SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
Unauthenticated remote access to ZKTeco BioTime's /base/safe_setting/ endpoint exposes stored credential material via manipulable backup_encryption_password_decrypt and export_encryption_password_decrypt parameters, affecting versions 9.0.3, 9.0.4, and 9.5.2. The CVSS 4.0 vector (PR:N/UI:N) and an 'Authentication Bypass' tag confirm no credentials or user interaction are required, enabling any network-reachable attacker to retrieve encryption passwords from the application. A public proof-of-concept exploit is available on GitHub, directly lowering the skill barrier for exploitation, though the vulnerability is not yet listed in CISA KEV.
OpenCart versions up to 4.1.0.3 are vulnerable to a race condition in the Single-Use Coupon Handler component that allows remote attackers to perform unauthorized manipulation resulting in information disclosure. The attack requires high complexity and no authentication, with a CVSS score of 2.9 indicating low impact. Publicly available exploit code exists, though the vendor did not respond to early disclosure notification.
Information disclosure in PbootCMS up to 3.2.12 allows remote attackers to directly request and download the SQLite database file /data/pbootcms.db, potentially exposing sensitive data. A public exploit is available, but exploitation is difficult and EPSS (0.06%) indicates very low probability of widespread exploitation. No active exploitation has been confirmed.
Command injection in TRENDnet TEW-822DRE firmware versions 1.00B21 and 1.01B06 allows authenticated remote attackers with low privileges to execute arbitrary commands on the device. The vulnerability exists in the /boafrm/formWsc endpoint via the peerPin parameter. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported to date (not listed in CISA KEV).
We need to produce a JSON object with the specified fields. The input provides CVE-2025-15133 details: ZSPACE Z4Pro+ firmware 1.0.0440024, command injection in zfilev2_api_CloseSafe, remote, publicly available exploit. EPSS 0.38%, percentile 59%. CWE-74 (improper neutralization). CVSS 4.0 vector given: base score 2.1, AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's low score despite network vector, low privileges required, but impacts are all low (confidentiality, integrity, availability low). EPSS low, no KEV, but POC available. Product: ZSPACE Z4Pro+ firmware (the CPE says cpe:2.3:o:zspace:z4pro\+_firmware:1.0.0440024). Product name: ZSPACE Z4Pro+. That's a specific device. Now synthesize all fields. product_name: "ZSPACE Z4Pro+" (the firmware is part of the product). So just "ZSPACE Z4Pro+". summary: Must not copy description. Need to weave in the fact that it's command injection, remote, authenticated (PR:L), POC available, EPSS low, CVSS low. Write impact: "Authenticated command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows remote attackers with low privileges to execute arbitrary commands via a crafted HTTP POST request to /v2/file/safe/close." Mention POC publicly available, not actively exploited. EPSS low, so limited real-world exploitation probability. No KEV. technical_context: Underlying technology: HTTP POST request handler in firmware, file management API endpoint; command injection in CloseSafe function. CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'). Use CPE for product. Explain that command injection occurs when input is not properly sanitized before being passed to a system command. risk_assessment: Use CVSS 4.0 vector: AV:N (network), AC:L, AT:N (attack requirements none), PR:L (low privileges), UI:N. Impacts VC:L/VI:L/VA:L — confidentiality, integrity, availability all low. So it's a limited impact, maybe command execution but scope unchanged. EPSS 0.38%, percentile 59% meaning low probability of exploitation in next 30 days. No KEV. POC publicly available. So risk is moderate: authenticated low-privilege leads to low impact, EPSS low, but exploit available. SSVC: exploitation none (no active), automatable maybe yes (network, low complexity), technical impact partial. So likely a lower priority. Contrast: CVSS 2.1 is very low, but base metric impacts only low. So the vulnerability is not high severity, but still an authenticated command injection. State that the CVSS score is low due to low impacts, not high impact. POC exists but EPSS suggests not widely targeted. Missing: no confirmation from vendor, only vuldb submission. affected_products: "ZSPACE Z4Pro+ firmware version 1.0.0440024 (cpe:2.3:o:zspace:z4pro\+_firmware:1.0.0440024). Refer to vendor advisory (not provided in references)." Since no advisory link, just mention vuldb and GitHub issue. remediation: No patch version specified. The description says vendor was contacted early about