CVE-2025-48633 is a security vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed). Vendor patch is available.
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution (RCE).
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.
A remote code execution vulnerability in A vulnerability (CVSS 6.5). Risk factors: public PoC available.
Remote SQL injection in Student Management System 1.0 via the sub parameter in /newsubject.php allows unauthenticated attackers to manipulate database queries. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. Exploitation probability is low (EPSS 0.04%), though the vulnerability is easily triggered over the network without authentication.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.
SQL injection in Student Management System 1.0 allows remote attackers to manipulate the 'ID' parameter in /newcurriculm.php, potentially leading to unauthorized database access. Public exploit code exists, but EPSS exploitation probability is negligible (0.04%), and no active exploitation has been reported. The affected product is a niche academic application, limiting real-world impact.
SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.
SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.
SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.
Unauthenticated SQL injection in Simple Shopping Cart 1.0 via the admin_username parameter on /adminlogin.php allows remote attackers to extract sensitive data or bypass authentication. A proof-of-concept exploit is publicly available, though no active exploitation has been reported in CISA KEV. The vulnerability affects code-projects/fabian's PHP-based shopping cart software.
SQL injection in IdeaCMS up to version 1.8 permits unauthenticated remote attackers to execute arbitrary SQL commands via the params argument in Coupon.php's whereRaw function. A public exploit is available, but the EPSS exploitation probability is low (0.04%), and no active exploitation is confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to extract or modify database data by manipulating the 'fname' parameter in /edit_user.php. The exploit is publicly available, but no active exploitation has been confirmed, and the EPSS score is very low (0.04%), indicating minimal real-world likelihood.
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.
SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.
SQL injection in Campcodes School File Management System 1.0 allows unauthenticated remote attackers to inject SQL via the stud_id parameter in /update_query.php. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%) and the CISA KEV catalog does not list it. The vulnerability has a CVSS 4.0 score of 5.5 (Medium), reflecting limited impact on confidentiality, integrity, and availability.
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destination input.
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.
In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
A remote code execution vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures.
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalation of privilege and background activity launches with User execution privileges needed. User interaction is not needed for exploitation.
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could lead to local escalation of privilege with user execution privileges needed. User interaction is not needed for exploitation.
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2025-48598 is a security vulnerability (CVSS 6.6). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resources without limits.
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.
IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.
Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answer(), which can cause a Denial of Service. This issue is fixed in version 1.34.6.
We need to generate a JSON analysis for CVE-2025-14207. The input provides data: description, CVSS 4.0 vector, CWE, EPSS, tags, references, ENISA EUVD ID, affected versions, etc. No KEV data, so not actively exploited. The exploit is "publicly available". Patch info: rolling release, no version details, so no specific fix version. I'll follow the instructions for each field. product_name: The product is "Hotel-Management-System" by tushar-2223. It's a PHP-based system. So, "Hotel Management System" (1-3 words). Primary product. So "Hotel Management System". summary: Need 2-3 sentences. Not paraphrasing description. Start with impact and product. It's SQL injection in Hotel-Management-System via invoiceprint.php's ID parameter. Remote exploitation possible. No KEV, EPSS low (0.04%). So: "SQL injection in tushar-2223 Hotel Management System allows remote attackers to manipulate database queries via the invoiceprint.php ID parameter." Mention EPSS and exploit: "Exploit code is publicly available, but EPSS indicates low exploitation probability (0.04%). No active exploitation confirmed." That's original synthesis. technical_context: Underlying tech: PHP application, likely MySQL/MariaDB. SQL injection due to improper input validation. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), specifically SQL injection. CPE data not provided, but product is identified. So: "The vulnerability stems from insufficient input validation in a PHP script (/admin/invoiceprint.php). The ID parameter, likely used in a database query, can be manipulated to inject arbitrary SQL commands. This is the classic SQL injection scenario, where user-supplied data is concatenated into SQL without proper sanitization." risk_assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's network, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability. EPSS 0.04%, low. No KEV. POC available. So overall: "CVSS 4.0 base score of 5.5 reflects low impact (VC/VI/VA all low), but the attack vector is network-accessible with no authentication, making exploitation easy. EPSS score (0.04%) suggests a very low probability of widespread exploitation. The availability of a public exploit slightly elevates risk for internet-facing instances, but the low impact limits urgency. With no active exploitation reported and a low EPSS, this is likely low-risk despite the easy exploitability." SSVC: exploitation status: PoC (public), automatable: yes (AV:N/AC:L), technical impact: partial (low). So decision: moderate priority? Not critical. I'll state: "Given the low impact and low EPSS, the real-world risk is low, though any SQL injection warrants attention." affected_products: "tushar-2223 Hotel-Management-System (commit bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15 and earlier due to rolling release). No specific version numbers available." Reference vendor advisory? None from tushar-2223, just the vulnerability reports. I can include the references: GitHub report and VulDB links. So: "The vulnerability affects the Hotel-Management-System by tushar-2223, particularly the commit referenced above. Due to the project's rolling release model, there are no designated version numbers. The advisory on VulDB (ID 334650) and a detailed report on GitHub provide technical details." remediation: No official patch. Rolling release, fix not confirmed. So remediation: "No vendor-released patch is available at this time. The project uses continuous delivery, so the maintainer may have already fixed the issue in later commits, but this is unconfirmed. As a workaround, restrict access to the /admin/invoiceprint.php endpoint to authorized personnel only, for example by IP whitelisting or requiring additional authentication. Consider applying input validation on the ID parameter to allow only numeric values, though this may break functionality if not done carefully. Monitor the GitHub repository for a confirmed fix." exploit_scenario: "An attacker sends a crafted HTTP request to /admin/invoiceprint.php with a malicious ID parameter containing SQL injection payload. If the application is exposed and no authentication is required, the database can be read or manipulated, potentially leaking sensitive information like guest records or admin credentials." POC exists, so note that. exploitation_conditions: Specific conditions: The attack requires the /admin/invoiceprint.php endpoint to be accessible. The CVSS vector indicates PR:N, so no authentication, but the endpoint is under /admin/; typical admin panels often require authentication. However, the description and CVSS explicitly state PR:N, so I'll trust that. So: "No authentication required (PR:N per CVSS). The invoiceprint.php script must be reachable over the network; if the application is behind authentication, exploitation is limited to authenticated users. The SQL injection occurs via the ID parameter, so the attacker must be able to supply arbitrary strings to that parameter." The EPSS low might be because admin panels are often restricted. But I'll state: "The primary condition is that the vulnerable endpoint /admin/invoiceprint.php is exposed without authentication. If the application enforces admin login, then exploitation requires valid credentials, contrary to the CVSS assumption. However, the public exploit may bypass authentication or the default installation may not enforce it." attack_chain: Steps: Access vulnerable endpoint → Inject SQL payload via ID parameter → Execute unauthorized SQL commands → Extract or modify data. Since PR:N, no auth step. So chain: "Access /admin/invoiceprint.php remotely → Inject crafted SQL string in ID parameter → Database executes malicious query → Exfiltrate sensitive data from hotel management database." Fits kill chain: Access → Delivery → Exploit → Execution → Exfiltration (impact). So: "Send HTTP request to /admin/invoiceprint.php → Inject SQL payload in ID parameter → Database executes arbitrary SQL query → Retrieve guest records or credentials." confidence_notes: "NVD and VulDB confirm the vulnerability and public exploit availability. EPSS data from FIRST.org. No vendor advisory from the project maintainer; the fix status is unknown due to rolling release. The CVSS 4.0 score is from VulDB/NVD and seems consistent. The PR:N in CVSS is questionable given the /admin/ path, but the vector is authoritative per the source." So I'll state: "Exploit confirmed publicly available. Patch status unconfirmed due to rolling release; no specific version. CVSS 4.0 vector accepted as authoritative, though the PR:N assumption for an admin path may not hold in all deployments." prevalence: The product is a niche Hotel Management System by an individual developer on GitHub. It's not widely deployed; likely used in small projects or learning exercises. So "low". Justification: "niche open-source hotel management project with limited production use". prevalence_basis: "Niche open-source project, minimal enterprise footprint" assessed_cvss_vector: I need to independently assess CVSS 3.1. Based on description: remote, no auth (PR:N), no user interaction, low impact on confidentiality, integrity, availability? The CVSS 4.0 has VC:L/VI:L/VA:L. For 3.1, it's a SQL injection, so confidentiality, integrity might be high if full DB access, but the score says low. I'll follow the impact as given: low. So: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 3.1 vector. But is scope changed? Probably unchanged because it's just the web app. So: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L". That yields score 7.3? That's high. Wait, calculate: C:L, I:L, A:L = (conf 3.4, integ 3.4, avail 2.8) with S:U, total: 9.6? Actually base score formula: Attack Vector: Network (0.85), Attack Complexity: Low (0.77), Privileges Required: None (0.85), User Interaction: None (0.85), Scope: Unchanged. Impact: C:L (0.22), I:L (0.22), A:L (0.22) => ISS = 1 - (1-0.22)*(1-0.22)*(1-0.22) = 0.506, adjusted: since scope unchanged, impact = 6.42*ISS = 3.25. Exploitability = 8.22*0.85*0.77*0.85 = 4.57. Base score = min(10, roundup(3.25+4.57)) = 7.8? Actually 7.8? Wait, roundup(7.82) = 7.8? Actually roundup(7.82) is 7.9. Something's off. Let's recalc: ISS = 1 - (1-0.22)^3 = 1 - 0.78^3 = 1 - 0.475 = 0.525. then impact = 6.42 * ISS = 6.42*0.525 = 3.37. Exploitability = 8.22 * AV:N * AC:L * PR:N * UI:N = 8.22 * 0.85 * 0.77 * 0.85 * 0.85 = 8.22 * (0.85*0.77*0.85*0.85) = 8.22 * 0.472 = 3.88. Base = 3.37 + 3.88 = 7.25, roundup = 7.3. So score 7.3. The CVSS 4.0 gave 5.5, which is low. But if I use C:L/I:L/A:L, 3.1 gives 7.3. That's a discrepancy. Maybe the impact should be low? But SQL injection typically gives high confidentiality if you can read all data. However, the assigned C/I/A low in CVSS 4.0 suggests limited impact, perhaps only error-based or blind, not full dump. I'll trust the source's impact: low. So 7.3. That's High, not low. But the risk assessment had low risk. I should stick with the source's impact assessment: VC:L, etc. So my 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. I'll output that. But the CVSS score for that is 7.3 (High). That contrasts with the CVSS 4.0 score 5.5 (Medium). I can note the inconsistency. But as analyst, I'm to provide my own independent assessment. If I believe the impact is low, 7.3 is still high. But I might adjust if I think SQL injection always leads to high impact. However, the instructions: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." I need to interpret impact based on description. The description only says SQL injection, no specifics on impact. With SQL injection, typically you can read entire database, so C:H, I:H, A maybe L (if you can modify data). But the input source gave low, so maybe it's just error-based without useful output. I'll consider that the assessment is that the impact is limited, perhaps only error information leakage, not full data exfiltration. So I'll stick with low. But I can mention in rationale that I'm assuming low impact based on researcher's assessment, though typical SQLi could lead to higher impact. So rating as Low. So vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a 7.3 High base score, but I'll note that the actual impact might be higher. I'll include it and then explain. assessed_cvss_rationale: "Network-exploitable with no authentication; impact limited to low based on the researcher's assessment, but typical SQLi may have higher impact." assessed_cvss40_vector: The provided vector already exists: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N ... I'll output that same base vector (the base part) as my assessment, consistent with my 3.1. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA
In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.