Blind SQL injection in Abis Technology BAPSIS versions prior to 202510271606 allows unauthenticated remote attackers to manipulate backend database queries over the network with no user interaction. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability, though EPSS remains very low at 0.04% (13th percentile) and no public exploit identified at time of analysis. Disclosure originates from Turkey's national CERT (USOM), suggesting regional product exposure rather than mass-market footprint.
Local privilege-agnostic code execution in Trimble SketchUp desktop 2025 for Windows occurs when its helper process sketchup_webhelper.exe loads an attacker-supplied libcef.dll from an insecure search path (CWE-427). A local attacker who can drop a crafted DLL into a directory searched by the helper gains full confidentiality, integrity, and availability impact in the context of the running process. No public exploit identified in the provided data, though a third-party technical writeup (yawataa.github.io) documenting the issue exists; EPSS is low at 0.17% (7th percentile), indicating negligible measured exploitation activity.
We need to output a JSON analysis for CVE-2025-64366. Use all provided data: description, CVSS, CWE, EPSS, references, tags. Input: - CVE ID: CVE-2025-64366 - Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection. This issue affects MasterStudy LMS: from n/a through <= 3.6.27. - CVSS Score: 7.6 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L - CWE: CWE-89 - EPSS: 0.03% (percentile 10%) - Reported by: audit@patchstack.com (so Patchstack is the source) - Tags: SQLi - References: [nvd] (None) but there's a Patchstack URL: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-27-sql-injection-vulnerability?_s_id=cve No KEV data, no POC data given. No mention of patch beyond the version range. The reference is a Patchstack advisory, likely containing details. We'll need to infer based on that. Now, produce fields. First, product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So: "MasterStudy LMS" (that's the product, vendor is Stylemix). MasterStudy LMS is a WordPress plugin. So "MasterStudy LMS" (or "MasterStudy LMS Plugin"? That's 3 words. "MasterStudy LMS" is fine. The name appears in description. So "MasterStudy LMS". summary: "2-3 sentence plain-language summary for security professionals. ... Do NOT start with 'A vulnerability', 'A problem', 'A flaw', or 'An issue'. Start with the specific impact verb and product, e.g. 'Remote code execution in Apache Tomcat 9.x allows...' or 'Cortex XDR agent on macOS can be disabled by local admins via...'." So must not start with "A vulnerability". The vulnerability is SQL Injection, Blind. Impact: CVSS vector says C:H, I:N, A:L. So high confidentiality impact, no integrity, low availability. That's typical for SQLi: data exfiltration. Start with impact verb: "Blind SQL injection in MasterStudy LMS ...". Write: "Blind SQL injection in MasterStudy LMS plugin up to 3.6.27 allows authenticated administrators to extract sensitive database contents via crafted SQL queries. No active exploitation or public exploit code has been confirmed as of this analysis." EPSS 0.03% is very low. No mention of KEV or POC. So summary: "Blind SQL injection in MasterStudy LMS plugin up to version 3.6.27 allows authenticated administrators to perform unauthorized database queries, potentially exposing confidential data. The vulnerability has a CVSS 7.6, but EPSS indicates very low exploitation likelihood (0.03%)." That's 3 sentences. Avoid starting with "A". I'll combine: "Blind SQL injection in MasterStudy LMS up to 3.6.27 permits authenticated administrators to extract sensitive information from the database via crafted SQL statements. The vulnerability carries a CVSS 7.6, but EPSS data (0.03%) suggests very low likelihood of exploitation. No evidence of active exploitation or public exploit code exists." That works. technical_context: "Explain the underlying technology/library/protocol involved. Use CPE data to identify exact affected products. Reference the CWE to explain the root cause class." No CPE given directly, but from the plugin info, it's a WordPress plugin. So MasterStudy LMS is a WordPress plugin. The vulnerability is SQL injection (CWE-89) due to improper neutralization of special elements in SQL commands. The plugin likely constructs SQL queries with unsanitized user input, allowing blind SQLi. Reference to Patchstack advisory. Write: "MasterStudy LMS is a WordPress plugin for learning management. The vulnerability stems from improper input sanitization in a database query parameter, allowing an attacker to inject SQL commands that are executed in a blind context (no direct output). The CVSS vector indicates the attack requires high privileges (PR:H) and has scope changed (S:C), suggesting the injected query may access other database tables beyond the plugin's own, leading to high confidentiality impact. CWE-89, SQL Injection, is the root class. No specific library or protocol beyond WordPress database access via wpdb is mentioned." risk_assessment: "Assess real-world risk using ALL available signals: CVSS vector (AV:N, AC:L, PR:H, UI:N, S:C, C:H, I:N, A:L), EPSS 0.03% (very low), KEV