disclosure, but no fix. So primary remediation: upgrade firmware when available. Workaround: restrict access to the HTTP management interface, disable /v2/file/safe/close endpoint if possible, or apply input validation. But since no patched version, suggest compensating controls: For example, restrict network access to trusted IPs, require strong authentication, monitor for suspicious requests. State no vendor-released patch identified. Vuldb reference may have details. exploit_scenario: A remote attacker with low-privilege credentials (e.g., device user) sends a crafted HTTP POST request to the /v2/file/safe/close endpoint, injecting OS commands via unsanitized input. The command executes with the privileges of the web server process, potentially leading to file manipulation, data leakage, or service disruption. POC is publicly available, so exploitation could be automated. exploitation_conditions: Authenticated (requires low privileges) per CVSS PR:L. The vulnerability is in the zfilev2_api_CloseSafe function handling HTTP POST requests to /v2/file/safe/close. No user interaction needed (UI:N). No special configuration beyond default device? The description says "was identified in ZSPACE Z4Pro+ 1.0.0440024" so likely default configuration. So conditions: network access to the device's HTTP service (likely management interface), possession of low-privilege credentials. So "Low-privilege credentials for the device's HTTP management interface are required; the vulnerable endpoint /v2/file/safe/close is exposed by default." attack_chain: Phases: network access → send crafted POST request with malicious input to /v2/file/safe/close → command injection in CloseSafe function → execute arbitrary OS command. Could add: "Obtain low-privilege credentials (e.g., via default credentials, brute force, or other vuln)" as a step? But the chain as given: 3-7 steps. Use: "Send crafted HTTP POST request to /v2/file/safe/close → Inject command into vulnerable parameter → Execute OS command with web server privileges". That's 3 steps. But we need to include the requirement of authentication, so maybe "Authenticate to device with low-privilege credentials → Send crafted HTTP POST to /v2/file/safe/close → Inject OS commands via unsanitized input → Execute arbitrary commands". That's 4 steps. Use: "Authenticate with low-privilege credentials → Craft malicious HTTP POST request → Send to /v2/file/safe/close endpoint → Trigger command injection in zfilev2_api_CloseSafe → Execute OS command as web server user". That's 5 steps. Good. No need for persistence, impact is low, so chain: Authenticate → Send crafted POST → Exploit command injection → Execute command. That captures it. Write: "Authenticate to device with low-privilege credentials → Send crafted HTTP POST request to /v2/file/safe/close → Inject OS commands via unsanitized input → Execute arbitrary commands as web server user". That's 4 steps. Arrow separated. confidence_notes: "Exploit is publicly available via GitHub, but no confirmation of active exploitation. Low EPSS score suggests low real-world exploitation probability. Affected version confirmed by CPE; no vendor advisory found, patch status unknown. Vulnerability reported to vendor but no fix verified." So mention that. prevalence: Unknown product ZSPACE Z4Pro+, likely a niche device (maybe VR/AR? ZSPACE is a company that makes interactive displays for education, Z4Pro+ might be a 3D display). Probably low prevalence. So "low". Basis: "niche educational hardware with limited enterprise footprint". So prevalence "low", basis: "niche educational hardware, limited deployment". assessed_cvss_vector: We need to propose our own CVSS 3.1 vector. Base on description: Network attack vector (remote), low attack complexity (no special conditions), privileges required low (PR:L from 4.0 vector), user interaction none, scope unchanged (SC:N in 4.0 implies S:U), impacts: confidentiality low, integrity low, availability low from 4.0's VC:L/VI:L/VA:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would give base score maybe 6.3? But that's higher than their 4.0 score 2.1. That 4.0 score might be extremely low because of the "E:P" only adding a small temporal? But base score 2.1 seems weird for AV:N/AC:L/PR:L/UI:N/VC:L/VI:L/VA:L. CVSS v4.0 calculator: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N yields base score 5.1? Wait, let's check typical CVSS v4.0 scoring: The given string has base metric values but also environmental metrics masked X. The provided vector is exactly as given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... All base metrics are there, so base score is calculated from those. I recall CVSS v4.0 base score for AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N would be something around 5.3? I can't