Remote code execution in Apache Camel's camel-coap component (versions 4.14.0-4.14.5, 4.18.0 before 4.18.1, and 4.19.0) allows an unauthenticated attacker to inject arbitrary internal Camel headers via CoAP URI query parameters, achieving OS command execution when a route forwards to a header-sensitive producer such as camel-exec. The component maps incoming CoAP query parameters straight into Exchange message headers with no HeaderFilterStrategy, so a single UDP packet to port 5683 can override the executable and arguments of a downstream exec producer and return command output in the CoAP response. Rated CVSS 10.0 with publicly available exploit code, though EPSS remains modest (0.55%, 68th percentile) and CISA SSVC records no observed exploitation, indicating opportunity rather than confirmed mass exploitation.
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the username field, because the login variable is concatenated directly into a query without parameterization. Affecting versions 7.0 through 12.4.3, it can be leveraged to create privileged accounts, exfiltrate database contents, and - where the DB account has elevated OS privileges - achieve operating-system command execution. Publicly available exploit code exists (VulnCheck advisory and multiple PoCs), though EPSS remains low at 0.09% and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers execute arbitrary shell commands by injecting into the admpass argument of the setLoginPasswordCfg function in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input to a system shell without sanitization, granting full device compromise. Publicly available exploit code exists (disclosed via VulDB/GitHub); no active exploitation is confirmed in CISA KEV, and EPSS is modest at 0.89% (76th percentile).
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote unauthenticated attackers to execute arbitrary system commands by manipulating the tty_server argument passed to the setAdvancedInfoShow function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation yielding full confidentiality, integrity, and availability impact. EPSS is currently low (0.89%, 76th percentile) and there is no public exploit identified as being actively used in the wild per CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sys_info argument passed to the setMiniuiHomeInfoShow function of /cgi-bin/cstecgi.cgi. Per the CVSS vector the attack is network-based with no privileges or user interaction required (PR:N/UI:N), and publicly available exploit code exists (published via VulDB/GitHub), though it is not listed in CISA KEV. EPSS is low at 0.89% (76th percentile), suggesting exploitation is plausible but not yet widespread.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to inject arbitrary operating-system commands through the telnet_enabled argument of the setTelnetCfg function in /cgi-bin/cstecgi.cgi. The flaw carries a CVSS 4.0 score of 8.9 with high impact to confidentiality, integrity, and availability, and publicly available exploit code exists, though it is not listed in CISA KEV. EPSS is modest at 0.89% (76th percentile), indicating publicly available exploit code exists but no confirmation of widespread active exploitation.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the HTTP argument processed by the CsteSystem function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with high impact to confidentiality, integrity, and availability. Publicly available exploit code exists and a POC has been disclosed; there is no public exploit identified as actively exploited in the wild (not on CISA KEV), and EPSS is low at 0.89%.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote, unauthenticated attackers execute arbitrary shell commands by manipulating the 'mode' parameter passed to the setWiFiAclRules function in the /cgi-bin/cstecgi.cgi CGI handler. Publicly available exploit code exists (VulDB) and SSVC rates it automatable with total technical impact, though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV. With CVSS 4.0 of 8.9 and no authentication required, any attacker reaching the device's web interface can gain full control.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote unauthenticated attackers execute arbitrary system commands by manipulating the 'tz' parameter of the setNtpCfg function in /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, total impact) reflects unauthenticated network reachability with full compromise, though EPSS remains modest at 0.89%. This is no public exploit identified as actively exploited - there is no CISA KEV listing at time of analysis.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) allows remote attackers to execute arbitrary operating-system commands by manipulating the sambaEnabled argument passed to the setStorageCfg function in /cgi-bin/cstecgi.cgi. The CVSS 4.0 vector indicates network-reachable, unauthenticated exploitation (AV:N/PR:N/UI:N) with total impact on confidentiality, integrity, and availability. Publicly available exploit code exists (VulDB), though EPSS remains modest at 0.89% (76th percentile) and it is not listed in CISA KEV.
OS command injection in the TOTOLINK A8000RU router (firmware 7.1cu.643_b20200521) lets remote attackers inject arbitrary operating-system commands through the wanIdx argument of the setDmzCfg handler in /cgi-bin/cstecgi.cgi. The CGI Handler passes attacker-controlled input into a shell context without sanitization, yielding full command execution on the device. Publicly available exploit code exists and the SSVC framework rates technical impact as total and the attack as automatable, though it is not listed in CISA KEV and EPSS remains modest at 0.89%.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'merge' parameter in the setWiFiEasyCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists on GitHub (Litengzheng/vuldb_new2), enabling trivial exploitation against internet-facing devices. CVSS 8.9 reflects network attack vector with no authentication required (AV:N/PR:N), and EPSS data suggests moderate real-world exploitation probability given the POC availability and low attack complexity.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via crafted addrPrefixLen parameter to the setIpv6LanCfg function in /cgi-bin/cstecgi.cgi. CVSS 8.9 (High) with CVSS:4.0 vector indicating network-accessible, low-complexity attack requiring no privileges or user interaction. Publicly available exploit code exists (GitHub POC), enabling weaponization by threat actors. Not currently listed in CISA KEV, suggesting limited observed exploitation despite public disclosure and high severity scoring.
OS command injection in Totolink A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the setIptvCfg parameter in /cgi-bin/cstecgi.cgi. CVSS 8.9 (Critical) with network attack vector and no authentication required. Public exploit code available on GitHub since disclosure, significantly lowering exploitation barrier for attackers targeting internet-facing consumer routers. No vendor patch identified for this end-of-life device at time of analysis.
Unsafe Java deserialization in Apache Camel's camel-infinispan component allows arbitrary code execution when the ProtoStream-based remote aggregation repository reads objects from an Infinispan cache using java.io.ObjectInputStream with no ObjectInputFilter applied. Any attacker able to write to the backing Infinispan cache can plant a malicious serialized gadget that executes in the application context during routine get/recover operations. Publicly available exploit code exists, though EPSS is low (0.08%) and there is no evidence of active exploitation.
Unsafe Java deserialization in the Apache Camel camel-mina component (versions 3.0.0 through 4.14.5, 4.15.0 through 4.18.1, and 4.19.0) allows remote attackers to achieve arbitrary code execution by delivering a crafted serialized object to a MINA TCP/UDP consumer that converts inbound data to ObjectInput. The flaw stems from MinaConverter.toObjectInput wrapping raw network bytes in an ObjectInputStream with no ObjectInputFilter or class allow-listing, so readObject() instantiates attacker-chosen classes. Publicly available exploit code exists and vendor patches are released, but there is no evidence of active exploitation (not in CISA KEV) and EPSS is very low at 0.08%.
Remote code execution in ProjeQtor 7.0 through 12.4.3 arises from a ZipSlip flaw in the plugin upload feature, where authenticated users holding upload permissions can smuggle directory-traversal sequences inside a crafted ZIP archive so that files extract outside the intended plugin directory. By planting a PHP webshell into a web-accessible path, an attacker executes arbitrary code with the web server's privileges. Publicly available exploit code exists (reported by VulnCheck), though there is no public exploit identified as actively exploited in the wild, and EPSS is a modest 0.42% (62nd percentile).
Command injection in the Tenda HG3 2.0 gateway/router allows an authenticated remote attacker to inject arbitrary OS commands through the formTracert handler at /boaform/formTracert by manipulating the datasize argument (CWE-77). Publicly available exploit code exists (disclosed via VulDB), though there is no public exploit identified as being actively used in the wild and it is not listed in CISA KEV. EPSS is modest at 0.29% (52nd percentile), indicating exploitation is plausible but not yet widespread.
OS command injection in Tenda HG3 router version 2.0 (build 300003070) allows authenticated remote attackers to execute arbitrary system commands with router privileges via the fmgpon_loid parameter in the formgponConf administrative function. Public exploit code is available and confirmed usable for attacks per VulDB reporting, significantly lowering the skill barrier for exploitation despite requiring valid administrative credentials.