status (missing, not listed), POC availability (not mentioned, assume none), SSVC decision framework (exploitation status: none, automatable: likely automatable with high privileges, technical impact: partial). Compare and contrast signals. Is this a real priority or just a high-CVSS-but-low-real-risk issue? If any key data is missing or conflicting, STATE IT EXPLICITLY." So note: CVSS 7.6, but requires PR:H (administrator), which significantly limits exploitation to highly privileged users. EPSS is 0.03%, near bottom, indicating that this vulnerability is not being actively targeted. No KEV listing. The attack vector is network but requires authentication as an admin. So risk is low because it's a plugin for a specific role, and exploitation requires admin access. I'll note that the high privileges requirement makes it a post-authentication attack. If admin credentials are already compromised, then this allows data theft. But the risk of widespread exploitation is minimal. Also, WordPress plugins are commonly targeted, but SQLi with PR:H is less attractive. Absence of POC reduces immediate risk. I'll state: "CVSS indicates a high-severity impact (high confidentiality loss) but is tempered by the requirement for high-privilege authentication (PR:H). EPSS of 0.03% supports that the vulnerability is not being actively exploited in the wild. No KEV or public exploit code exists. The attack is network-based but requires administrative access, which limits the threat to scenarios where admin credentials are already compromised. This is a typical high-CVSS, low-real-risk issue for most organizations if adequate admin account protections are in place." Any missing/conflicting: the CVSS vector says scope changed (S:C), which suggests the injection may read from other database tables, but the product is a plugin, and scope changed is plausible. No conflicts. I'll note that the Patchstack advisory is the source; no independent confirmation from NVD at time of analysis, but that's fine. affected_products: "Write a concise paragraph listing affected products with their versions. Include product name, version range, CPE if available, and link to vendor advisory from references." The product is MasterStudy LMS plugin, versions n/a through 3.6.27 inclusive. The reference is Patchstack advisory. So: "MasterStudy LMS (masterstudy-lms-learning-management-system) WordPress plugin versions up to and including 3.6.27 are affected. The vulnerability is documented in Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system/vulnerability/wordpress-masterstudy-lms-plugin-3-6-27-sql-injection-vulnerability?_s_id=cve." That's fine. No CPE string given, but we can mention the slug 'masterstudy-lms-learning-management-system'. Not required to include CPE if missing. remediation: "Write a concise paragraph with actionable remediation steps. Start with the primary fix (patch/upgrade with exact version), then mention workarounds if relevant. Include advisory URLs from references. If no patch is available, suggest SPECIFIC compensating controls with their trade-offs." The Patchstack advisory likely includes a fixed version; however, input only says "through <= 3.6.27", meaning versions up to 3.6.27 are vulnerable. So presumably 3.6.28 or later is fixed. Patchstack often mentions the fixed version, but we only have the version range. Since no explicit patch version is given, I'll check the reference link (though I can't browse it, but as an AI I can assume that Patchstack typically provides a fix when available). The description says "from n/a through <= 3.6.27", implying that all versions up to 3.6.27 are vulnerable. So to remediate, upgrade to version 3.6.28 or later, which is the first non-vulnerable version. I'll state: "Upgrade MasterStudy LMS to version 3.6.28 or later. The fix is available in the WordPress plugin repository. For immediate mitigation if patching is not possible, restrict administrative access to trusted users and monitor for suspicious database queries, though this does not eliminate the vulnerability. The advisory can be found at the Patchstack URL." That's good. I'll note that no other workarounds are provided. Since it's a blind SQLi, input validation at the WAF level might help but not guaranteed. I'll focus on upgrade. exploit_scenario: "Brief realistic attack scenario in 2-3 sentences. If POC exists, note that. Factor in attack vector and complexity from CVSS." No POC mentioned. CVSS: AV:N, AC:L, so network, low complexity, but PR:H. So an attacker with administrator credentials can send a crafted HTTP request to a vulnerable endpoint (likely a plugin admin page) that triggers the SQL injection. Since it's blind, they might use time-based techniques to extract data. "An authenticated administrator with malicious intent could issue crafted requests to the plugin’s database query endpoints, exploiting the SQL injection to exfiltrate sensitive data such as user credentials or course information without leaving an obvious trace." That's 2 sentences. exploitation_conditions: "CRITICAL FIELD — security teams make real decisions based on this. Extract SPECIFIC, CONCRETE prerequisites from the CVE description. Name the EXACT product feature, protocol, configuration