compute exactly without a calculator, but 2.1 seems suspicious. However, the question says CVSS Score: 2.1, and provides that vector. Possibly the low score is because the impacts are all low, but 2.1 seems very low. Maybe I misread: Some CVSS v4.0 base scores for low impact can be as low as 2.0 when combined with certain PR etc. Actually, with PR:L, the impact subscore is based on the low impacts. The CVSS v4.0 base score formula: I don't have it memorized, but I'd expect a score of maybe 5.0. But the given score is 2.1, so maybe they included "E:P" (exploit maturity) in the score, because that's a temporal metric, not base. The provided vector includes temporal score (E:P), so the overall score might incorporate that, lowering it further from a base of maybe 5.1. For our assessed CVSS vectors, we need to provide our own base vector without temporal metrics. The instruction: "Your OWN independent CVSS 3.1 base-metric vector ... NOT a copy of any score in the input." So I'll just assign the base metrics independently. I think AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is appropriate. That's a valid CVSS:3.1 base score around 6.3. But is that justified? The vulnerability is command injection, which often has high integrity and maybe high confidentiality, but the CVSS 4.0 has low impacts. The description doesn't specify high impact; it's just command injection. So low impact might be understating it. However, to be faithful to the low impacts in the provided vector, I'll keep them low. The CVSS 4.0 vector from the source says VC:L/VI:L/VA:L, so I'll map to C:L/I:L/A:L. That yields a moderate score. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L". For CVSS 4.0: need to map to 4.0 base metrics. I'll produce the same base as the input without temporal: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N". That would be a base score around 5.1 maybe. But the input had temporal E:P lowering to 2.1. But I'll output base vector only, no temporal. So good. Rationale: "Requires low-privilege authentication (PR:L), impacts are limited to low confidentiality, integrity, and availability (C:L/I:L/A:L). Network attack vector." For the CVSS 4.0 rationale: one sentence max 25 words: "Network exploitable with low privileges and no user interaction; impacts are all low." that works. Provide both. assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" (no temporal). Now assemble JSON. Ensure all fields are plain text strings. So: product_name: "ZSPACE Z4Pro+" summary: "Authenticated command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows remote attackers with low privileges to execute arbitrary OS commands via a crafted HTTP POST request to the /v2/file/safe/close endpoint. A public proof-of-concept exploit is available, but EPSS indicates low exploitation likelihood (0.38%). No active exploitation reported." technical_context: "The flaw resides in the zfilev2_api_CloseSafe function of
Command injection in ZSPACE Z4Pro+ 1.0.0440024 via the /v2/file/safe/open HTTP POST endpoint allows authenticated remote attackers to execute arbitrary commands with limited impact on confidentiality, integrity, and availability. The vulnerability affects the zfilev2_api_open function and has been publicly disclosed with exploit code available; however, the EPSS score of 0.38% (59th percentile) and CVSS scope constraint (SC:N) suggest limited real-world exploitation risk despite authenticated remote access capability.
Public command injection in ZSPACE Z4Pro+ firmware allows authenticated remote attackers to execute arbitrary commands via the zfilev2_api_SafeStatus function in the /v2/file/safe/status endpoint. Low CVSS base score (2.1) and EPSS (0.38%) reflect limited impact and low exploitation probability, but public POC code exists, increasing risk for targeted attacks. No evidence of active exploitation in the wild.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Code injection in CmsEasy up to 7.7.7 allows remote attackers with administrative access to execute arbitrary code through the template management feature. The vulnerability exists in the savetemp_action function, which improperly handles the 'content' and 'tempdata' parameters, and a public exploit is available. Exploitation requires high privileges, no active exploitation has been reported, and EPSS indicates very low exploitation probability.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
Stack-based buffer overflow in the sokol graphics library's pipeline descriptor defaults function allows a local attacker with low privileges to trigger memory corruption. The vulnerability affects all versions up to commit 16cbcc864012898793cd2bc57f802499a264ea40, and a public exploit is available, though active exploitation has not been confirmed by CISA KEV.
