Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal vulnerability in Shiguangwu sgwbox N3 NAS firmware 2.0.25 allows remote unauthenticated attackers to read arbitrary files via the /eshell API endpoint. A public exploit is available, and no vendor patch exists yet. EPSS score of 0.42% indicates moderate exploitation probability, though no active exploitation is currently confirmed (no CISA KEV listing).
We need to construct the JSON as per the instructions, based on the provided CVE data. Let's analyze the inputs. CVE ID: CVE-2025-14711 Description: A flaw in FantasticLBP Hotels Server up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0. Unknown code in /controller/api/hotelList.php. Manipulation of argument pickedHotelName/type causes SQL injection. Attack can be carried out remotely. Exploit published. Rolling release. Vendor did not respond. CVSS Score: 5.5 (but there's a CVSS 4.0 vector provided: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... rest with X). The CVSS 4.0 base is AV:N, etc. Score 5.5 would correspond to a CVSS 3.1? But they gave CVSS:4.0 vector. Possibly they just gave a CVSS 4.0 base score of 5.5? Actually they wrote "CVSS Score: 5.5" then CVSS Vector with CVSS:4.0. That seems inconsistent. Possibly the score is from a different version. The provided vector is CVSS 4.0, and it's AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That sounds like low impact to confidentiality integrity availability. That might yield a low score. I'll trust the vector, and the score is not crucial as we are to do our own assessed CVSS vectors. I'll ignore the 5.5 score and rely on the provided CVSS 4.0 vector info. Actually the description says "SQL injection". Typically SQLi can lead to high impact (reading data, modifying). But the provided vector indicates low impact on each. That might be a conservative assessment. My own assessment: SQL injection in a hotel management system could lead to reading sensitive data (C high), maybe modifying (I high), but depending on database permissions. I need to assess based on the description. The description says "manipulation ... causes sql injection". No specifics on impact, but typical SQLi can be severe. I'll set C/I/A accordingly. Usually for SQLi, I assume confidentiality impact high (read data), integrity maybe high if writeable, availability maybe low. But I can choose. Since it's an API endpoint that might return hotel list, maybe it's select query? But parameter pickedHotelName/type might be used in a query, injection might allow arbitrary read. I'll assess with CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H? Possibly. But need to be realistic: without authentication, remote SQLi, full DB compromise likely. I'll set C:H/I:H/A:H. For CVSS 4.0, I can map similarly: VC:H/VI:H/VA:H? But the provided vector had L. I'll use my own assessment. I'll include rationale. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection falls under CWE-89, but they gave CWE-74, a broader class. Probably it's SQLi. I'll mention SQL injection. Multi-source intelligence: - EPSS: 0.08% (percentile 23%) - low likelihood of exploitation soon. - POC/Exploit: Publicly available (yes, the description says exploit published, and references point to GitHub issues). - Reported by cna@vuldb.com. - CPE: cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:* (up to that commit). - Tags: PHP, SQLi, Hotels Server. - References: two exploit links to github.com/navex2/CVE/issues/1 and /2, then vuldb entries. No KEV listed, so not in CISA Known Exploited Vulnerabilities. POC available but not confirmed active exploitation. EPSS low. Patch status: The description says "The product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way." So no patch mentioned. Input has no explicit patch version or advisory. So I'll state "No vendor-released patch identified at time of analysis." But there might be a fix around that commit? The version is "up to 67b44df162fab26df209bd5d5d542875fcbec1d0", which looks like a commit hash. So all versions before that commit might be vulnerable. Rolling release might mean there's no versioned release, just commits. The fix might be in a later commit, but we don't know. So patch unavailable. Product: FantasticLBP Hotels Server. The product_name: "Hotels Server" or "FantasticLBP Hotels Server"? The CPE says fantasticlbp:hotels_server. I'll use "FantasticLBP Hotels Server" as product name (1-3 words: "FantasticLBP Hotels Server"? That's three words. Or "Hotels Server"? I'll use "FantasticLBP Hotels Server" as precise name. It's a PHP web application for hotel management. Now craft each field: product_name: "FantasticLBP Hotels Server" (three words, but "Hotels Server" might be better? The CPE product is hotels_server, vendor fantasticlbp. So product name: "Hotels Server". However, description says "FantasticLBP Hotels Server". I'll use "HotelServer" or "Hotels Server"? The tag says "PHP, SQLi, Hotels Server". I'll go with "Hotels Server" but need to ensure it's specific. The full name is "FantasticLBP Hotels Server". I'll use "FantasticLBP Hotels Server" (3 words). Good. summary: Start with specific impact verb and product. "SQL injection in FantasticLBP Hotels Server up to commit 67b44df... allows remote unauthenticated attackers to manipulate database queries via the pickedHotelName or type parameters in /controller/api/hotelList.php." Then mention active exploitation? Not active, but POC available. EPSS low. So: "Publicly available exploit code exists, though EPSS indicates a low exploitation probability. The vendor has not responded to disclosure and no fix is available." That fits. It's original synthesis. technical_context: Underlying technology: PHP web application for hotel management. The vulnerable component is the /controller/api/hotelList.php API endpoint that handles hotel listing requests. The parameters pickedHotelName and type are likely used directly in a SQL query without proper sanitization, leading to SQL injection (CWE-89, but classified under CWE-74 broader injection). CPE confirms affected product is cpe:2.3:a:fantasticlbp:hotels_server:* up to the specified commit. This is a PHP/SQL context. risk_assessment: CVSS vector provided is CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P, indicating network-accessible, no privileges required, no user interaction, but only low impact on confidentiality, integrity, availability. However, typical SQLi can be high impact. EPSS 0.08% (23rd percentile) indicates low expected exploitation activity. POC publicly available but not listed in KEV, so no known active exploitation. SSVC assessment: no active exploitation, automatable (yes, remote SQLi), technical impact potentially high (depending on DB permissions). The low EPSS and lack of KEV suggest this is not an immediate priority compared to higher-risk vulnerabilities, but the POC availability and unauthenticated nature warrant attention for exposed instances. Note that the CVSS impact rating may understate the true impact if the database is not isolated. Contrast signals: EPSS low, POC published, no KEV, unauthenticated network vector, low impact per provided CVSS but SQLi often leads to data breach. I'll state: "CVSS:4.0 vector rates impact as low, but SQL injection in a hotel management system could expose guest data, making potential real-world impact higher. EPSS score is low despite public POC, suggesting limited exploitation activity at this time." affected_products: FantasticLBP Hotels Server, all versions up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0 (rolling release, no fixed version). The CPE is cpe:2.3:a:fantasticlbp:hotels_server:*:*:*:*:*:*:*:*. No vendor advisory; references include VulDB entries and exploit GitHub issues. So: "Affects FantasticLBP Hotels Server up to and including commit 67b44df162fab26df209bd5d5d542875fcbec1d0; no official release version identifier. The product uses a rolling release model. Refer to the VulDB advisory (336428) and exploit proofs at GitHub issues #1 and #2 in the navex2/CVE repository." I'll write concisely. remediation: No vendor patch available; vendor did not respond. Suggest: "Upgrade to a later commit if one exists that fixes the SQL injection, though no fixed version is announced. As a workaround, implement input validation and parameterized queries on the affected endpoint. Consider restricting access to /controller/api/hotelList.php via web server rules until the code is fixed. Disabling the endpoint if not essential can mitigate the risk. Also, ensure the database account used by the application has minimal privileges to limit potential impact." I'll phrase naturally. exploit_scenario: An attacker sends a crafted HTTP request to /controller/api/hotelList.php with malicious SQL in the pickedHotelName or type parameter. This injects SQL commands, potentially allowing data exfiltration (e.g., guest records) or database modification. A proof of concept is publicly available on GitHub. exploitation_conditions: No complex conditions. Remote unauthenticated attack against the API endpoint is sufficient. No special configuration or authentication required. The endpoint appears to be part of the application's default functionality. There are no limiting factors beyond the accessibility of the web server. So: "No special conditions — remote unauthenticated exploitation against default installations of FantasticLBP Hotels Server with the /controller/api/hotelList.php endpoint exposed." Actually we need EXACT product feature, protocol, configuration: "The vulnerability exists in the hotelList.php API endpoint, which is accessible over HTTP(S) without authentication. No specific configuration is required; the endpoint is present in default deployments." attack_chain: "Send HTTP request to /controller/api/hotelList.php with crafted 'pickedHotelName' parameter → Inject SQL payload into database query → Execute arbitrary SQL queries → Read or modify hotel data." That's 4 steps. I'll add more: Access vulnerable web server → Send crafted request to endpoint → Parameter manipulation bypasses sanitization → SQL injection executes → Database compromise. I'll keep to 3-7 step chain using phases: Access → Delivery → Exploit → Impact. "Access unauthenticated endpoint → Deliver malicious SQL in HTTP parameter → Exploit SQL injection in query building → Execute unauthorized database operations → Exfiltrate or modify sensitive hotel data." That's 5 steps. I'll format with arrows. confidence_notes: NVD provided CVE but the description and CVSS vector came from VulDB (CNA). Exploit existence confirmed by public GitHub issues. No vendor confirmation, as vendor did not respond. The CPE is assigned, and the commit hash is given. The CVSS 4.0 vector is from VulDB. So: "Vulnerability confirmed by VulDB CNA and NVD. Exploit publicly available on GitHub. No vendor advisory or fix. Impact considered low by CVSS:4.0 but may be higher based on SQL injection nature." prevalence: What is deployment footprint? FantasticLBP Hotels Server is a niche open-source PHP hotel management system. I'd say it's rare. Prevalence: rare. Basis: "niche open-source hotel management system with limited deployment." So prevalence_basis: "niche open-source hotel management project." I'll set prevalence to "rare". assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. AV:N (remote), AC:L (no complexity), PR:N (no authentication), UI:N, S:U (no scope change, only the database server), C:H (confidentiality high, as injection can leak all data), I:H (integrity high, can modify data), A:H (availability maybe by dropping tables? Usually SQLi can cause denial of service, but I'll set A:H because SQL injection can disrupt database, but careful: typical SQLi impact is C:H/I:H/A:N or A:H. I'll choose A:H for worst case, but often it's A:N unless the injection allows database shutdown. However, I'll be conservative: A:L or A:N? The description doesn't mention availability
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
Stored cross-site scripting in MISP (Malware Information Sharing Platform) versions before 2.5.28 allows authenticated users with workflow privileges to inject arbitrary JavaScript via the workflow execution path view (executionPath.ctp), where doT.js template expressions used unescaped interpolation. Successful exploitation against a user who views the affected page (UI:R) results in scope-changed compromise of the victim's MISP session, including high-confidentiality/integrity/availability impact (CVSS 9.0). Publicly available exploit code exists in researcher-published repositories; no CISA KEV listing at time of analysis.
FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Red Hat's runtimes-inventory-rhel8-operator lets a standard cluster user act with full cluster-administrator authority on the Red Hat management platform. A misconfigured internal proxy attaches the cluster's main administrative credentials to every command it relays - not just the report traffic it should handle - so any authenticated user can issue admin-level instructions and alter cluster configuration or status. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 12th percentile), and the issue is not in CISA KEV, but the impact is a classic confused-deputy authentication bypass and Red Hat has shipped a fix.
Unauthenticated denial-of-service in a Rockwell Automation controller allows remote attackers to trigger a hard fault by sending malformed CIP (Common Industrial Protocol) packets over the network, rendering the controller completely unresponsive. The device displays a solid red Fault LED and requires a physical power cycle followed by manual fault-code clearing (0xF019) before returning to operational state. Discovered during fuzzing, this vulnerability targets OT/ICS environments where controller availability is safety-critical; no active exploitation or public exploit code has been identified at time of analysis.
FNT Command 13.4.0 is vulnerable to Directory Traversal. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Rockwell Automation Micro850 and Micro870 programmable logic controllers enter a recoverable fault state (fault code 0xFE60) when their IPv6 stack processes multiple malformed packets from an adjacent network segment. The impact is purely an availability disruption requiring manual operator intervention to clear the fault - no confidentiality or integrity compromise occurs. This is particularly significant in OT/ICS environments where controller downtime can halt industrial processes, though the fault is described as recoverable rather than bricking the device.
Open redirect vulnerability in Mayan EDMS allows remote attackers to redirect users to arbitrary websites by crafting malicious URLs targeting the /authentication/ endpoint, affecting versions up to 4.10.1. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed. EPSS indicates a low probability of exploitation at 0.18%.
Code injection in CTCMS up to version 2.1.2 allows high-privilege authenticated remote attackers to inject arbitrary code via manipulation of the Cj_Add or Cj_Edit arguments in the Backend System Configuration Module (/ctcms/libs/Ct_Config.php). Public exploit code is available, but exploitation requires administrative credentials and produces only low confidentiality impact without scope expansion. EPSS score of 0.07% indicates minimal real-world exploitation probability despite public POC availability.
Code injection in CTCMS up to version 2.1.2 allows high-privileged remote attackers to inject arbitrary code via the CT_App_Paytype parameter in the Backend App Configuration Module's Save function. The vulnerability has a low CVSS score (2.0) due to requiring high administrative privileges (PR:H), but publicly available exploit code exists. Real-world risk is limited to authenticated administrators with backend access.
Sensitive information disclosure in Hitron HI3120 firmware 7.2.4.5.2b1 exposes credentials or session data to a local low-privileged attacker through the device's web management interface Logout function in index.html. The root cause, indicated by the 'Insufficient Session Expiration' tag, is that the logout action fails to fully invalidate or clear sensitive session artifacts, leaving them recoverable post-logout. No active exploitation is confirmed (EPSS 0.11%, 1st percentile), and the attack surface is constrained to local access with low privileges, significantly limiting real-world impact despite the High confidentiality rating.
Symlink following in the USB Handler of Ugreen DH2100+ firmware up to 5.3.0 enables a physically present attacker with high privileges to achieve full system compromise. Exploit code is publicly available but the attack cannot be executed remotely and requires administrative access. The low EPSS score (0.01%) reflects the limited exploitation conditions.
Sixun Shanghui Group Business Management System 4.10.24.3 allows unauthenticated remote attackers to access files and directories through the /ExportFiles/ endpoint due to improper access controls, resulting in information disclosure of sensitive data. The vulnerability requires high attack complexity and has publicly available exploit code, but remains difficult to exploit in practice with an EPSS score of 0.06% indicating minimal real-world exploitation probability.
Remote code execution via dynamic code resource manipulation in SamuNatsu HaloBot's Inter-plugin API allows authenticated remote attackers to execute arbitrary code by manipulating the action argument in the html_renderer plugin. The vulnerability affects unsupported legacy versions of the product (commit hash 026b01d4a896d93eaaf9d5163a287dc9f267515b and earlier), with publicly available exploit code disclosed but no vendor-released patch, as the maintainer has abandoned the project and did not respond to early disclosure.
SQL injection in ketr JEPaaS up to version 7.2.8 allows high-privileged remote attackers to manipulate the keyWord argument in the readAllPostil function (/je/postil/postil/readAllPostil), resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS score of 2.0 reflects the requirement for high-level privileges (PR:H), significantly limiting real-world exploitation scope.
Stored cross-site scripting (XSS) vulnerability in vion707 DMadmin backend allows high-privilege authenticated users to inject malicious scripts via the Add function in AddonsController, affecting the application's integrity. The vulnerability requires user interaction (UI:P) and high-privilege access (PR:H), limiting real-world exploitation risk despite a network attack vector. Public exploit code is available, but the extremely low CVSS score (1.9) and EPSS probability (0.05th percentile) suggest minimal practical risk in typical deployments.
Path traversal vulnerability in Smartbit CommV Smartschool App up to version 10.4.4 allows local authenticated attackers to manipulate the SplashActivity component and access or modify files outside intended directories. The vendor has not responded to early disclosure notification, and public exploit code is available.
Path traversal vulnerability in Municorn FAX App 3.27.0 on Android allows local authenticated users to access files outside intended directories with low confidentiality, integrity, and availability impact. The vulnerability affects the biz.faxapp.app component and has been publicly disclosed with exploit code available, though EPSS exploitation probability remains very low at 0.04%, suggesting limited real-world attack likelihood despite public availability.
Path traversal vulnerability in atlaszz AI Photo Team Galleryit App version 1.3.8.2 on Android allows authenticated local attackers to manipulate the gallery.photogallery.pictures.vault.album component and access files outside intended directories. The vulnerability requires local access and authenticated user privileges; public exploit code exists. The vendor has not responded to early disclosure notification, leaving the application unpatched.