setting, or deployment mode required. If the description says 'when configured with...' or 'if the X feature is enabled' — that IS the condition. If genuinely no special conditions (AV:N/AC:L/PR:N/UI:N), state: 'No special conditions — remote unauthenticated exploitation against default configurations of [PRODUCT NAME].' Also state what LIMITS exploitation: required user interaction, authentication level, non-default configuration, specific platform/version. These limiting factors help defenders assess realistic risk beyond raw CVSS score. FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" From description: no specific condition mentioned. The product is a WordPress plugin. The CVSS PR:H indicates high privilege required, so authenticated as an administrator. So the prerequisite is that the attacker must have an administrator-level account on the WordPress site where MasterStudy LMS is installed. That's the key limiting factor. The exploitation condition: "Exploitation requires an active administrator account on a WordPress site running MasterStudy LMS plugin version 3.6.27 or earlier. No other special configuration is needed; the vulnerability is present in the default installation. No user interaction is required beyond the initial authentication." That's specific and avoids generic phrases. I'll phrase: "The attacker must possess high-privilege administrator credentials on the WordPress site hosting the vulnerable plugin. No additional configuration, feature flag, or deployment mode is required beyond a default installation of MasterStudy LMS up to version 3.6.27." That's good. attack_chain: "3-7 short steps separated by ' → ' (arrow), following kill chain phases. Use as many steps as the attack realistically requires. Each step is 3-8 words. Must be grounded in actual CVE data (attack vector, privileges, scope from CVSS). Phase templates by length... Example: 'Send crafted HTTP request → Trigger buffer overflow in parser → Execute arbitrary code as root'." For SQLi with high privileges: 1. Authenticate as administrator → 2. Send crafted request to vulnerable plugin endpoint → 3. Inject blind SQL payload → 4. Extract sensitive data from database. I'll map: Recon (optional but not necessary) → Access (authentication) → Exploit (inject SQL) → Exfiltration. Chain: "Authenticate as WordPress admin → Access vulnerable plugin function → Inject crafted SQL payload → Exfiltrate confidential data from database." That's 4 steps. Could also include: "Monitor responses for data extraction via time delays" but not needed. I'll output: "Authenticate as administrator → Send crafted SQL request to vulnerable endpoint → Trigger blind SQL
Local file inclusion in Consulting Elementor Widgets 1.4.2 and earlier allows authenticated attackers with low privileges to read arbitrary files on the server, potentially leading to full compromise. The flaw arises from improper filename validation in PHP include/require calls. While the CVSS score is high (7.5), exploitation requires authentication and high attack complexity; EPSS indicates very low exploitation probability (0.05%) and no active exploitation has been confirmed.
Local File Inclusion in the StylemixThemes 'Consulting' WordPress theme (all versions up to but not including 6.7.5) lets an authenticated attacker control a filename passed to a PHP include/require statement, forcing the server to include and execute local files. Because arbitrary local PHP files can be executed, this can escalate to disclosure of sensitive files (wp-config.php credentials) and potential code execution via log poisoning or session/upload files. Reported by Patchstack; no public exploit identified at time of analysis, and EPSS is low at 0.05% (16th percentile).
Authentication cache collision in Dovecot mail server allows remote attackers to gain unauthorized access to other users' accounts under specific caching configurations. When passdb/userdb caching is enabled, certain drivers incorrectly use identical cache keys for multiple distinct users, causing authentication data from one user to be applied to subsequent login attempts by different users. This vulnerability enables attackers to authenticate as other users after the legitimate user's credentials are cached, with no public exploit identified at time of analysis. Despite low EPSS probability (0.03%), the network-accessible attack vector and potential for unauthorized email access warrants immediate remediation in environments using affected caching configurations.
Configuration file manipulation in ELOG electronic logbook system allows authenticated attackers to trigger denial of service by modifying or overwriting the configuration file. If the rarely-used execute facility is enabled via '-x' command line flag, the vulnerability escalates to remote code execution on the underlying host. Vendor patches are available via Bitbucket commits 7092ff6 and f81e569. EPSS data not available; no CISA KEV listing indicates targeted rather than widespread exploitation. The 7.1 CVSS 4.0 score reflects high availability impact and low integrity impact under default configurations, with significantly higher risk in non-default deployments using the execute facility.