We need to output a JSON with fields as instructed. We must synthesize data from multiple intelligence sources about CVE-2025-15140. First, parse the given info: CVE ID: CVE-2025-15140 Description: A vulnerability was found in saiftheboss7 onlinemcqexam up to 0e56806132971e49721db3ef01868098c7b42ada. It affects unknown code of file /admin/quesadd.php. Manipulation of argument ans1/ans2 results in sql injection. Attack can be carried out remotely. Exploit has been made public. Product adopts rolling release. Vendor did not respond. CVSS Score: 5.5 (CVSS 4.0) CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), generic) Just CWE-74, not CWE-89 specifically, but it's sql injection so fits. EPSS: 0.04% (percentile 14%) Tags: SQLi, PHP References: - https://github.com/Anti1i/cve/issues/4 - https://vuldb.com/?ctiid.338518 - https://vuldb.com/?id.338518 - https://vuldb.com/?submit.715219 - https://vuldb.com/?submit.715463 No KEV, no patch info explicitly. Product: saiftheboss7 onlinemcqexam, a PHP web application for online MCQ exams. The vulnerability is SQL injection via ans1/ans2 parameters in /admin/quesadd.php. The description says "Attack is possible to be carried out remotely." and "Exploit has been made public". So summary: An SQL injection vulnerability in saiftheboss7 onlinemcqexam's admin question addition endpoint allows remote attackers to manipulate ans1/ans2 parameters, potentially extracting or modifying database data. The exploit is public. The product's rolling release means any deployment after commit 0e56806132971e49721db3ef01868098c7b42ada is vulnerable, no fixed version since vendor unresponsive. Technical context: The vulnerability is an SQL injection (CWE-74 injection), in a PHP application using a MySQL-like database. The /admin/quesadd.php endpoint takes ans1 and ans2 parameters without prop
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
We need to generate a JSON object based on the provided CVE data. We must follow all instructions precisely. Let's extract data: - CVE ID: CVE-2025-15126 - Description: "A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way." - CVSS Score: 1.3 (CVSS 4.0 base score? Actually it says CVSS Score: 1.3, CVSS Vector: CVSS:4.0/... so it's a 4.0 score). The vector: AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/... That means: Attack Vector: Network, Attack Complexity: High, Attack Requirements: None, Privileges Required: Low, User Interaction: None, Confidentiality: Low, Integrity: None, Availability: None, no scope change, Exploit maturity: Proof-of-Concept. - CWE: CWE-266 (Incorrect Privilege Assignment) - EPSS Score: 0.04% (percentile 11%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:* - Tags: Information Disclosure, Jeecg Boot - References: - github.com/Hwwg/cve/issues/39 (exploit) - vuldb.com/?ctiid.338504 - vuldb.com/?id.338504 - vuldb.com/?submit.711782 (exploit) Now, we need to synthesize all this into a thorough analysis. The description says "manipulation of the argument positionId causes improper authorization" - CWE-266. So it's like an IDOR or authorization bypass allowing maybe unauthorized access to user list? The function name getPositionUserList suggests retrieving user list for a position, and improper authorization on positionId could allow a low-privileged user to see others' data. CVSS: Confidentiality Low, no other impact. The CVSS vector is 4.0, so we need to assess ourselves using 3.1 and 4.0 vectors consistent with our own assessment. The provided vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So we need to map that to 3.1 metrics: AV:N, AC:H, PR:L, UI:N, S:U, C:L, I:N, A:N. That would be CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. But the instructions say: "assessed_cvss_vector: Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we should confirm that this matches our assessment. Description: "remote attack ... complexity high ... exploitation difficult ... improper authorization ... manipulate argument positionId ..." So indeed, remote, needs authentication? The CVSS says PR:L, so low privileges. No user interaction. Impact: only confidential info (low). So we can generate that vector. For 4.0, we'll also produce a vector consistent with that, but note that the provided one already has AT:N (Attack Requirements None), so we can just reuse that. However, we should add exploit maturity? The instruction says "base vector" only, not including temporal/environmental. So we'll just output the base vector without E/X/etc. So for 4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. That matches the provided one stripped of temporal. For 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. Now, for fields: product_name: "JeecgBoot" (it's 1-3 words, the product name is JeecgBoot, Jeecg Boot). So "JeecgBoot" or "Jeecg Boot"? In description "JeecgBoot" so I'll use "JeecgBoot". summary: Must be original synthesis, not copy description. Start with impact verb. So: "Improper authorization in JeecgBoot up to 3.9.0 