Command injection in Tenda CH22 version 1.0.0.1 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the `editNameMit` parameter within the `formeditFileName` function at the `/goform/editFileName` web management endpoint. A public proof-of-concept exploit has been released, confirmed by the CVSS 4.0 E:P modifier and a linked Notion-hosted exploit writeup. No CISA KEV listing at time of analysis, but the public PoC significantly lowers the skill bar for exploitation against any CH22 device with an exposed or accessible management interface.
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privileged remote attacker to execute arbitrary OS-level commands via the cmdinput parameter of the /goform/exeCommand endpoint. The underlying formexeCommand function passes user-controlled input to a system command without adequate sanitization, exposing the router's underlying Linux OS. A proof-of-concept exploit has been publicly disclosed on Notion (referenced via VulDB), elevating real-world risk beyond the moderate CVSS 4.0 score of 5.3, which appears to understate the practical OS-level impact typical of router command injection primitives.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.
Open redirect via safe-URL validator bypass in CTFd versions 3.8.0 through 3.8.3 allows remote unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling phishing of competition participants. The vulnerability lies in the _is_safe_url() function within CTFd/utils/validators/__init__.py, which fails to correctly reject malformed or protocol-relative values supplied via the 'Next' query parameter. The vendor CHANGELOG for the patched release (3.8.4) further notes that attacker-controlled links could serve as a vector for arbitrary JavaScript execution if clicked, suggesting the integrity impact may exceed the open-redirect framing; a public exploit writeup exists and no active KEV listing is present at time of analysis.
Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
SQL injection in sambitraj's Student-Management-System exposes multiple user-supplied parameters in the Management Mutation Handler to database query manipulation by authenticated remote attackers. The application uses a rolling release model with no versioned releases; all commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected and no patch has been issued despite responsible disclosure via GitHub issue. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental), though no active exploitation has been confirmed and the CVSS 4.0 score of 2.1 reflects limited rated impact under low-privilege conditions.
SQL injection in the Dashboard component of sambitraj's Student-Management-System exposes the application to remote database manipulation via the roll_no and teacher_name parameters, affecting all commits through 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. A low-privileged authenticated attacker can inject arbitrary SQL to read or modify student records without any patch or vendor response currently available. A public exploit exists via GitHub issue disclosure, though real-world impact is constrained by the project's extremely narrow deployment footprint.
Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.
Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.
Server-side template injection (SSTI) via the FreeMarker engine in Dromara UJCMS 10.1.0 through 10.1.3 allows authenticated backend administrators to inject malicious template directives through the web-file-template update API endpoint. Exploitation requires high-privilege backend credentials but is network-reachable with no user interaction, and a public proof-of-concept exploit has been published on GitHub demonstrating the attack path. The vendor-scored CVSS 4.0 impact is rated low across confidentiality, integrity, and availability, though the FreeMarker SSTI class is capable of full JVM-level code execution if template sandboxing is absent or misconfigured - defenders should not assume the impact ceiling matches the reported score.
Session cookie forgery in Apache::AppSamurai::Util through version 1.01 is possible because CreateSessionAuthKey derives its entire entropy from observable runtime state - wall-clock microseconds and the Apache worker process ID - rather than a cryptographically secure random source. An unauthenticated remote attacker who can bound the second in which a target session was created and enumerate the small PID space can construct candidate 64-character hex cookies and recover a valid session token through online brute-force, bypassing authentication for all resources protected by the module. No public exploit code has been identified and SSVC confirms no current exploitation, though the attack is mechanically feasible given the constrained key space.
Privilege escalation in the Content Mask WordPress plugin (before 1.8.5.5) allows any authenticated Contributor to publish posts and pages without holding the publish capability, bypassing WordPress's role-based access control. The root cause is a missing capability check (CWE-269) when the plugin registers and handles its custom post type publishing workflow. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and the flaw is not listed in CISA KEV, reflecting negligible observed exploitation interest.