Race condition in the Purchase Request Handler of PHPEMS up to version 11.0 allows remote attackers to corrupt purchase data integrity under precise timing conditions. Exploitation requires high complexity and many attempts, with limited impact on information disclosure. A public proof-of-concept is available, but no active exploitation has been confirmed.
OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.
Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the `cmd` parameter of the `/msp_info.htm?flag=cmd` web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows remote attackers to inject malicious scripts via the LoginController initialization function, requiring user interaction to execute. The vulnerability has a public exploit available but represents low real-world risk due to CVSS 2.1 score, minimal EPSS exploitation probability (0.04%), and the requirement for user click-through. The vendor has not responded to early disclosure through a GitHub issue.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Stored cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows low-privileged authenticated attackers to inject JavaScript payloads via the doMachineList or doPodList functions. The vulnerability has a publicly available exploit but is not known to be actively exploited, and the EPSS likelihood is very low (0.06%). Affected users should restrict access and apply input sanitization until a vendor patch is released.
Unrestricted file upload in newbee-mall-plus 2.0.0 permits authenticated high-privilege users to submit arbitrary files through the Product Information Edit Page, bypassing server-side file type validation in UploadController.java. The affected CPE is cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*, and a public proof-of-concept has been disclosed via GitHub. No patch is available at time of analysis, as the vendor did not respond to responsible disclosure; however, EPSS at 0.05% (17th percentile) and the PR:H CVSS requirement together indicate low observed exploitation probability despite POC existence.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
Open redirect vulnerability in Edimax BR-6208AC firmware versions 1.02 and 1.03 allows authenticated remote attackers to redirect users to arbitrary websites via manipulation of the wlan-url parameter in the formALGSetup web interface function. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, resulting in limited integrity impact. Public exploit code is available, but the device has reached end-of-life status with no further firmware updates planned by Edimax.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 affects the index function of AppDataMigrateController, allowing remote attackers to inject arbitrary web scripts. Exploit code is publicly available, but no vendor patch has been released. EPSS indicates low exploitation probability (0.03%), and the vulnerability requires authentication and user interaction.
Stored cross-site scripting (XSS) in Campcodes Park Ticketing System 1.0 allows high-privileged users to inject malicious scripts via the name/ride parameter in the save_pricing function of admin_class.php, affecting user sessions with user interaction. Publicly available exploit code exists, though EPSS scoring (0.02%) and high privilege requirement (PR:H) suggest limited real-world exploitation likelihood despite the low CVSS score of 1.9.
Race condition in PHPEMS Coupon Handler component up to version 11.0 allows authenticated remote attackers to manipulate coupon processing logic, potentially resulting in integrity compromise. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation despite publicly available proof-of-concept code. EPSS score of 0.04% indicates low real-world exploitation probability despite public POC availability.
Authenticated high-privilege users can exploit missing authorization checks in the Automattic Crowdsignal Forms plugin for WordPress (versions <= 1.7.2) to perform unauthorized data modifications or service disruptions, leading to low integrity and availability impacts. The vulnerability carries a CVSS base score of 3.8, a very low EPSS exploitation probability (0.03%), and there is no evidence of active exploitation or public exploit code.
Deserialization vulnerability in aizuda snail-job up to version 1.7.0 on macOS allows remote attackers with low privileges to execute arbitrary code by supplying malicious serialized data to the argsStr argument of the FurySerializer.deserialize function. Public exploit code is available, though no active exploitation has been confirmed at the time of analysis.
Credential leakage in the Ruby URI gem's `+` operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in `URI#join` and `URI#merge` but left `URI#+` unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using `+` are concretely at risk of sending those credentials to attacker-controlled hosts.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
Open redirect vulnerability in CloudPanel Community Edition up to version 2.5.1 allows authenticated attackers with user interaction to redirect users to arbitrary external websites via a malicious Referer header in the /admin/users endpoint. The vulnerability carries a CVSS 2.0 score with low severity impact, EPSS exploitation probability of 0.04%, publicly available exploit code, and vendor-confirmed patch in version 2.5.2.
Stored or reflected cross-site scripting in sunhailin12315/product-review allows authenticated users to inject malicious JavaScript via the content parameter in the Write a Review component, which executes in other users' browsers when they view the review. Exploitation requires valid user credentials and victim interaction with the malicious review content. Public proof-of-concept code exists, but EPSS exploitation probability remains at 0.04%, indicating minimal real-world targeting despite the attack surface.
Remote deserialization in Dromara Sa-Token up to version 1.44.0 allows low-privileged authenticated attackers to transmit maliciously crafted serialized Java objects, potentially leading to limited data tampering or availability impacts. Exploitation is difficult (high complexity), and public exploit code exists, but EPSS score of 0.06% indicates low real-world exploitation likelihood. No active exploitation or CISA KEV listing has been confirmed.