A vulnerability was detected in Verysync 微力同步 2.21.3. This affects an unknown function of the file /safebrowsing/clientreport/download?key=dummytoken of the component Web Administration Module. Performing manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
SQL injection in Chanjet TPlus through version 20251121 allows remote unauthenticated attackers to manipulate the currentAccId parameter in the MultiCompanySettingController ASHX handler, leading to limited data tampering, information disclosure, and service disruption. Public exploit code is available; however, no active exploitation has been confirmed (not listed in CISA KEV), and EPSS indicates low probability of widespread attacks.
SQL injection in Chanjet CRM up to version 20251121 allows remote attackers to manipulate database queries via the gblOrgID parameter in /tools/jxf_dump_table_demo.php. Public exploit code is available, enabling practical attacks despite a low EPSS exploitation probability of 0.04%. The vendor has not responded to disclosure, leaving no official patch.
We are to generate a comprehensive analysis based on the provided data, following the strict JSON output format. Let's break down the input: - CVE: CVE-2025-14192 - Description: Vulnerability in RashminDungrani online-banking up to commit hash 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. File /site/dist/auth_login.php, Username argument leads to SQL injection. Remote attack. Exploit public. Rolling releases, no version details. Vendor did not respond. - CVSS Score: 5.5 (this is likely a CVSS v4.0 base score given the vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (this is a CVSS 4.0 vector, with E:P indicating exploit code maturity is proof-of-concept, and other supplemental metrics as X not defined) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.04% (13th percentile) - very low. - KEV: not mentioned, so not in CISA KEV. - Patch availability: The description says "Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available." Also vendor did not respond. So no clear patch version. However, the vulnerability might be fixed in some later commit? Since rolling releases, the commit hash might be the known affected one, but later commits may have fixed it silently? In remediation, we must note that no official patch version is available, but the GitHub repo might have updates. - Tags: SQLi, PHP - CPE strings: not explicitly given, but affected versions from EUVD: online-banking 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This suggests the product is a specific GitHub repository. So we can derive product name: "online-banking" by RashminDungrani. - References: a GitHub file showing exploit? The first link is a docx file "online-banking-have-sql.docx" which likely conta
A security vulnerability has been detected in Verysync 微力同步 up to 2.21.3. The impacted element is an unknown function of the file /rest/f/api/resources/f96956469e7be39d of the component Web Administration Module. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.