allows authenticated low-privileged attackers to access position-based user lists by manipulating the positionId parameter. The vulnerability in the getPositionUserList endpoint exposes potentially sensitive user data. Exploit code is publicly available, though attack complexity is high." Make sure not to start with "A vulnerability". That's fine. Mention that exploit is public, POC exists. EPSS low (0.04%) but not notable. No KEV mention. So summary: "Improper authorization in JeecgBoot versions up to 3.9.0 allows low-privileged remote attackers to enumerate position-associated user data via crafted positionId parameter manipulation on the /sys/position/getPositionUserList endpoint. The issue exposes limited confidential information, and publicly available exploit code exists, although exploitation requires high attack complexity." That's good. technical_context: Explain underlying technology: JeecgBoot is a Java-based low-code development platform. The CWE-266 Incorrect Privilege Assignment means the authorization check for the positionId parameter is flawed. The /sys/position/getPositionUserList endpoint likely returns list of users belonging to a specific position, and without proper verification, a user could query positions they shouldn't have access to. CPE indicates product: jeecg:jeecg_boot. So I'll write something educational: "JeecgBoot is an open-source low-code Java development platform. The flawed endpoint /sys/position/getPositionUserList is designed to return user lists for a given position. Under CWE-266, incorrect privilege assignment stems from missing or insufficient authorization checks on the positionId parameter, enabling an authenticated user with minimal privileges to access user data associated with arbitrary positions. This is a classic IDOR (Insecure Direct Object Reference) variant where the parameter lacks proper ownership validation." risk_assessment: Need to combine signals: CVSS 4.0 score 1.3 (very low), but that's due to high attack complexity and only low confidentiality impact. EPSS 0.04% (low exploitation likelihood). KEV: no, not in KEV. POC: publicly available. SSVC: Exploitation: public PoC (but no active exploitation). Automatable: high complexity makes automation unlikely. Technical Impact: low (confidentiality, no integrity/availability). So real-world priority is low despite public exploit. Contrast: "CVSS indicates network attack vector but high complexity, requiring attacker to already have low-privileged account. EPSS score is low (0.04%), suggesting limited exploitation probability. No active exploitation reported. Public exploit code exists but is not easily weaponized due to difficulty." That covers. Also note missing vendor response. affected_products: Write paragraph: "JeecgBoot versions up to 3.9.0 are affected, as per CPE cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*. The vendor has not responded to disclosure, and no official advisory or patch version is available. Reference: (provide links from references) https://vuldb.com/?id.338504 and the GitHub issue link https://github.com/Hwwg/cve/issues/39." Actually the description says "up to 3.9.0", so version range all versions through 3.9.0. remediation: Primary fix? No patch available, vendor hasn't responded. So suggest compensating controls: "No vendor-released patch is available; the vendor has not responded to disclosure. As a mitigation, restrict access to the /sys/position/getPositionUserList endpoint to authorized users only via web application firewall rules or reverse proxy, or disable the feature if not needed. Implement strict authorization checks on positionId to ensure users can only query their own positions. Contact JeecgBoot developers for an official fix." Since patch is not available, say "No vendor-released patch identified at time of analysis". Then suggest workarounds. exploit_scenario: Realistic attack scenario: "An authenticated attacker with standard user privileges sends crafted requests to /sys/position/getPositionUserList with arbitrary positionId values, potentially enumerating user lists across different organizational positions. This could leak sensitive organizational structure information and user associations, although exploitation is difficult due to required knowledge of valid position IDs." exploitation_conditions: Must be specific prerequisites. The description says: function getPositionUserList of /sys/position/getPositionUserList, argument positionId. So conditions: "The attacker must be authenticated with at least low-level user privileges (PR:L). The target must have the /sys/position/getPositionUserList endpoint accessible. The attacker must be able to manipulate the positionId parameter. No default configuration changes are required; the vulnerability is inherent in the function's authorization logic. High attack complexity arises from the need to guess or know valid position IDs to enumerate users, but these may be predictable or brute-forceable." Note that the CVSS says AC:H, so we can mention that it's not trivial. No user interaction required. attack_chain: Steps: "Access authenticated session as low-privileged user → Enumerate or guess valid position IDs → Send crafted request to /sys/position/getPositionUserList with target positionId → Exfiltrate user list data associated with that position." That's 3-4 steps. I'll use 4-step: Access → Delivery → Exploit → Impact? More like: "Authenticate as low-privileged user → Identify valid positionId values → Send manipulated request to getPositionUserList → Retrieve confined user data." So: "Authenticate with low privileges → Discover or brute-force valid positionId values → Send crafted HTTP request to /sys/position/getPositionUserList → Receive user list data associated with targeted position." That's 4 steps. Good. confidence_notes: "Public exploit code available (GitHub issue). Vendor unresponsive; no official fix confirmed. CVSS and CWE assigned by VulDB. EPSS data sourced from FIRST. Affected version range inferred from description and CPE. No active exploitation confirmed." That's specific. Forbidden generic phrases: Avoid "analysis based on available data" – I'll state exactly what is confirmed and missing. prevalence: JeecgBoot is an open-source low-code platform, likely used but not as widespread as major frameworks. I'd say "medium" – it's a commonly used Java low-code tool, but not ubiquitous like Spring. Anchors: medium "common but not everywhere". Prevalence basis: "open-source Java low-code platform with moderate enterprise adoption". So "medium". prevalence_basis: "open-source Java low-code platform with moderate enterprise adoption" within 12 words. assessed_cvss_vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N assessed_cvss_rationale: "Requires low-privileged account and high attack complexity to guess position IDs; only low confidentiality impact." (within 25 words). That justifies AC:H, C:L. assessed_cvss40_vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (no temporal). Now construct JSON. All fields must be plain text strings. No markdown. Ensure I don't use prohibited phrases. Product_name: "JeecgBoot". Summary not starting with A vulnerability etc. Technical_context: explain CWE-266, etc. Risk_assessment: mention all signals. Affected_products: paragraph with links. Remediation: no patch, suggest mitigations. Exploit_scenario: realistic. Exploitation_conditions: specific. Attack_chain: steps separated by ' → '. Confidence_notes: specific. Prevalence and basis: "medium" and justification. Check exploitation conditions: "FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" So I need to avoid those. I will list the exact prerequisites: authenticated as low-privileged user, accessible endpoint, ability to manipulate positionId. I'll note that no special configuration is required beyond the existence of the feature. That is specific. I'll
Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active
Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.
Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.
Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.
Authentication bypass in TaleLin Lin-CMS up to version 0.6.0 allows remote attackers to manipulate username and password arguments in the /tests/config.py Tests Folder component, potentially exposing credentials stored in the configuration file. The attack requires high complexity and has been publicly disclosed, but exploitation is considered difficult with an EPSS score of 0.04% indicating very low real-world exploitation probability.
Improper authentication bypass in xiaozhi-esp32-server-java up to version 3.0.0 allows remote attackers with low-privilege access to bypass cookie-based authentication via crafted requests. A public exploit exists, but no active exploitation has been confirmed, and the exploitation probability is low (EPSS 0.10%). The vulnerability affects the tryAuthenticateWithCookies method in the AuthenticationInterceptor component.
Denial of service in OMEC UPF v2.1.3-dev and earlier allows remote attackers with low privileges to crash the user plane function via a crafted PFCP Session Establishment Request. Public exploit code exists, but the low EPSS score (0.06%) and required authentication limit immediate risk. No active exploitation has been confirmed.
Code injection in ChenJinchuang Lin-CMS-TP5 up to 0.3.3 allows authenticated low-privileged attackers to execute arbitrary code remotely. The flaw resides in the file upload handler
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Stored cross-site scripting (XSS) in yourmaileyes MOOC up to version 1.17 allows an authenticated attacker to inject malicious scripts via the 'review' parameter of the submission review feature, which executes when another user views the content. The vulnerability has a publicly released exploit, but no patch is available, and EPSS indicates very low exploitation probability (0.04%). This poses a low real-world risk due to limited impact and niche adoption.
