Arbitrary JavaScript execution in the mathjs (npm) expression parser lets an attacker who can submit expressions escape the math sandbox and run code in the host JavaScript runtime. It affects mathjs versions >= 13.1.1 and < 15.2.0 and stems from an unsafe object/array property setter that failed to block dangerous properties. Publicly available exploit code exists (a proof-of-concept gist), but there is no evidence of active exploitation; EPSS is only 0.05% (16th percentile), consistent with the CISA SSVC exploitation status of 'none'.
Unauthenticated information disclosure (IDOR) in the My Calendar WordPress plugin (versions ≤ 3.7.6) lets remote attackers read calendar events-including private and hidden ones-from any sub-site on a WordPress Multisite network by injecting an arbitrary site ID into the unauthenticated mcjs_action AJAX endpoint. On Single Site installations the same request triggers an uncaught fatal error, giving an unauthenticated denial-of-service vector. Publicly available exploit code exists, though EPSS remains very low (0.01%) and the flaw is not in CISA KEV. Fixed in version 3.7.7.
In products of the MSE6 product-family by Festo a remote authenticated, low privileged attacker could use functions of undocumented test mode which could lead to a complete loss of confidentiality,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in Livemesh Addons for Elementor (WordPress plugin) ≤9.0 allows authenticated attackers with Contributor-level privileges to include and execute arbitrary PHP files via recursive directory traversal bypass in widget template parameters. The vulnerability requires Elementor plugin installation and either admin interaction (social engineering) or direct Contributor access. CVSS 8.8 reflects high impact (RCE potential) but limited by authentication requirement. No active exploitation confirmed (not in CISA KEV), but publicly available exploit code exists (Wordfence disclosure with technical details and code references).
Arbitrary file write and deletion in the go-acme/lego ACME client (versions before 4.34.0) allows a malicious or compromised ACME server to escape the configured webroot via path traversal. When lego solves an HTTP-01 challenge with the webroot provider, it writes the key authorization to a path built by directly concatenating the server-supplied challenge token; a token containing '../' sequences (e.g. '../../../../tmp/pwned') redirects the write - and the corresponding CleanUp() delete - to any location writable by the lego process, up to remote code execution if lego runs as root. Publicly available exploit code exists (SSVC 'poc'), but the EPSS score is very low (0.05%, 14th percentile), consistent with the requirement that the victim first point lego at an attacker-controlled ACME server.
Cross-Site Request Forgery (CSRF) in Career Section WordPress plugin versions ≤1.6 enables unauthenticated attackers to delete arbitrary server files through social engineering. Attackers trick authenticated WordPress administrators into clicking malicious links that exploit missing nonce validation in the delete action handler, leading to path traversal and unrestricted file deletion. CVSS 8.8 (High) with network attack vector but requires user interaction (UI:R). EPSS and KEV data not provided; public exploit code status unknown. Wordfence advisory and upstream patch commit available.
Privilege escalation in AcyMailing WordPress plugin (versions 9.11.0-10.8.1) allows authenticated Subscriber-level users to gain administrator access through a multi-stage attack chain. Attackers exploit a missing capability check in the wp_ajax_acymailing_router AJAX handler to access admin-only configuration controllers, enable autologin features, inject malicious cms_id values into newsletter subscribers, and authenticate as any WordPress user including administrators. EPSS data not available; no confirmed active exploitation (CISA KEV absent), but the low attack complexity (AC:L) and detailed public code references increase exploitation risk for installations with subscriber registration enabled.
Remote command injection in OpenHarness gateway handler allows authenticated remote chat users to execute administrative commands like /permissions full_auto without authorization, escalating privileges to modify security controls of running instances. Vulnerability exploits insufficient command validation in chat interface. Fixed in commit dd1d235. CVSS 8.7 (High) with network attack vector and low complexity. EPSS data unavailable; not listed in CISA KEV. VulnCheck advisory and GitHub patch available.