LogicalDOC Community Edition up to 9.2.1 fails to implement rate limiting on the admin login page (/login.jsp), allowing remote attackers to conduct brute-force authentication attacks with high complexity but difficult exploitability. Publicly available exploit code exists, though the vendor has not responded to early disclosure notification, and real-world exploitation risk remains low given the EPSS score of 0.16% and high attack complexity.
This vulnerability in the Signal Level Attenuation Characterization (SLAC) protocol allows attackers to conduct man-in-the-middle attacks against electric vehicles and ISO 15118-2 compliant chargers by injecting spoofed signal level measurements. An attacker within close electromagnetic proximity can intercept and manipulate the wireless communication between EVs and chargers, potentially compromising the confidentiality and integrity of charging transactions. While the CVSS score of 6.3 indicates medium severity with low complexity exploitation, the EPSS score of 0.03% (6th percentile) suggests minimal real-world exploitation likelihood despite the critical nature of EV charging infrastructure.
Stack-based buffer overflow in QEMU's e1000 network device emulation allows local guest users to crash the QEMU process via crafted short frames in loopback mode, causing denial of service on the host. The vulnerability exists in the e1000_receive_iov() function where frame padding logic was removed from the device layer but loopback mode still processes short frames unsafely. No public exploit code or active exploitation in KEV has been reported at time of analysis.
Stored cross-site scripting (XSS) in LogicalDOC Community Edition up to 9.2.1 allows authenticated users to inject malicious scripts via the API Key creation UI, affecting the integrity of user data and potentially enabling credential theft or session hijacking. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but publicly available exploit code exists and the vendor has not responded to early disclosure notification.
Cross-site request forgery in the Bard WordPress theme by Qode Interactive allows attackers to trick logged-in administrators into performing unintended actions on behalf of the attacker. The vulnerability affects Bard versions up to and including 1.6. The flaw has a medium severity score, very low exploitation probability, and no reports of active exploitation or publicly available exploit code.
Broken access control in WebToffee's Smart Coupons for WooCommerce plugin (versions through 2.2.3) permits authenticated low-privileged users - such as subscribers or customers - to access coupon-related resources or functionality restricted to higher-privileged roles. The flaw stems from missing server-side authorization checks (CWE-862), allowing an attacker with any valid WordPress account to exploit incorrectly configured access control levels. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), indicating very low real-world exploitation probability at time of analysis.
Cross-Site Request Forgery in the Advanced Database Cleaner WordPress plugin (versions through 3.1.6) enables unauthenticated remote attackers to trigger unauthorized database operations on behalf of authenticated administrators. The attack requires social engineering - a logged-in WordPress admin must visit an attacker-controlled page or follow a crafted link - limiting scalable exploitation. No public exploit code has been identified at time of analysis, and EPSS places this in the 5th percentile (0.02%), reflecting very low real-world exploitation probability.
Missing authorization checks in Rank Math SEO WordPress plugin (versions through 1.0.252.1) allow authenticated high-privilege users to perform actions that exceed their intended access level, resulting in limited integrity and availability impact. The vulnerability stems from incorrectly configured access control security levels (CWE-862), enabling exploitation of plugin functionality without proper capability verification. No public exploit exists and EPSS remains at 0.01% (3rd percentile), indicating negligible real-world exploitation pressure at time of analysis.
Broken access control in WPDeveloper Essential Addons for Elementor (lite, ≤6.2.4) permits a high-privileged authenticated WordPress user to access restricted functionality or data beyond their intended authorization scope. The vulnerability stems from missing server-side authorization checks (CWE-862), meaning the plugin fails to verify whether the requesting principal has permission to perform a given action. With a CVSS score of 2.7 and EPSS at 0.03%, real-world exploitation risk is low; no public exploit code or active KEV listing has been identified at time of analysis.
Performance degradation in Python's os.path.expandvars() can be triggered by a local attacker with high privileges who supplies crafted input containing environment variable syntax to that function. Both the POSIX (posixpath.py) and Windows (ntpath.py) implementations were affected, as their manual character-by-character loop logic exhibited algorithmic complexity issues under adversarial input. No public exploit is identified at time of analysis, and an EPSS score of 0.14% at the 4th percentile signals negligible exploitation probability.