In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Uninitialized memory read in the Linux kernel Bluetooth HCI event layer allows a malicious or malfunctioning Bluetooth controller to leak a byte of kernel memory and induce undefined command-completion handling. The flaw lives in hci_cmd_complete_evt(), where an unknown Command Complete opcode causes the code to read skb->data[0] as a return status even after all parameter bytes were already pulled, leaving the buffer empty. It is a fixed upstream kernel bug (CWE-908-class use of uninitialized resource) with no public exploit identified at time of analysis and a very low EPSS score of 0.04%.
Improper Input Validation vulnerability in Infinera MTC-9 allows remote unauthenticated users to crash the service and cause a reboot of the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Denial of service in the Linux kernel NFS server (nfsd) allows a crash in nfsd4_read_release() to be triggered while the trace_nfsd_read_done tracepoint is active, as surfaced by the pynfs read.testNoFh conformance test. The flaw affects NFSv4 READ compound processing and results in a kernel crash (availability impact only, no data disclosure or code execution). It has been resolved upstream and shipped across multiple stable series; no public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.05%).
A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).
Denial of service in the Linux kernel's NFSD (in-kernel NFSv4 server) allows remote clients to crash the server by sending a GETATTR request that queries the newly-defined time_deleg FATTR4 delegation attributes, for which NFSD previously had no defined handler. The fix makes NFSD return nfserr_inval for such spec-invalid queries (RFC 9754 Section 5) instead of crashing. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, so this is a defensive robustness fix rather than an actively exploited issue.
In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2025-48621 is a security vulnerability (CVSS 7.3) that allows a tapjacking attack due. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the web_action.do endpoint.
CVE-2025-14261 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.
Out-of-bounds read in the Linux kernel's framebuffer console (fbdev) bitblit code affects the built-in font rendering path, where bit_putcs_aligned() and bit_putcs_unaligned() masked the character value with 0xff/0x1ff and used it as a glyph index without validating it against the actual font's glyph count. A local low-privileged attacker able to drive framebuffer console output can trigger a global out-of-bounds read past the built-in font array, leaking adjacent kernel memory or crashing the system. Discovered by syzbot; no public exploit identified at time of analysis, and with an EPSS of 0.04% real-world exploitation is unlikely to be widespread.
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.
Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Some endpoints in vulnerability-lookup that modified application state (e.g. changing database entries, user data, configurations, or other privileged actions) may have been accessible via HTTP GET requests without requiring a CSRF token. This flaw leaves the application vulnerable to Cross-Site Request Forgery (CSRF) attacks: an attacker who tricks a logged-in user into visiting a malicious website could cause the user’s browser to issue GET requests that perform unintended state-changing operations in the context of their authenticated session. Because the server would treat these GET requests as valid (since no CSRF protection or POST method enforcement was in place), the attacker could exploit this to escalate privileges, change settings, or carry out other unauthorized actions without needing the user’s explicit consent or awareness. The fix ensures that all state-changing endpoints now require HTTP POST requests and include a valid CSRF token. This enforces that state changes cannot be triggered by arbitrary cross-site GET requests. This issue affects Vulnerability-Lookup: before 2.18.0.
In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
A remote code execution vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures.
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-48598 is a security vulnerability (CVSS 6.6). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.
Command injection in D-Link DIR-823X firmware allows remote authenticated attackers to execute arbitrary OS commands via the ppp_username parameter in the set_wan_settings endpoint. A proof-of-concept exploit is publicly available, but no active exploitation is confirmed. The vulnerability impacts firmware versions up to 202504
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Path traversal in the file upload handler of Yottamaster DM2, DM3, and DM200 NAS firmware (up to 1.2.23/1.9.12) allows remote authenticated attackers with low privileges to write arbitrary files to unintended directories. Exploit code is publicly available, though EPSS (0.24%) indicates low probability of widespread exploitation, and no active exploitation has been reported.