Denial of service in mcp-framework (npm) versions <= 0.2.21 lets a remote unauthenticated attacker crash any server using the HttpStreamTransport by sending a single oversized HTTP POST to /mcp, exhausting memory. The readRequestBody() function concatenates request-body chunks into a string with no cap, and although a 4MB maxMessageSize config value exists it is never enforced. Publicly available exploit code exists (SSVC 'poc'), a vendor patch shipped in 0.2.22, and EPSS is low (0.14%, 34th percentile).
Privilege escalation in Microchip IStaX before 2026.03 allows an authenticated low-privileged web user to derive the shared per-device cookie secret directly from their own webstax_auth session cookie and mint a forged cookie granting full administrative access. Because the secret is common to the device rather than per-user and can be reconstructed from an already-issued cookie, any account holder can self-elevate to admin. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%), but the technical impact is total.
Authenticated SQL injection in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below lets an attacker with valid datasource credentials achieve full read and write access to a connected database via the /de2api/datasetData/previewSql endpoint. User-supplied SQL is wrapped in a subquery without enforcing a single SELECT, and a JDBC blocklist bypass re-enables allowMultiQueries=true, allowing stacked statements such as UPDATE. Publicly available exploit code exists (SSVC: PoC), but EPSS is only 0.03% and it is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
SQL injection in DataEase, the open-source data visualization and analytics platform, allows an authenticated user to execute arbitrary SQL through the API datasource save workflow in all versions up to and including 2.10.20. The flaw stems from the Base64-encoded 'deTableName' value being spliced into a DDL statement via unsanitized string replacement, letting an attacker break out of identifier quoting to run error-based injection that leaks backend database details such as the MySQL version. SSVC rates the technical impact as total and automatable, though publicly available exploit code exists only as a proof of concept and EPSS remains very low (0.03%); the issue is fixed in 2.10.21.
SQL injection in DataEase, an open-source data visualization and analytics platform, lets an authenticated user inject arbitrary SQL via the sort parameter of the datasetData enum-value endpoint, achieving time-based blind SQL injection against the backing database. All versions 2.10.20 and below are affected, with a total-impact potential to read, alter, or disrupt data. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and it is not listed in CISA KEV, but the technical impact is rated total.
SQL injection in DataEase, an open-source data visualization and analytics platform, allows an authenticated user to inject arbitrary SQL through the orderDirection sorting parameter on dataset endpoints (/de2api/datasetData/enumValueDs and /de2api/datasetTree/exportDataset) in versions 2.10.20 and below. Because the Order2SQLObj class places the raw value directly into the ORDER BY clause via StringTemplate with no whitelist, an attacker can perform time-based blind data extraction and denial of service. Publicly available exploit code exists (SSVC exploitation: poc); it is not in CISA KEV and the EPSS probability is very low (0.03%). Fixed in version 2.10.21.
SQL injection in DataEase's dataset export endpoint (POST /de2api/datasetTree/exportDataset) lets an authenticated attacker inject arbitrary SQL through the expressionTree parameter in versions 2.10.20 and below. User-controlled values in 'like' filter terms are concatenated unsanitized into SQL during filter-tree translation, enabling blind, time-based extraction of database contents. Publicly available exploit code exists (SSVC: poc); EPSS is low (0.03%, 8th percentile) and the flaw is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.
CRLF Injection in Openfind MailGates/MailAudit allows remote unauthenticated attackers to read arbitrary system files via HTTP header manipulation. Affects MailGates/MailAudit versions 5.0-6.0 (prior to 5.2.10.099 and 6.1.10.054 respectively). CVSS 8.7 with network vector, low complexity, and no authentication required indicates critical real-world risk. Taiwan CERT advisory published; no CISA KEV listing or public exploit code identified at time of analysis, suggesting early disclosure phase.
