Unauthenticated path traversal in Tenda CH22 router firmware 1.0.0.1 permits remote attackers to manipulate file paths via the /public/ endpoint. Exploitation can result in limited file disclosure, modification, or deletion. Public exploit code is available, but no active exploitation has been confirmed and EPSS indicates low probability of widespread attacks.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database queries via the /customer_details.php endpoint. A public exploit is available, but the EPSS score is low (0.01%) and no active exploitation has been confirmed through CISA KEV.