Remote command injection in D-Link DCS-930L firmware version 1.15.04 allows authenticated attackers to execute arbitrary system commands via the AdminID parameter of the /setSystemAdmin endpoint. Exploit code is publicly available, but the device is end-of-life and unsupported, so no official patch is expected. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in itsourcecode Student Information System 1.0 allows authenticated attackers to manipulate database queries via the ID parameter in the /section_edit1.php script. Proof-of-concept exploit code is publicly available, but exploitation requires low-privilege authentication and EPSS indicates very low likelihood of widespread exploitation.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate the item_name parameter in /Admin/additems.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed, and a low EPSS score (0.04%) indicates minimal immediate risk.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate database queries via the user_id parameter in /Customers/settings.php. While the CVSS 4.0 base score is only 2.1 (Low), public exploit code is available, enabling authenticated attackers to read or modify database contents. The EPSS score of 0.04% and absence from CISA KEV suggest low real-world exploitation probability, but organizations using this product should assess internal risk based on stored data sensitivity.
SQL injection in Daily Time Recording System 4.5.0 allows remote authenticated (low‑privilege) attackers to inject arbitrary SQL via the detail_Id parameter of /admin/add_payroll.php, enabling limited data disclosure, modification, or service disruption. A public proof‑of‑concept exploit exists, though the EPSS score of 0.04% suggests very low exploitation probability and no active exploitation has been confirmed.
SQL injection in Philipinho Simple-PHP-Blog up to commit 94b5d3e allows low-privileged remote attackers to manipulate SQL queries via the /edit.php endpoint. An exploit is publicly available, but no active exploitation in the wild is reported. EPSS probability is very low (0.04%).
SQL injection in Employee Profile Management System 1.0 enables authenticated remote attackers to inject arbitrary SQL via the per_id parameter in the /print_personnel_report.php endpoint. Public exploit code is available, though active exploitation is not confirmed. The flaw can lead to data leakage or manipulation.
Unrestricted file upload in Campcodes Retro Basketball Shoes Online Store 1.0 allows authenticated administrators to upload malicious files via the product_image parameter of /admin/admin_running.php. This can be exploited for remote code execution, and a public exploit is available. EPSS indicates very low exploitation probability (0.06%), and no active exploitation has been confirmed.
A remote code execution vulnerability in A security vulnerability (CVSS 4.7). Risk factors: public PoC available.
Reflected cross-site scripting in SourceCodester Online Banking System 1.0 allows remote attackers to inject scripts via the First Name or Last Name parameter on the user page. Exploit code is publicly available, though no active exploitation has been confirmed and EPSS indicates very low exploitation probability.
Cross-site scripting (XSS) in GreenCMS 2.3.0603 allows remote attackers with administrative privileges to inject web script via the 'Link' parameter in menu management. The product is end-of-life and no longer supported; an exploit is publicly available but real-world risk is low due to high privilege requirements and limited deployment.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
We need to generate a JSON analysis for CVE-2025-14207. The input provides data: description, CVSS 4.0 vector, CWE, EPSS, tags, references, ENISA EUVD ID, affected versions, etc. No KEV data, so not actively exploited. The exploit is "publicly available". Patch info: rolling release, no version details, so no specific fix version. I'll follow the instructions for each field. product_name: The product is "Hotel-Management-System" by tushar-2223. It's a PHP-based system. So, "Hotel Management System" (1-3 words). Primary product. So "Hotel Management System". summary: Need 2-3 sentences. Not paraphrasing description. Start with impact and product. It's SQL injection in Hotel-Management-System via invoiceprint.php's ID parameter. Remote exploitation possible. No KEV, EPSS low (0.04%). So: "SQL injection in tushar-2223 Hotel Management System allows remote attackers to manipulate database queries via the invoiceprint.php ID parameter." Mention EPSS and exploit: "Exploit code is publicly available, but EPSS indicates low exploitation probability (0.04%). No active exploitation confirmed." That's original synthesis. technical_context: Underlying tech: PHP application, likely MySQL/MariaDB. SQL injection due to improper input validation. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), specifically SQL injection. CPE data not provided, but product is identified. So: "The vulnerability stems from insufficient input validation in a PHP script (/admin/invoiceprint.php). The ID parameter, likely used in a database query, can be manipulated to inject arbitrary SQL commands. This is the classic SQL injection scenario, where user-supplied data is concatenated into SQL without proper sanitization." risk_assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's network, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability. EPSS 0.04%, low. No KEV. POC available. So overall: "CVSS 4.0 base score of 5.5 reflects low impact (VC/VI/VA all low), but the attack vector is network-accessible with no authentication, making exploitation easy. EPSS score (0.04%) suggests a very low probability of widespread exploitation. The availability of a public exploit slightly elevates risk for internet-facing instances, but the low impact limits urgency. With no active exploitation reported and a low EPSS, this is likely low-risk despite the easy exploitability." SSVC: exploitation status: PoC (public), automatable: yes (AV:N/AC:L), technical impact: partial (low). So decision: moderate priority? Not critical. I'll state: "Given the low impact and low EPSS, the real-world risk is low, though any SQL injection warrants attention." affected_products: "tushar-2223 Hotel-Management-System (commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 and earlier due to rolling release). No specific version numbers available." Reference vendor advisory? None from tushar-2223, just the vulnerability reports. I can include the references: GitHub report and VulDB links. So: "The vulnerability affects the Hotel-Management-System by tushar-2223, particularly the commit referenced above. Due to the project's rolling release model, there are no designated version numbers. The advisory on VulDB (ID 334650) and a detailed report on GitHub provide technical details." remediation: No official patch. Rolling release, fix not confirmed. So remediation: "No vendor-released patch is available at this time. The project uses continuous delivery, so the maintainer may have already fixed the issue in later commits, but this is unconfirmed. As a workaround, restrict access to the /admin/invoiceprint.php endpoint to authorized personnel only, for example by IP whitelisting or requiring additional authentication. Consider applying input validation on the ID parameter to allow only numeric values, though this may break functionality if not done carefully. Monitor the GitHub repository for a confirmed fix." exploit_scenario: "An attacker sends a crafted HTTP request to /admin/invoiceprint.php with a malicious ID parameter containing SQL injection payload. If the application is exposed and no authentication is required, the database can be read or manipulated, potentially leaking sensitive information like guest records or admin credentials." POC exists, so note that. exploitation_conditions: Specific conditions: The attack requires the /admin/invoiceprint.php endpoint to be accessible. The CVSS vector indicates PR:N, so no authentication, but the endpoint is under /admin/; typical admin panels often require authentication. However, the description and CVSS explicitly state PR:N, so I'll trust that. So: "No authentication required (PR:N per CVSS). The invoiceprint.php script must be reachable over the network; if the application is behind authentication, exploitation is limited to authenticated users. The SQL injection occurs via the ID parameter, so the attacker must be able to supply arbitrary strings to that parameter." The EPSS low might be because admin panels are often restricted. But I'll state: "The primary condition is that the vulnerable endpoint /admin/invoiceprint.php is exposed without authentication. If the application enforces admin login, then exploitation requires valid credentials, contrary to the CVSS assumption. However, the public exploit may bypass authentication or the default installation may not enforce it." attack_chain: Steps: Access vulnerable endpoint → Inject SQL payload via ID parameter → Execute unauthorized SQL commands → Extract or modify data. Since PR:N, no auth step. So chain: "Access /admin/invoiceprint.php remotely → Inject crafted SQL string in ID parameter → Database executes malicious query → Exfiltrate sensitive data from hotel management database." Fits kill chain: Access → Delivery → Exploit → Execution → Exfiltration (impact). So: "Send HTTP request to /admin/invoiceprint.php → Inject SQL