Remote denial of service in moby/spdystream (Go SPDY/3 library) versions <= v0.5.0 allows an unauthenticated remote peer to crash any service that accepts SPDY connections. By sending a small number of malformed control frames whose attacker-controlled 32-bit counts and lengths are used as unbounded allocation sizes, an attacker forces the process to allocate gigabytes of memory and hit an out-of-memory crash. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the flaw is trivially automatable and reaches container-platform components (advisory titled 'DOS on CRI'), so patched v0.5.1 should be adopted where SPDY is exposed.
SQL injection in DataEase, the open-source data visualization and analytics platform, lets an authenticated attacker execute arbitrary SQL commands via the /datasource/getTableField endpoint in versions 2.10.20 and earlier. The getTableFiledSql method in CalciteProvider.java concatenates the tableName parameter into a query using String.format without parameterization, and the existing table-name validation is bypassed by registering an API datasource with a malicious deTableName that getTables returns as legitimate. Publicly available exploit code exists per the SSVC assessment, though EPSS remains very low (0.03%, 8th percentile) and it is not in CISA KEV; it is one of a cluster of SQLi issues patched together in 2.10.21.
SQL injection in DataEase (versions ≤ 2.10.20) lets an authenticated user run arbitrary SQL against the backing database through the API datasource update endpoint. The attacker-controlled deTableName field is dropped into a CREATE TABLE statement without escaping, yielding error-based injection that can extract database contents. A proof-of-concept is indicated by CISA SSVC, though EPSS remains very low (0.03%) and it is not on CISA KEV; fixed in 2.10.21.
Authentication bypass in Cloud Foundry UAA allows remote unauthenticated attackers to obtain access tokens for arbitrary users when SAML 2.0 bearer assertions are enabled, leading to unauthorized access to all UAA-protected systems. Affects UAA versions 77.30.0 through 78.7.0 and CF Deployment versions 48.7.0 through 54.14.0. The vulnerability stems from acceptance of unsigned and unencrypted SAML 2.0 assertions (CWE-290: Authentication Bypass by Spoofing), enabling complete authentication mechanism bypass with network access and low attack complexity (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). No public exploit identified at time of analysis, but the technical details disclosed in the vendor blog create high weaponization potential.
Arbitrary server-side file deletion in SiYuan (b3log/SiYuan) versions 3.6.3 and prior lets a low-privileged actor with access to the /api/av/removeUnusedAttributeView endpoint - such as a Reader-role or publish context - supply an id parameter containing ../ sequences to escape the storage/av directory and delete any .json file on the server, including conf/conf.json and workspace metadata. The GitHub Security Advisory (GHSA-vw86-c94w-v3x4) includes step-by-step reproduction, so publicly available exploit code exists, but there is no public exploit identified as weaponized and SSVC exploitation status is 'none'; EPSS is low at 0.06%. Fixed in version 3.6.4.
Sandbox escape leading to arbitrary local code execution affects Snowflake Cortex Code CLI (an AI coding agent) in all versions prior to 1.0.25. Because the CLI improperly validates bash commands, an attacker who plants specially crafted content in untrusted material-such as a malicious repository-can cause the agent to run subsequent commands outside its sandbox and execute arbitrary code on the user's device without consent. No public exploit identified at time of analysis; EPSS is low (0.07%) and exploitation is non-deterministic and model-dependent, so real-world reliability is limited.
Arbitrary file read in DataEase (open-source data visualization and analytics platform) versions 2.10.20 and below lets an authenticated attacker exfiltrate sensitive files from the server host by abusing the MySQL datasource configuration. Because the Mysql class exposes an auto-generated public setter for its JDBC security blocklist (via Lombok @Data), a crafted JSON datasource payload replaces the blocklist with an empty list before validation, enabling dangerous JDBC parameters like allowLoadLocalInfile=true. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the technical chain is well-documented in the vendor GHSA advisory.
Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data.
Remote code execution in sagredo qmail before 2026.04.07 arises because the notlshosts_auto TLS-fallback feature in qmail-remote.c builds a /bin/touch shell command with the remote partner's FQDN and runs it through popen(), enabling OS command injection when that FQDN carries shell metacharacters. An operator-controlled remote mail server (or attacker able to control the MX/hostname a victim delivers to) can inject commands that execute as the qmail-remote (qmailr) user. Publicly available exploit code exists per the SSVC proof-of-concept rating, but it is not listed in CISA KEV and EPSS is very low (0.08%), indicating no evidence of widespread exploitation.
SQL injection in Zohocorp ManageEngine PAM360 (before build 8531) and Password Manager Pro (builds 8600 through 13230) lets an authenticated attacker inject arbitrary SQL through the query report module, enabling extraction and modification of privileged-vault data. Because these products are enterprise password/privileged-access managers, a successful injection can expose stored credentials and secrets for an entire environment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and a vendor patch is available.
Logic error in Luanti 5 (formerly Minetest) game engine before 5.15.2 allows malicious mods to gain unauthorized access to security-restricted APIs by intercepting mod environment setup. When any mod is designated as trusted (via secure.trusted_mods or secure.http_mods), a specially crafted mod can exploit the environment initialization sequence to receive the insecure environment or HTTP API access intended only for trusted mods. CVSS 8.1 reflects local attack vector with high complexity but no authentication required and scope change with high confidentiality/integrity/availability impact. GitHub security advisory and two fix commits confirm patch availability. No CISA KEV listing or public exploit code identified at time of analysis.
Receiver-side use-after-free in rsync 3.0.1 through 3.4.1 lets a malicious peer corrupt memory on a host running rsync with the -X (--xattrs) option. The receive_xattr function trusts an attacker-supplied length value during a qsort operation, which a malicious sender/server can abuse to crash the receiver or potentially achieve code execution; Linux hosts are vulnerable in many common configurations and non-Linux platforms more broadly. No public exploit identified at time of analysis, EPSS is very low (0.01%), and SSVC scores exploitation as none, indicating a real-but-not-urgent memory-safety bug rather than a mass-exploited threat.
Arbitrary code execution in Eaton Intelligent Power Protector (IPP) software via insecure library loading allows local authenticated attackers with low privileges to execute code with elevated integrity impact across security boundaries. Attack complexity is high, requiring the attacker to have access to the software package installation files. EPSS data unavailable; no CISA KEV listing or public POC identified at time of analysis. Eaton has released a patched version available through their download center.
Arbitrary file write in OCaml opam before 2.5.1 allows a malicious package to escape its intended installation scope: a destination filepath in a package's .install field can contain ../ sequences to reach parent directories and drop files outside the target prefix. Exploitation requires a user to install a crafted opam package, so it is a supply-chain/local vector rather than a remote one. Tracked as OSEC-2026-03 and fixed in opam 2.5.1; no public exploit identified at time of analysis and EPSS is negligible (0.01%).
Authenticated low-privileged users in wger can modify installation-wide gym configuration via /config/gym-config/edit due to missing permission enforcement, enabling vertical privilege escalation. The GymConfigUpdateView declares 'config.change_gymconfig' permission but inherits WgerFormMixin instead of WgerPermissionMixin, causing the permission check to never execute. Exploiting this allows attackers to manipulate default gym assignments affecting all users, with GymConfig.save() automatically reassigning user profiles and creating gym configurations tenant-wide. CVSS 7.6 (High) with network attack vector, low complexity, and low privileges required. No active exploitation (KEV) or public POC identified at time of analysis, though GitHub advisory provides detailed reproduction steps.
Remote code execution in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below allows an authenticated attacker to run arbitrary commands as root by abusing an unsafe Java deserialization path in the bundled Quartz 2.3.2 scheduler. Because Quartz reads job-data BLOBs from the qrtz_job_details table via ObjectInputStream with no class filter, and the shipped commons-collections-3.2.1 (pulled in by velocity-1.7.jar) exposes the InvokerTransformer gadget, an attacker who can write to the job table - e.g. by chaining the previously disclosed previewSql SQL injection - plants a CommonsCollections6 payload that fires when the cron trigger runs. SSVC rates technical impact as total with a proof-of-concept exploit; EPSS is low at 0.40% (61st percentile) and it is not in CISA KEV, so this is currently a PoC-stage rather than mass-exploited issue.
Unauthenticated SQL injection in the DirectoryPress - Business Directory And Classified Ad Listing WordPress plugin (versions ≤ 3.6.26) allows remote attackers to extract sensitive database information via the 'packages' parameter. Exploitation requires no user interaction or privileges, making it highly automatable. No active exploitation or public exploit code has been reported, and the EPSS probability is low (0.06%).
Denial of service in fio (Flexible I/O Tester) v3.41 lets a crafted job file crash the process via a NULL pointer dereference: when the fdp_pli option is supplied without an argument, the str_fdp_pli_cb() callback passes a NULL pointer to strdup(), triggering a segmentation fault (CWE-476). Only availability is affected - no code execution or data exposure. It carries a low EPSS score (0.06%, 19th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis, though a referenced gist and upstream GitHub issue #2055 document reproduction.
Unauthenticated denial of service in zrok's OAuth-protected proxy shares (openziti/zrok <= 1.1.11 and v2 < 2.0.1) lets a remote attacker crash the proxy process with a single crafted Cookie header. The GetSessionCookie routine reads an attacker-controlled cookie-stripe count and performs make([]string, count) with no upper bound before any authentication, driving gigabyte-scale heap allocations that cause OOM termination or goroutine panics across every share the proxy serves. There is no public exploit identified at time of analysis, and EPSS is low (0.06%), but exploitation is trivially automatable per CISA SSVC.
Stack buffer overflow in ngtcp2, a C implementation of the IETF QUIC protocol, affects all versions prior to 1.22.1 when the qlog logging callback is enabled. The function ngtcp2_qlog_parameters_set_transport_params() serializes peer-supplied QUIC transport parameters into a fixed 1024-byte stack buffer without bounds checking, so a remote peer can send oversized transport parameters during the handshake to write past the buffer and crash the process (availability impact per CVSS 7.5). SSVC lists exploitation status as 'poc' and there is publicly available exploit code exists, but EPSS is very low at 0.04% (12th percentile), and it is not in CISA KEV.
SQL injection in Riaxe Product Customizer for WordPress (all versions ≤2.1.2) allows unauthenticated remote attackers to extract sensitive database contents via crafted REST API requests. The vulnerability exists in the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint where the 'options' parameter keys within 'product_data' lack proper SQL escaping. CVSS 7.5 (High) with attack vector network/low complexity/no authentication required. Wordfence discovery indicates active researcher attention. No CISA KEV listing or public exploit code identified at time of analysis, but EPSS data unavailable for risk calibration.
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. No active exploitation is confirmed; vendor patch available in version 3.2.0 released April 2026.
Signature validation bypass in Redsys payment gateway plugin (WooCommerce) allows remote attackers to mark unpaid orders as completed without actual payment. Unauthenticated attackers who obtain a valid order key and amount can forge payment callbacks across Redsys, Bizum, and Google Pay flows, enabling fraudulent order fulfillment. Affects versions ≤7.0.0 of 'Payment Gateway for Redsys & WooCommerce Lite' WordPress plugin. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation, though EPSS data unavailable. No CISA KEV listing or public POC identified at time of analysis. Vendor patch released in changeset 3501998.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach protected routes by sending URLs with duplicate leading slashes (e.g. //admin/secret) when the deprecated top-level Fastify ignoreDuplicateSlashes option is enabled. Because middie reads the option only from routerOptions while Fastify's router still honors the top-level form, a normalization gap allows middleware-enforced checks to be skipped. There is no public exploit identified at time of analysis and EPSS is negligible (0.04%), but SSVC rates technical impact as total, reflecting a full auth-check bypass on affected deployments.
Command injection in radare2's rabin2 PDB parser allows local attackers to execute arbitrary commands when the tool is compiled without SSL support on UNIX systems. The vulnerability (CWE-78) affected a narrow window between commits 01ca2f6 and 9236f44 (post-6.1.2, pre-6.1.3), spanning less than one week in the development timeline. CVSS 7.4 (HIGH) reflects local attack vector with high complexity but no authentication required. No active exploitation confirmed (not in CISA KEV), though publicly available exploit code exists. EPSS data not provided. Fixed in commit 9236f44a28 per GitHub PR #25651.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 lets remote attackers inject malicious SQL through the /music/view_playlist.php endpoint, enabling unauthorized database queries against the backend. Per the CVSS vector (PR:N) the flaw is reachable without authentication, and a public technical write-up describing the injection is available on GitHub, though it is not listed in CISA KEV and carries a very low EPSS score (0.03%). SSVC rates exploitation as not-observed but automatable with partial technical impact, marking it as opportunistically scannable rather than actively weaponized.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows remote attackers to manipulate backend database queries through the /music/view_music.php endpoint. The flaw stems from unsanitized user input reaching a SQL statement (CWE-89), enabling database content disclosure and tampering. No public exploit identified at time of analysis beyond a third-party GitHub vulnerability report, and EPSS is very low (0.03%, 7th percentile), consistent with an obscure hobby-grade PHP application rather than a mass-exploited target.
Local privilege escalation in Dell Storage Manager - Replay Manager for Microsoft Servers 8.0 allows low-privileged authenticated users to gain elevated privileges with high integrity and availability impact. Dell has released security advisory DSA-2026-058 with patches. The CVSS 7.3 (High) score reflects significant post-exploitation impact, though local access and existing authentication requirements limit initial attack surface. No active exploitation (CISA KEV) or public proof-of-concept code identified at time of analysis.
Stored Cross-Site Scripting in Prismatic WordPress plugin (all versions ≤3.7.3) allows unauthenticated remote attackers to inject malicious scripts via crafted comment submissions containing the 'prismatic_encoded' pseudo-shortcode. Vulnerable code in prismatic_decode function fails to sanitize user-supplied attributes. CVSS 7.2 with scope change (S:C) elevates impact beyond vulnerable component. EPSS data not available; no CISA KEV listing identified. Wordfence threat intelligence confirms vulnerability; patch released in version 3.7.4 per WordPress plugin repository changelog.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated administrators to execute arbitrary SQL commands via the /parking/manage_location.php endpoint. CVSS 7.2 indicates high-privilege requirement (PR:H) limiting exploitation to compromised admin accounts or insider threats. EPSS score of 0.01% (2nd percentile) suggests minimal observed exploitation activity. No CISA KEV listing indicates no confirmed active exploitation in enterprise environments.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL queries via the /parking/manage_user.php endpoint. CVSS 7.2 with network vector but requires high-privilege authentication (PR:H), significantly limiting attack surface. EPSS probability is very low (0.01%, 2nd percentile), indicating minimal observed exploitation activity. No CISA KEV listing or public POC confirmation, though a technical writeup exists in GitHub repository mt-0505/cve-report.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL commands via the /parking/view_parked_details.php endpoint. The vulnerability requires administrative credentials (CVSS PR:H) but enables full database compromise once authenticated. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. A public proof-of-concept exists on GitHub, lowering the technical barrier for authenticated attackers.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL commands via the /parking/manage_category.php endpoint, enabling complete database compromise. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. Proof-of-concept exploit code is publicly available on GitHub, lowering the barrier for authenticated attackers with administrative access.