Stack-based buffer overflow in the Tenda HG3 2.0 router allows authenticated remote attackers to corrupt memory by supplying an oversized destNet parameter to the formUploadConfig handler at the /boaform/formIPv6Routing endpoint. Publicly available exploit code exists, though EPSS rates real-world exploitation probability very low (0.05%, 14th percentile) and there is no public exploit identified as actively exploited. Successful exploitation yields total impact to confidentiality, integrity, and availability, typically manifesting as device crash or arbitrary code execution on the embedded system.
Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise the device via buffer overflow in the httpd web management interface. Exploitation requires low-privilege credentials but enables complete device takeover (CVSS 7.4). A public proof-of-concept exploit exists on GitHub, significantly lowering the barrier to active exploitation despite requiring authentication.
Buffer overflow in Tenda F456 router firmware 1.0.0.5 allows authenticated remote attackers to achieve full device compromise through the PPTP user management interface. The vulnerability exists in the fromPPTPUserSetting function within the httpd component, exploitable via manipulation of the 'delno' parameter sent to /goform/PPTPUserSetting. Public exploit code is available on GitHub, significantly lowering the barrier to exploitation, though no CISA KEV listing or widespread exploitation has been confirmed at time of analysis.
Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to compromise device integrity and confidentiality via buffer overflow in the WAN configuration interface. The vulnerability exploits the fromAdvSetWan function's improper handling of the wanmode parameter, enabling complete device takeover. Public exploit code exists on GitHub (Litengzheng/vuldb_new), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector, low complexity (AC:L), and publicly available POC makes this a realistic threat to exposed management interfaces.
Buffer overflow in Tenda F456 router version 1.0.0.5 allows authenticated remote attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability resides in the fromSetIpBind function of the httpd daemon's /goform/SetIpBind endpoint, exploitable via malformed 'page' parameter input. Public exploit code exists on GitHub (Litengzheng/vuldb_new), elevating real-world risk despite requiring low-privilege authentication (CVSS 7.4, EPSS data not provided, not in CISA KEV at time of analysis).
Buffer overflow in D-Link DIR-825 router's miniupnpd service allows authenticated adjacent network attackers to achieve complete device compromise through malicious UPnP SOAP requests. Affects DIR-825 firmware versions up to 3.00b32, which D-Link no longer supports. Public exploit code exists (CVSS:4.0 7.3 High), but EPSS probability remains low at 0.03% (7th percentile), suggesting limited real-world exploitation activity. Remediation options are constrained as the product has reached end-of-life status.
Local privilege escalation in Canonical's authd (the Ubuntu authentication daemon for external identity providers) prior to 0.6.4 arises from a logic error that resets a user's primary group ID (GID) to their UID when their identity-provider record changes. Affected are users whose primary GID legitimately differs from their UID - created under authd < 0.5.4 or reassigned via 'authctl group set-gid' - causing newly created files and directories to be misowned by an unintended group. Publicly available exploit code exists, but there is no public exploit identified as actively used; SSVC records exploitation status as none and EPSS is negligible (0.01%).
Arbitrary file disclosure in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to read .log files anywhere on the filesystem by injecting ../ sequences into the logname parameter of the dynamicDialog.php log viewer. Reported by VulnCheck with publicly available exploit code; EPSS is low (0.20%, 42th percentile) and it is not in CISA KEV, so no public exploit identified as actively exploited. The flaw is limited to files readable by the web server process and to .log-named targets, capping direct impact to information disclosure.
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' records - including password hashes and API keys - by directly calling the objectDetail.php endpoint, which fails to enforce ownership or role checks (CWE-862). Because the exposed administrator credentials enable privilege escalation, the flaw effectively promotes a low-privilege account to full control. Publicly available exploit code exists, though EPSS is low (0.06%, 18th percentile) and it is not on CISA KEV, indicating no public exploit identified as actively used in the wild.
String injection in Notepad++ 8.9.3 leads to memory address disclosure or application crash when processing maliciously crafted input. Attackers can leverage this remotely without authentication (CVSS 4.0 score 10.0, AV:N/PR:N), though desktop application context suggests user interaction required despite UI:N in vector. Publicly available exploit code exists per GitHub repository llgsjsm/cve-2026-3008. Fixed in version 8.9.4 release candidate per community forum discussion. EPSS data not available for 2026 CVE.
Remote code execution and arbitrary file write in Apache Camel affects routes using the JMS, SJMS, CoAP, or Google Pub/Sub components, where an attacker with producer access to a consumed broker can smuggle case-variant Camel internal headers (e.g. 'CAmelExecCommandExecutable') past case-sensitive filtering. The flaw is an incomplete fix for CVE-2025-27636: five non-HTTP HeaderFilterStrategy implementations were never given the setLowerCase(true) hardening, so injected headers are resolved by their canonical casing in downstream components like camel-exec and camel-file. There is no public exploit identified at time of analysis and EPSS is very low (0.06%), but CVSS is 9.9 and SSVC rates technical impact as total.
Remote code execution in Apache Camel's JMS-family components (camel-jms, camel-sjms, camel-sjms2, camel-amqp, camel-activemq, camel-activemq6) allows an attacker who can publish a crafted JMS ObjectMessage to a consumed queue or topic to execute arbitrary code, because JmsBinding.extractBodyFromJms() calls ObjectMessage.getObject() with no ObjectInputFilter, allowlist, or denylist. Exploitation requires a usable deserialization gadget chain on the application classpath and is reachable in the default configuration (mapJmsMessage enabled) whenever Camel acts as a JMS consumer. There is no public exploit identified at time of analysis and the vulnerability is not on CISA KEV; EPSS is low at 0.30% (53rd percentile).
Command injection in leonvanzyl's autocoder (development snapshot commit 79d02a) lets remote, unauthenticated attackers achieve arbitrary code execution by supplying a crafted 'command' parameter to the /devserver/start endpoint, which passes attacker input to a shell. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, though CISA's SSVC framework rates it as automatable with total technical impact; EPSS is low at 0.27% (50th percentile).
Remote unauthenticated command injection in Tenda AC18 router firmware V15.03.05.05_multi allows complete device compromise via the SetSambaCfg interface. Attackers can execute arbitrary system commands by manipulating the guestuser parameter in HTTP requests to /goform/SetSambaCfg. CVSS 9.8 critical severity with network attack vector and no authentication required. EPSS score of 0.06% (19th percentile) suggests low observed exploitation despite extreme technical severity. Publicly documented exploit proof-of-concept exists on GitHub.
Remote unauthenticated attackers can execute arbitrary code in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 through unsafe deserialization in AbstractIoBuffer.getObject(). This is an incomplete fix bypass for CVE-2024-52046 where the classname allowlist validation occurs after static initializers execute, enabling attackers to trigger malicious code execution before security controls engage. Apache confirmed the flaw affects applications calling IoBuffer.getObject() and released patches in versions 2.0.28, 2.1.11, and 2.2.6. CVSS 9.8 critical score reflects network-accessible unauthenticated exploitation with complete system compromise potential.
Remote code execution in Apache MINA 2.0.0-2.0.27, 2.1.0-2.1.10, and 2.2.0-2.2.5 allows unauthenticated network attackers to execute arbitrary code by exploiting unsafe deserialization in AbstractIoBuffer.resolveClass(). The vulnerability bypasses classname allowlist protections due to incomplete validation of static classes and primitive types. CVSS 9.8 critical severity reflects trivial network-based exploitation requiring no authentication or user interaction. Applications using IoBuffer.getObject() are affected. Vendor-released patches available in versions 2.0.28, 2.1.11, and 2.2.6.
Remote unauthenticated attackers can escalate privileges to administrator level in Directorist Social Login WordPress plugin versions prior to 2.1.4 through incorrect privilege assignment during social authentication flows. Exploitation requires no authentication or user interaction, enabling complete site takeover via social login mechanisms. CVSS 9.8 (Critical) reflects network-based attack vector with no complexity barriers. No public exploit code or CISA KEV listing identified at time of analysis, but Patchstack reporting suggests vulnerability may be under researcher scrutiny.
