Authentication bypass in JAY Login & Register plugin for WordPress versions ≤2.4.01 allows unauthenticated remote attackers to impersonate any site user, including administrators, by exploiting flawed cookie validation in the user-switching function. Attackers require only knowledge of target user IDs to gain complete account access without credentials. No public exploit identified at time of analysis.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
PHP object injection in Doubly Cross Domain Copy Paste plugin (≤1.0.46) allows authenticated attackers with Subscriber-level privileges to execute arbitrary code via deserialized untrusted input from uploaded ZIP archives. Exploitation requires administrators to explicitly enable Subscriber access. Available POP chains enable code execution, file deletion, and sensitive data retrieval. Attack vector requires low privilege (PR:L) authentication with network accessibility and no user interaction. No public exploit identified at time of analysis.
Weak cryptographic hashing in the image_check function of Tenda AX9 firmware 22.03.01.46 allows remote attackers to compromise firmware integrity validation without authentication. The vulnerability has a CVSS score of 2.9 (very low severity) and publicly available exploit code exists, but the high attack complexity and difficult exploitability rating indicate practical barriers to successful exploitation. Real-world risk is minimal: while the vulnerability permits information disclosure related to hash values, it does not enable remote code execution or device takeover.
OS command injection in TOTOLINK X5000R firmware 9.1.0cu.2089_B20211224 allows authenticated remote attackers to execute arbitrary system commands via the User parameter in the /cgi-bin/cstecgi.cgi exportOvpn function. The vulnerability requires valid login credentials but results in complete system compromise once authenticated. Public exploit code is available, and the CVSS score of 2.1 significantly underrepresents the true risk due to the low-impact scoring parameters masking the severity of unauthenticated command execution in a network-accessible management interface.
SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
Popup Builder (Easy Notify Lite) plugin for WordPress versions up to 1.1.37 allows authenticated attackers with Subscriber-level access to reset plugin settings to default values due to missing capability checks in the easynotify_cp_reset() function. The vulnerability requires user authentication and does not grant elevated privileges or information disclosure, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active exploitation has been identified at time of analysis, though the issue poses moderate risk to WordPress installations relying on plugin configuration integrity.
The HAPPY Helpdesk Support Ticket System WordPress plugin up to version 1.0.9 allows authenticated attackers with Subscriber-level access to submit replies to arbitrary support tickets by bypassing authorization checks on the 'submit_form_reply' AJAX action. The vulnerability stems from missing capability validation before processing ticket replies, enabling low-privileged users to manipulate the 'happy_topic_id' parameter and interact with tickets they do not own or are not assigned to. While the CVSS score of 4.3 reflects low-to-medium severity with integrity impact only, the EPSS percentile of 13% and absence of evidence of active exploitation suggest this is not an immediate critical priority, though it should be patched to prevent unauthorized ticket interference.
Unauthorized data modification in AnnunciFunebri Impresa WordPress plugin through version 4.7.0 allows authenticated subscribers to reset all plugin options via the missing capability check on annfu_reset_options() function. Attackers with Subscriber-level access can delete all 29 plugin configuration options, reverting the plugin to default state without administrative authorization. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers with Subscriber-level access can modify tracking settings in the Employee Spotlight WordPress plugin (versions up to 5.1.3) due to missing authorization checks in the employee_spotlight_check_optin() function. The vulnerability allows privilege escalation to perform account integrity modifications that should require administrator approval, affecting all installations of this plugin without patches applied.
Path traversal vulnerability in JW Library App for Android up to version 15.5.1 allows local authenticated users to access files outside intended directories via manipulation of the SiloContainer component. CVSS score of 1.9 reflects low confidentiality impact with no integrity or availability consequences; however, publicly available exploit code exists. Real-world risk is minimal given requirement for local access and prior authentication, EPSS score of 0.03% indicates negligible exploitation probability.
Deserialization vulnerability in Tiny RDM up to version 1.2.5 allows authenticated remote attackers to trigger unsafe pickle deserialization via the Pickle Decoding component, potentially leading to code execution. The attack requires high complexity and prior authentication, making practical exploitation difficult. Public exploit code is available, but the low EPSS score (0.10%) and absence of active exploitation tracking suggest limited real-world risk at present.