SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the chkId[] parameter in /admin/view_products.php, potentially leading to data exposure, modification, or service disruption. The vulnerability has publicly available exploit code and a low EPSS score (0.04%), with no indication of active exploitation.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtAreaCode parameter in /admin/add_area.php. A public exploit is available, but no active exploitation in CISA KEV and EPSS probability is very low (0.04%). Attackers can extract or modify database contents with low impact to confidentiality, integrity, and availability per CVSS.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
Sensitive information disclosure in Gmission Web Fax 3.0 (before 3.0.1) enables a locally authenticated low-privileged user to access protected fax data without proper authorization. The root cause is missing authorization checks (CWE-200) that can be abused by an authenticated local actor to read confidential information beyond their intended access scope. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Stored cross-site scripting (XSS) in WordPress Custom Field Template plugin through version 2.7.7 allows authenticated users to inject malicious scripts that execute in the browsers of other users who view affected content, potentially compromising site security and user data. The vulnerability has an EPSS score of 0.04% (14th percentile), indicating low real-world exploitation probability despite the high-impact nature of stored XSS on WordPress sites.
DOM-based cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin through version 3.5.16 allows attackers to inject malicious scripts into the search interface that execute in users' browsers. The vulnerability affects the plugin's web page generation when processing search input, enabling attackers to steal session tokens, redirect users, or perform actions on behalf of authenticated users without requiring authentication themselves. No CVSS score was available at analysis time, but the low EPSS score (0.04%, 14th percentile) suggests limited real-world exploitation likelihood despite the XSS vector.
Stored cross-site scripting (XSS) in codeaffairs Wp Text Slider Widget plugin for WordPress versions 1.0 and earlier enables authenticated attackers to inject malicious scripts that execute in the browsers of site administrators and other users. The vulnerability arises from improper input sanitization during widget configuration, allowing persistent code injection through the plugin's admin interface.
Missing authorization in Crocoblock JetBlog plugin versions up to 2.4.7 allows unauthenticated attackers to exploit incorrectly configured access control, potentially bypassing intended security restrictions on blog content and administrative functions. The vulnerability stems from broken access control mechanisms that fail to properly validate user permissions before granting access to sensitive operations, with an EPSS score of 0.04% indicating low real-world exploitation probability despite the authorization defect.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
Server-Side Request Forgery (SSRF) in WordPress Image Shrinker plugin versions up to 1.1.0 enables unauthenticated remote attackers to forge requests from the affected server to internal or external resources, potentially exposing sensitive data or enabling lateral movement within network infrastructure. The vulnerability has extremely low exploitation probability (EPSS 0.04th percentile) and no public exploit code identified, suggesting limited real-world threat despite the technical severity of SSRF vulnerabilities.
Authorization Bypass in Crocoblock JetPopup WordPress plugin through version 2.0.20.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to protected popup content and functionality. EPSS score of 0.04% indicates low exploitation probability despite the authorization flaw; no public exploit code or active exploitation has been identified.