payload in ID parameter → Database executes arbitrary SQL query → Retrieve guest records or credentials." confidence_notes: "NVD and VulDB confirm the vulnerability and public exploit availability. EPSS data from FIRST.org. No vendor advisory from the project maintainer; the fix status is unknown due to rolling release. The CVSS 4.0 score is from VulDB/NVD and seems consistent. The PR:N in CVSS is questionable given the /admin/ path, but the vector is authoritative per the source." So I'll state: "Exploit confirmed publicly available. Patch status unconfirmed due to rolling release; no specific version. CVSS 4.0 vector accepted as authoritative, though the PR:N assumption for an admin path may not hold in all deployments." prevalence: The product is a niche Hotel Management System by an individual developer on GitHub. It's not widely deployed; likely used in small projects or learning exercises. So "low". Justification: "niche open-source hotel management project with limited production use". prevalence_basis: "Niche open-source project, minimal enterprise footprint" assessed_cvss_vector: I need to independently assess CVSS 3.1. Based on description: remote, no auth (PR:N), no user interaction, low impact on confidentiality, integrity, availability? The CVSS 4.0 has VC:L/VI:L/VA:L. For 3.1, it's a SQL injection, so confidentiality, integrity might be high if full DB access, but the score says low. I'll follow the impact as given: low. So: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 3.1 vector. But is scope changed? Probably unchanged because it's just the web app. So: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L". That yields score 7.3? That's high. Wait, calculate: C:L, I:L, A:L = (conf 3.4, integ 3.4, avail 2.8) with S:U, total: 9.6? Actually base score formula: Attack Vector: Network (0.85), Attack Complexity: Low (0.77), Privileges Required: None (0.85), User Interaction: None (0.85), Scope: Unchanged. Impact: C:L (0.22), I:L (0.22), A:L (0.22) => ISS = 1 - (1-0.22)*(1-0.22)*(1-0.22) = 0.506, adjusted: since scope unchanged, impact = 6.42*ISS = 3.25. Exploitability = 8.22*0.85*0.77*0.85 = 4.57. Base score = min(10, roundup(3.25+4.57)) = 7.8? Actually 7.8? Wait, roundup(7.82) = 7.8? Actually roundup(7.82) is 7.9. Something's off. Let's recalc: ISS = 1 - (1-0.22)^3 = 1 - 0.78^3 = 1 - 0.475 = 0.525. then impact = 6.42 * ISS = 6.42*0.525 = 3.37. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * (0.85*0.77*0.85*0.85) = 8.22 * 0.472 = 3.88. Base = 3.37 + 3.88 = 7.25, roundup = 7.3. So score 7.3. The CVSS 4.0 gave 5.5, which is low. But if I use C:L/I:L/A:L, 3.1 gives 7.3. That's a discrepancy. Maybe the impact should be low? But SQL injection typically gives high confidentiality if you can read all data. However, the assigned C/I/A low in CVSS 4.0 suggests limited impact, perhaps only error-based or blind, not full dump. I'll trust the source's impact: low. So 7.3. That's High, not low. But the risk assessment had low risk. I should stick with the source's impact assessment: VC:L, etc. So my 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. I'll output that. But the CVSS score for that is 7.3 (High). That contrasts with the CVSS 4.0 score 5.5 (Medium). I can note the inconsistency. But as analyst, I'm to provide my own independent assessment. If I believe the impact is low, 7.3 is still high. But I might adjust if I think SQL injection always leads to high impact. However, the instructions: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." I need to interpret impact based on description. The description only says SQL injection, no specifics on impact. With SQL injection, typically you can read entire database, so C:H, I:H, A maybe L (if you can modify data). But the input source gave low, so maybe it's just error-based without useful output. I'll consider that the assessment is that the impact is limited, perhaps only error information leakage, not full data exfiltration. So I'll stick with low. But I can mention in rationale that I'm assuming low impact based on researcher's assessment, though typical SQLi could lead to higher impact. So rating as Low. So vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 7.3 High base score, but I'll note that the actual impact might be higher. I'll include it and then explain. assessed_cvss_rationale: "Network-exploitable with no authentication; impact limited to low based on the researcher's assessment, but typical SQLi may have higher impact." assessed_cvss40_vector: The provided vector already exists: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... I'll output that same base vector (the base part) as my assessment, consistent with my 3.1. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA