We need to produce a JSON object for CVE-2025-15002 based on the provided data. First, parse the input: - CVE ID: CVE-2025-15002 - Description: A vulnerability found in SeaCMS up to 13.3. Affected is unknown function of file js/player/dmplayer/dmku/class/mysqli.class.php. Manipulation of argument page/limit leads to SQL injection. Attack can be executed remotely. Exploit disclosed to public and may be used. - CVSS Score: 5.5 (but this seems to be associated with the CVSS 4.0 vector, not 3.1) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?), but typically SQL injection is CWE-89. Here it's CWE-74, which is a generic injection. Could be something like "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')". However, description says SQL injection, so likely CWE-89, but input says CWE-74. We'll note that. - Multi-source intelligence: - EPSS Score: 0.05% (percentile 15%) — very low exploitation probability. - POC/Exploit: Publicly available (that's from the "POC/Exploit" field? Actually the input says "POC/Exploit: Publicly available". So there is a public exploit. - Reported by: cna@vuldb.com - CPE (affected products): cpe:2.3:a:seacms:seacms:*:*:*:*:*:*:*:* - Tags: SQLi, PHP, Seacms - References: [nvd] (exploit) https://note-hxlab.wetolink.com/share/VFwALb6qhnTZ [nvd] (None) https://vuldb.com/?ctiid.337707 [nvd] (None) https://vuldb.com/?id.337707 [nvd] (None) https://vuldb.com/?submit.716083 No KEV status mentioned, so not in KEV. No patch information explicitly. This is a vuldb submission. The description says "up to 13.3", so affected versions <= 13.3? The CPE is seacms:* means all versions, but description says up to 13.3. So likely all
We are tasked with producing a JSON object synthesizing data for CVE-2025-14990. CVE ID: CVE-2025-14990 Description: "A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks." Given: CVSS Score: 5.5? Actually the CVSS vector provided is a 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X The score 5.5 is likely the base score from that vector. Let's assume CVSS 4.0 base score 5.5 (low). The vector indicates: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. So it's a network-vector, low attack complexity, no privileges, no user interaction, low impact on vulnerable system (confidentiality, integrity, availability), no impact on subsequent systems. Exploit maturity E:P (proof of concept). Overall, low severity. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection would normally be CWE-89, but here it's CWE-74, maybe a mistake. We'll note it's SQLi but CWE given is 74. Multi-source intel: EPSS Score: 0.05% (percentile 15%) - very low exploitation probability. POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Complete Online Beauty Parlor Management System References: github issue, vuldb entries, campcodes homepage. We need to produce fields: product_name: "Complete Online Beauty Parlor Management System" - but that's long, maybe "Beauty Parlor Management System"? The CPE product name is "complete_online_beauty_parlor_management_system". Short: "Complete Online Beauty Parlor Management System" (still long) but they said 1-3 words ONLY. Could be "Beauty Parlor CMS"? But better: "Beauty Parlor Management". However, the exact name is "Complete Online Beauty Parlor Management System". 1-3 words: "Beauty Parlor System"? That might lose clarity. I'll choose "Beauty Parlor Management" (3 words). Or "Complete Online Beauty Parlor" is 3 words? Actually "Complete Online Beauty" is 3 words. But product name: "Campcodes Complete Online Beauty Parlor Management System". I'll pick "Beauty Parlor Management" as shorthand. But the requirement: "1-3 words ONLY. The specific product or service name affected." I'll use "Beauty Parlor MS" (MS for Management System) but that might be too terse. I'll use "Online Beauty Parlor System". That's 4 words? Online (1) Beauty (2) Parlor (3) System (4) -> 4. I could drop "Online": "Beauty Parlor System" is 3. Or "Beauty Parlor CMS"? The software might not be a CMS. I'll go with "Beauty Parlor Management System"? That's 4 words. Maybe "Beauty Parlor Mgmt" but Mgmt is not a word. The rule says "1-3 words ONLY." So I need a very short product name. The vendor is Campcodes, the product is "Complete Online Beauty Parlor Management System". I could say "Beauty Parlor System" (3 words). Yes, that works. I'll use "Beauty Parlor System". The CPE confirms it's version 1.0. summary: Must be original synthesis, not copy of description. Start with specific impact verb and product. E.g., "SQL injection in Beauty Parlor System 1.0 allows remote attackers to manipulate appointment data via viewid parameter." Include EPSS risk: "EPSS predicts very low exploitation probability (0.05%), but a public exploit is available." Mention CWE and KEV? Not in KEV. So "no known active exploitation." Noted: POC is public. technical_context: Mention that it's a PHP web application, the vulnerability is SQL injection in the /admin/view-appointment.php endpoint through the viewid parameter. CWE-74 indicates injection, though SQLi is typically CWE-89. The CPE specifies the exact product and version. The underlying technology: PHP and likely MySQL. risk_assessment: CVSS 4.0 base score 5.5 Medium (Low impact, network, low attack complexity, no privs needed). EPSS 0.05% suggests very unlikely to be exploited in the wild. Not in KEV. POC exists, so possible targeted attacks. The application is a niche beauty parlor management system, likely limited enterprise deployment, so real-world risk is low. SSVC: Exploitation: PoC (public), Automatable: Yes (network, low complexity), Technical Impact: Partial (low impact on confidentiality, integrity, availability). So priority might be moderate only for organizations using this specific software. Compare signals: high ease of exploitation (remote, no auth) but low impact and low prevalence reduces urgency. affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0, as per CPE cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0. The affected file is /admin/view-appointment.php. No vendor advisory link is provided; references include VulDB entries and a GitHub issue." remediation: No official fix mentioned. Since no vendor advisory is available, suggest: "No vendor patch identified. Mitigation: Disable the affected endpoint /admin/view-appointment.php if not needed, or apply input validation to sanitize the viewid parameter. Restrict network access to the admin panel to trusted IPs. Regularly monitor for SQLi attempts." Since it's a remote unauthenticated injection, the best immediate step is to filter the parameter. Provide specific: "Apply a Web Application Firewall rule to block SQLi patterns on the viewid parameter. Note that the application is from Campcodes, possibly discontinued, so consider replacing the software if it is mission-critical." No patch available. exploit_scenario: "An attacker sends a crafted HTTP GET request to /admin/view-appointment.php?viewid=1' OR '1'='1, exploiting the SQL injection to extract database information, modify appointment records, or potentially gain further access to the underlying server if database privileges allow." exploitation_conditions: From CVSS: AV:N, AC:L, PR:N, UI:N, so no authentication required, remotely exploitable, no user interaction. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Beauty Parlor System 1.0. The /admin/view-appointment.php endpoint is publicly accessible and does not require authentication." No limiting factors beyond maybe the admin interface might be somewhat hidden, but default is often accessible. So "unauthenticated". attack_chain: "Reconnaissance of web application → Send malicious SQL payload in viewid parameter → Backend PHP code concatenates input into SQL query → SQL query executed, data exfiltration or modification." More concisely: "Identify /admin/view-appointment.php endpoint → Inject SQL via viewid → Database executes malicious query → Extract/modify appointment data". That's 4 steps. confidence_notes: What is confirmed: Vulnerability in /admin/view-appointment.php of Campcodes Complete Online Beauty Parlor Management System 1.0, disclosed publicly via VulDB and GitHub. Exploit PoC available. Not confirmed: Active exploitation (no KEV). No vendor advisory found; patch status unknown. The CWE is given as CWE-74, but SQL injection is typically CWE-89 — possible misclassification. prevalence: The software is a niche product for beauty parlors, likely low deployment in enterprise environments. So prevalence: "low". Basis: "niche vertical application for small businesses" (max 12 words). I'll use "low" and basis "small business beauty parlor management software". assessed_cvss_vector: Given CVSS 4.0 vector already provided. But the task says: "Your OWN independent CVSS 3.1 base-metric vector ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we need to assign a 3.1 vector. According to description: network attack vector, low complexity, no privileges (since it seems unauthenticated — the description doesn't mention auth, but CVSS 4.0 gave PR:N), no user interaction. Impact: SQL injection could lead to data leakage and data manipulation, but CVSS 4.0 gave Low for all. For 3.1, we'd have: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N maybe? Or could be C:L/I:L/A:L? SQLi often leads to database compromise, which can affect availability too. I'll assign C:L/I:L/A:L (all low) as it's a database injection, but scope unchanged. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a score of 7.3? Actually CVSS 3.1 with C:L/I:L/A:L and everything else low gets 7.3 (High). But original 4.0 score is 5.5. The difference is that 4.0 has separate vulnerable system impact and subsequent impact, and here it's low impact across all three. In 3.1, low impact on all three with AV:N/AC:L/PR:N/UI:N/S:U yields 7.3. That might be too high. The 4.0 vector gave VC:L/VI:L/VA:L (low). Equivalent 3.1 would be the same: C:L/I:L/A:L. So I'll use that. Rationale: "Remote, unauthenticated SQL injection with low impact to confidentiality, integrity, and availability of the database." assessed_cvss40_vector: We can use the same as provided but we'll justify: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's fine. Rationale: "Attack requires only network access, no privileges; impact is limited to low on the vulnerable component." Now compile into JSON. Ensure all fields are plain text strings, no arrays. product_name: "Beauty Parlor System" summary: "SQL injection in Campcodes Beauty Parlor System 1.0 allows remote attackers to manipulate or exfiltrate appointment data via the viewid parameter in /admin/view-appointment.php. The vulnerability is remotely exploitable with no authentication, has a publicly available exploit, but EPSS predicts very low (0.05%) exploitation probability. There is no evidence of active exploitation in the wild." technical_context: "The vulnerability exists in the PHP-based Campcodes Complete Online Beauty Parlor Management System 1.0. The offending endpoint /admin/view-appointment.php fails to properly sanitize the 'viewid' input, leading to SQL injection (CWE-74, though typically categorized as CWE-89). The CPE identifies the affected application exactly, and the vulnerability is exploitable against the database back-end, likely MySQL." risk_assessment: "CVSS 4.0 base score 5.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, indicating easy remote exploitation but only low impact to confidentiality, integrity, and availability. EPSS gives a 0.05% chance of exploitation in the next 30 days, in the 15th percentile, suggesting almost negligible real-world threat. No CISA KEV entry. A public proof-of-concept (PoC) exists, enabling scripted attacks, but the product is a niche beauty parlor management system with likely minimal enterprise footprint. SSVC assessment: Exploitation (PoC), Automatable (Yes), Technical Impact (Partial). Overall, this is a low-priority issue except for organizations actively using this exact software." affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0 (cpe:2.3:a:campcodes:
SQL injection in Online Beauty Parlor System 1.0 allows remote attackers to manipulate database queries through the /admin/search-invoices.php endpoint. The vulnerability carries a medium CVSS score, but exploit code is publicly available and no authentication is required, making it easy to attack. No active exploitation in the wild has been confirmed, and the EPSS probability remains low.
Stored cross-site scripting (XSS) in WP Microdata WordPress plugin version 1.0 and earlier allows authenticated users or lower-privileged administrators to inject malicious scripts that execute in the browsers of site visitors, potentially leading to credential theft, session hijacking, or malware distribution. The vulnerability stems from improper input sanitization during web page generation. EPSS score of 0.04% indicates low exploitation probability in real-world conditions.
Stored cross-site scripting (XSS) in HappyDevs TempTool WordPress plugin version 1.3.1 and earlier allows authenticated attackers to inject malicious scripts that persist in the database and execute in the browsers of other users who view affected pages. The vulnerability exists in the [Show Current Template Info] functionality and affects the current-template-name component; exploitation requires an authenticated user with appropriate plugin permissions but can compromise all site visitors who interact with the injected content.
Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.8.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HappyDevs TempTool plugin for WordPress exposes sensitive system information through an information disclosure vulnerability affecting versions up to 1.3.1. The vulnerability allows unauthorized parties to retrieve embedded sensitive data by exploiting improper access controls, specifically in the [Show Current Template Info] functionality. With an EPSS score of 0.04% and no CVSS vector assigned, exploitation likelihood is low, though the information disclosed could inform secondary attacks.
Missing Authorization vulnerability in Mapro Collins Magazine Edge magazine-edge allows Exploiting Incorrectly Configured Access Control Security Levels.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.