SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
Popup Builder (Easy Notify Lite) plugin for WordPress versions up to 1.1.37 allows authenticated attackers with Subscriber-level access to reset plugin settings to default values due to missing capability checks in the easynotify_cp_reset() function. The vulnerability requires user authentication and does not grant elevated privileges or information disclosure, resulting in a CVSS score of 5.4 (medium severity). No public exploit code or active exploitation has been identified at time of analysis, though the issue poses moderate risk to WordPress installations relying on plugin configuration integrity.
The HAPPY Helpdesk Support Ticket System WordPress plugin up to version 1.0.9 allows authenticated attackers with Subscriber-level access to submit replies to arbitrary support tickets by bypassing authorization checks on the 'submit_form_reply' AJAX action. The vulnerability stems from missing capability validation before processing ticket replies, enabling low-privileged users to manipulate the 'happy_topic_id' parameter and interact with tickets they do not own or are not assigned to. While the CVSS score of 4.3 reflects low-to-medium severity with integrity impact only, the EPSS percentile of 13% and absence of evidence of active exploitation suggest this is not an immediate critical priority, though it should be patched to prevent unauthorized ticket interference.
Unauthorized data modification in AnnunciFunebri Impresa WordPress plugin through version 4.7.0 allows authenticated subscribers to reset all plugin options via the missing capability check on annfu_reset_options() function. Attackers with Subscriber-level access can delete all 29 plugin configuration options, reverting the plugin to default state without administrative authorization. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers with Subscriber-level access can modify tracking settings in the Employee Spotlight WordPress plugin (versions up to 5.1.3) due to missing authorization checks in the employee_spotlight_check_optin() function. The vulnerability allows privilege escalation to perform account integrity modifications that should require administrator approval, affecting all installations of this plugin without patches applied.