-promotion bug in ksm_madvise(). When MADV_UNMERGEABLE is applied to a VMA registered with userfaultfd (UFFD) in MINOR mode, the function incorrectly clears the upper 32 bits of vma->vm_flags due to a C integer promotion defect, producing a UFFD inconsistency that causes a kernel BUG or WARNING at mm/userfaultfd.c:2067 during fd cleanup. No public exploit has been identified and EPSS is 0.33% (26th percentile), but the crash was confirmed via syzkaller fuzzing and patches have been backported across multiple stable kernel branches.
Remote unauthenticated SQL injection in Ghost Hot Spot's login form allows direct database manipulation and potential authentication bypass for versions up to 20251014, confirmed by published POC code. The extremely low EPSS score (0.03%, 7th percentile) contradicts technical exploitability metrics, suggesting limited real-world threat from this niche product. Vendor non-response precludes a timely security patch.
Incorrect privilege assignment in the TrustyAI component of Red Hat OpenShift AI exposes pod, PersistentVolumeClaim, and LMEvalJob metadata cluster-wide to every authenticated user or service account. The TrustyAI operator automatically provisions a ClusterRoleBinding that binds the role `trustyai-service-operator-lmeval-user-role` to `system:authenticated`, the built-in Kubernetes group encompassing all authenticated identities - meaning any user or workload with valid cluster credentials inherits get/list/watch permissions on pods in every namespace. No special conditions are required beyond holding any valid credential on the cluster. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% reflects low opportunistic exploitation probability, though the misconfiguration is trivially leveraged by any cluster tenant.
Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.