Authentication bypass in MERCURY MIPC252W IP camera 1.0.5 allows remote unauthenticated attackers to hijack authenticated RTSP sessions and execute unauthorized camera control commands. After an initial valid Digest authentication in a DESCRIBE request, the device fails to validate subsequent RTSP request credentials (SETUP, PLAY, TEARDOWN), accepting empty or invalid Authorization headers as long as session parameters match. This enables complete camera takeover including video stream access, configuration changes, and service disruption without credential brute-forcing. EPSS score of 0.01% suggests minimal observed exploitation activity, though the attack complexity is low (AV:N/AC:L/PR:N) and public PoC exists on GitHub.
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Server-side request forgery in ShadowCloneLabs GlutamateMCPServers allows remote unauthenticated attackers to manipulate the 'url' parameter in the puppeteer_navigate component (src/puppeteer/index.ts), potentially accessing internal resources or conducting network reconnaissance. A publicly available proof-of-concept exploit exists (GitHub). EPSS data not available, but CVSS 7.3 (High) with network vector, low complexity, and no authentication requirements indicates significant accessibility. The vendor has not responded to early disclosure via GitHub issue #8, and no patch timeline exists due to the project's rolling release model.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
Server-side request forgery in JoeCastrom mcp-chat-studio (all versions through 1.5.0) allows unauthenticated remote attackers to forge arbitrary server-initiated HTTP requests by injecting a malicious URL into the `base_url` query parameter of the LLM Models API (`server/routes/llm.js`). A public exploit exists via GitHub issue report, and SSVC classifies this as automatable - meaning it can be scripted for broad scanning. No patch has been issued; the maintainer has not responded to the coordinated disclosure.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows remote unauthenticated attackers to bypass authentication and access the /item API endpoint, resulting in limited confidentiality impact. The vulnerability has a CVSS score of 5.5 (network-accessible, low attack complexity, no privileges required), and publicly available exploit code exists, increasing real-world risk despite the moderate base score.
CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary database queries via the ID parameter in /ajax.php?action=delete_product. Publicly available exploit code exists (GitHub POC), enabling unauthorized data access, modification, or deletion without authentication. EPSS data not available, but the combination of network attack vector, no authentication requirement, and public exploit significantly elevates real-world exploitation risk for internet-exposed instances.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 exposes the `/ajax.php?action=save_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to inject arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is needed, and a public proof-of-concept exploit is available per VulDB and a referenced GitHub issue. Despite straightforward exploitability, the EPSS score of 0.03% (9th percentile) reflects the product's niche deployment footprint rather than any exploitation difficulty, and no CISA KEV listing has been confirmed.
SQL injection in code-projects Online Lot Reservation System 1.0 exposes the pre-authentication login endpoint `/loginuser.php` to unauthenticated remote database manipulation via the `email` and `password` parameters. A public POC has been disclosed on GitHub, though real-world exploitation risk is tempered by an EPSS of 0.03% (9th percentile), SSVC 'Exploitation: none', and the product's obscure deployment footprint. Successful exploitation yields partial compromise of confidentiality, integrity, and availability of the underlying database - consistent with CVSS 4.0 impact ratings of VC:L/VI:L/VA:L.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to read, modify, or delete database records via the ID parameter in /ajax.php?action=delete_receiving. Publicly available exploit code (GitHub POC) demonstrates working attack against default installations with no authentication required (CVSS AV:N/AC:L/PR:N). EPSS data not available, but POC publication significantly lowers exploitation barrier for opportunistic attacks against internet-exposed instances.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_category. Public exploit code exists on GitHub (y1shiny1shin/vuldb-project), enabling immediate weaponization against unpatched systems. CVSS 7.3 reflects potential for confidentiality, integrity, and availability compromise through database manipulation. No remediation release identified at time of analysis.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_receiving. Publicly available exploit code (GitHub PoC) enables immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required, enabling confidentiality/integrity/availability impact across database operations. EPSS data not provided, but public exploit availability significantly elevates real-world risk for unpatched installations of this open-source PHP application.