We need to produce a JSON analysis for CVE-2025-15149. Let's gather all data from input. Input: CVE ID: CVE-2025-15149 Description: A vulnerability has been found in rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded. Affected by this vulnerability is the function updateProductServlet of the file src/servlet/product/updateProductServlet.java of the component Add New Product Page. The manipulation of the argument productName leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 1.9 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-79 EPSS Score: 0.04% (percentile 11%) Reported by: cna@vuldb.com Tags: Java, XSS References: https://github.com/zyhzheng500-maker/cve/blob/main/%E5%AD%98%E5%82%A8%E5%9E%8BXss.md https://vuldb.com/?ctiid.338526 https://vuldb.com/?id.338526 https://vuldb.com/?submit.716583 Product: rawchen ecms. The description says "rawchen ecms up to b59d7feaa9094234e8aa6c8c6b290621ca575ded". That's a commit hash, likely from a Git repository. The product uses rolling release so no versions. So product_name: "ecms" maybe? The product is "rawchen ecms". I'll say "ecms" because rawchen is the vendor. But the instruction: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." So product name is "ecms" possibly. But "ecms" might be too generic. The full name in description is "rawchen ecms". So I'll say "rawchen ecms" as 2 words. That's specific. So product_name: "rawchen ecms". Summary: 2-3 sentence plain-language. Not copy description. Synthesize all data: XSS vulnerability in rawchen ecms's Add New Product page, allowing remote attackers with high privileges (PR:H) to inject scripts via productName parameter, potentially leading to client-side code execution. Exploit publicly disclosed, but EPSS low (0.04%). No KEV. Rolling release, no fixed version. So summary: "A cross-site scripting (XSS) vulnerability in the Add New Product page of rawchen ecms allows remote attackers with high privileges to inject arbitrary web script via the productName parameter, potentially compromising user sessions. The exploit has been publicly disclosed, but active exploitation is not confirmed and EPSS indicates low likelihood of widespread exploitation." That captures what attacker can do, product, version type, EPSS. Technical context: Explain underlying technology. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The file src/servlet/product/updateProductServlet.java, function updateProductServlet, likely a Java servlet handling product updates. The productName argument is not sanitized, leading to stored or reflected XSS. Mention Java servlet, web application. CPE data not provided, so rely on description. Mention it's a rolling release, commit hash up to that point. Risk assessment: Use CVSS vector: 4.0 base score 1.9 (very low). Vector: AV:N (network), AC:L (low complexity), AT:N (none), PR:H (high privileges required), UI:P (user interaction passive), VC:N, VI:L, VA:N, SC:N, SI:N, SA:N. So high privileges, user interaction passive (likely victim must view page with injected script). Impact low integrity to vulnerable component (VI:L), no confidentiality/availability. EPSS 0.04% very low. No KEV. POC publicly disclosed (exploit has been disclosed). So risk is low despite remote network vector because requires authentication and passive user interaction, and only partial integrity impact. Likely low priority. But mention that CVSS base score is low, and EPSS confirms low exploitation probability. So real-world risk is low, more of a nuisance. Will flag that CVSS vector indicates high privileges (PR:H), so only authenticated administrators or product managers could inject script, and another user must view it. So it's a self-XSS or targeted? Likely stored XSS in product name field that affects other users viewing products. Still low. Affected products: rawchen ecms, all versions up to commit b59d7feaa9094234e8aa6c8c6b290621ca575ded. Since rolling release, no version numbers. References: github link with detailed description (XSS). So I'll say: "rawchen ecms (rolling release) up to commit b59d7feaa9094234e8aa6c8c6b290621ca575ded. No fixed version identified. The vulnerability is described in a GitHub write-up (https://github.com/zyhzheng500-maker/cve/blob/main/%E5%AD%98%E5%82%A8%E5%9E%8BXss.md) and a VulDB entry (https://vuldb.com/?id.338526)." Remediation: No patch. Vendor unresponsive. Since it's rolling release, maybe they'll fix in a later commit. No advisory URL. Compensation: Implement input validation and output encoding on productName field. For web application firewall rule to block script tags in product Name. Or disable the Add New Product functionality for untrusted users. But PR:H, so only high privilege users can exploit; restrict such users further. Actually the vulnerability allows high privilege user to inject script that may affect lower-privilege users viewing the product page. So the immediate threat is from malicious insiders with administrative access. Mitigation: Ensure product names are properly sanitized and encoded. If using a template engine, auto-escape. The specific fix would be in updateProductServlet. So I'll say: "Upgrade to a commit newer than the affected hash if available; the project uses rolling releases so monitor for a fix. As a workaround, implement output encoding for productName in the product listing pages and apply input validation to reject HTML/script tags. Limit the Add New Product functionality to trusted administrators only, but given PR:H this is already required." Exploit scenario: An attacker with administrative access to the ecms admin panel logs in, navigates to Add New Product page, and injects a malicious script in the productName field. When other users (e.g., customers) view the product catalog, the script executes, stealing session cookies or performing actions on their behalf. Publicly disclosed exploit exists (the github link). Attack vector network, so remote admin. Exploitation conditions: The attacker must have high privileges (PR:H) to access the Add New Product page. The victim must view the product page containing the injected script (UI:P). No other conditions like specific configuration, the 'Add New Product' page is the feature. Attack chain: I'll provide a chain: Admin access to ecms dashboard → Navigate to Add New Product page → Submit crafted product name with XSS payload → Victim views product page → Script executes in victim's browser. So: "Authenticate with high-privilege credentials → Access Add New Product form → Insert XSS payload in productName field → Victim views product listing → Payload executes in victim's session". That's 5 steps. Confidence notes: The vulnerability is confirmed by VulDB and a public exploit write-up. The vendor did not respond, so patch status is unconfirmed. CVSS vector provided by VulDB (CVSS 4.0). Active exploitation not confirmed. EPSS based on limited data. No CISA KEV listing. Prevalence: rawchen ecms is a niche open-source CMS, probably not widely deployed. So prevalence: low. Prevalence_basis: "niche open-source CMS, limited adoption". Assessed CVSS vector: I need my own CVSS 3.1. Given description: remote exploitation, high privileges required, user interaction passive, only integrity impact (VI:L). So CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N. Note: Scope changed? The vulnerable component is the web application (servlet) and the impacted component is the victim's browser? In CVSS 3.1, stored XSS often uses Scope Changed (S:C) because the vulnerable component is the server but the impact is on the user's browser, which is a different security scope. CVSS 4.0 uses separate vulnerable/impacted metrics. In the provided 4.0 vector, they set VC:N/VI:L/VA:N and SC:N/SI:N/SA:N, meaning no scope change, just vulnerable component integrity low. But typical XSS would have scope changed. However, they set SC:N, so they assessed that the vulnerable component and impacted component are the same (both the web application itself). That seems wrong for stored XSS, but it's possible if the XSS only affects the admin's own session? It's ambiguous. The description says cross site scripting, which typically has scope change. I'll assess S:C, C:N, I:L, A:N. So CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N. Rationale: "High privileges required for injection; user interaction required for payload execution; scope changed due to impact on client browser." Assessed CVSS 4.0: I'll convert: AV:N, AC:L, AT:N (none), PR:H, UI:P (passive), then vulnerable system: VC:N, VI:L, VA:N (since low integrity on vulnerable system? Actually vulnerable component is the server, but with stored XSS, the vulnerable component is the server, the subsequent system is the browser. But my 3.1 scope changed means I consider the server vulnerability (VI:L on server?) Actually, with stored XSS, the server stores the script, and the impact is on the user's browser (confidentiality and integrity). CVSS 3.1 scope changed: C/I/A on the impacted component (browser). So CVSS 3.1: C:N, I:L, A:N for impacted component? But the 3.1 vector can only have one set of C/I/A. With scope changed, the metrics are for the impacted component (browser). So I set C:N, I:L, A:N because the script can modify the page (integrity) but not necessarily steal data directly? Actually XSS can steal cookies, session tokens (confidentiality). But if the product only reflects the name, it might be low. I'll set C:N because description doesn't explicitly mention data theft; just cross site scripting, often low impact. But CVE description just says cross site scripting, not stored, maybe reflected. The file is updateProductServlet, it's likely stored (updating a product). So stored XSS can have higher impact. I'll be conservative and set C:L (confidentiality low) as well? I need to pick one. The given CVSS 4.0 vector had VC:N, VI:L, meaning vulnerable component (server) integrity low, and confidentiality/availability none. That doesn't capture client impact. Probably the assessor considered it self-XSS or no scope change. I'll stick with my analysis: scope changed, and the impacted component (browser) confidentiality could be low (if script can steal cookies). So CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. That's balanced. Rationale: "Requires admin privileges and user interaction; stored XSS impacts client confidentiality/integrity." I'll use that. For CVSS 4.0, I'll map: AV:N, AC:L, AT:N, PR:H, UI:P, then VC:N (vulnerable system integrity not directly affected, only stores? Actually vulnerable system stores malicious input, not integrity impact on server? Maybe VI:N, but the server's data (product name) is changed but that
Information disclosure in Halo up to 2.21.10 can be triggered by a remote attacker with low privileges via high-complexity manipulation of the /actuator configuration handler, potentially leaking limited configuration data. Public exploit code exists, but active exploitation has not been confirmed and EPSS indicates a negligible exploitation probability (0.03%). The low CVSS 4.0 score and high attack complexity further reduce the real-world