Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized destHost parameter to the ipFilterList=mod action in netis.cgi, triggering a stack-based buffer overflow. Because the Boa web server runs CGI handlers as root and the overflow occurs before authentication is checked, successful exploitation yields full device takeover. Publicly available exploit code exists and the flaw was reported by VulnCheck; CVSS 4.0 base is 9.3 (AV:N/AC:L/PR:N/UI:N), but no active exploitation (CISA KEV) is confirmed.
Remote authentication bypass in EFM ipTIME T16000M firmware 14.20.2 lets unauthenticated attackers defeat session validation via the httpcon_check_session_url function, gaining administrative access to the router's web management interface over the network. Publicly available exploit code exists (published via VulDB), and the CVSS 4.0 score of 9.3 reflects total loss of confidentiality, integrity, and availability. There is no public exploit identified in CISA KEV, but the vendor was contacted and did not respond, so affected devices currently have no fix.
Remote code execution in the Netis NC63 router (firmware through V3.0.0.3327) lets unauthenticated attackers gain root by sending an oversized Base64-encoded password to the login handler in /bin/netis.cgi, whose custom Base64 decoder writes past a fixed-size stack buffer. Because the Boa web server runs CGI processes as root, successful exploitation yields full device takeover. Publicly available exploit code exists (published by VulnCheck and researcher ozcanpng), and the CVSS 4.0 base score is 9.3, though there is no public exploit identified as being used in active attacks.
Authentication bypass in EFM ipTIME T24000M firmware through version 14.20.0 allows unauthenticated remote attackers to bypass session validation by manipulating the httpcon_check_session_url function in the Session Validation Handler. The flaw falls under CWE-287 (Improper Authentication) and grants unauthorized access to router management functions without valid credentials. A public proof-of-concept has been disclosed via GitHub, and the vendor has not responded to disclosure efforts, leaving no official patch available.
Stack-based buffer overflow in UTT HiPER 1250GW firmware (≤ 3.2.7-210907-180535) exposes the device to remote code execution via a crafted HTTP request to the `/goform/aspRemoteApConfTempSend` endpoint. The unsafe `strcpy()` call processing the `Profile` parameter allows a low-privileged remote attacker to overwrite stack memory, with full confidentiality, integrity, and availability impact on both the device and downstream network systems per the CVSS 4.0 subsequent-system metrics. A public proof-of-concept is confirmed on GitHub; no public exploitation confirmed in CISA KEV at time of analysis.
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect `required()` field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. Email-based MFA is unaffected; no public exploit or CISA KEV listing exists at time of analysis, though the logic flaw is straightforward and the fix is trivially reversible to derive an exploit.
Denial-of-service in Mistune Python Markdown parser versions 3.3.0-3.3.2 allows remote unauthenticated attackers to crash any process that renders user-supplied Markdown by submitting input with hundreds of consecutive asterisk characters. The recursive HTMLRenderer.render_token() traversal grows proportionally to emphasis nesting depth and exceeds Python's default recursion limit, raising an unhandled RecursionError that terminates the parsing process. No public exploit identified at time of analysis, though the fix commit itself demonstrates the attack pattern explicitly in its regression test suite.
Remote buffer overflow in UTT HiPER 1200GW routers (firmware up to 2.5.3-170306) allows network-reachable authenticated attackers to corrupt memory by supplying an oversized SSID value to the /goform/formConfigFastDirectionW endpoint, which calls strcpy without bounds checking on user input. Full confidentiality, integrity, and availability impact on the device is possible, potentially enabling arbitrary code execution and pivoting into the network behind the gateway. A public proof-of-concept exploit is available on GitHub; no active exploitation has been confirmed in CISA KEV at time of analysis.
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holding member-read rights, enabling offline password cracking attacks against member accounts. Both the member list and individual member detail endpoints return the crypted password verifier field because neither the base API serializer nor the Members API class applies field-level filtering to strip credential material from responses. A public proof-of-concept exists; this is not confirmed as actively exploited via CISA KEV, but the low access bar combined with exposed credential hashes and available exploit code makes this a genuine remediation priority for organizations running affected versions.
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.
Universe checking state desynchronization in the Rocq Prover allows the kernel to continue accepting universe-inconsistent terms after a module using `Local Unset Universe Checking` is closed, despite user-visible diagnostics reporting the check as enabled. Once the module closes, Hurkens' paradox can be applied without axioms, plugins, or unsafe features to derive a proof of False, from which any proposition is provable. A public proof-of-concept is available, no patch exists, and neither `Print Assumptions` nor `Test Universe Checking` reveals the compromised kernel state.
Soundness violation in Rocq Prover's guard checker (versions V8.20 through V9.1.1) allows crafting a nested fixpoint that produces a proof of False from purely definitional code - no tactics, axioms, plugins, or unsafe flags required. The flaw stems from the checker's failure to track higher-order recursive calls when a fixpoint passes itself as an argument to a nested fixpoint, which then applies it to a non-subterm value, admitting a type definitionally equal to its own negation. A public proof-of-concept exploit exists at github.com/endrazine/rocq-cve-poc-21683; no active exploitation is confirmed in CISA KEV, but any proof corpus accepted by affected Rocq versions should be considered potentially unsound until re-verified under Rocq 9.2.0.
Rocq Prover's kernel guard checker fails to revalidate the recursive tree representation of inductive type parameters after they are altered by transport, allowing construction of provably non-terminating fixpoint definitions that the kernel accepts as structurally decreasing. Two cooperating fixpoints exploit this: the first corrupts the recursive tree via a transport rewrite, and the second inherits the corrupted tree without re-verification, enabling a structurally non-decreasing call to be accepted as terminating. The resulting definition derives a proof of False from axioms consistent with the calculus of inductive constructions, breaking logical soundness; a public proof-of-concept exists at https://github.com/endrazine/rocq-cve-poc-22024 and no merged patch is available at time of analysis.
Logical unsoundness in Rocq Prover's guard checker allows a crafted nested mutual fixpoint definition to be accepted as structurally terminating when it is not, yielding a proof of False derivable without axioms, plugins, or unsafe flags in versions V8.20 through V9.1.1. The flaw means any proposition - including security-critical formally verified properties - can be trivially proven once a malicious or malformed proof file is compiled on an affected system. A public proof-of-concept exploit exists; no active exploitation has been recorded in CISA KEV, consistent with the niche academic deployment base.
Lean 4's formal proof kernel accepts unsound opaque declarations due to a missing closure check in environment::add_opaque, enabling a metaprogram to admit a constant of type False without sorry, unsafeCast, or any unsafe mechanism - directly shattering the kernel's soundness guarantee. All Lean 4 versions before 4.32.2 are affected; a publicly available proof-of-concept at https://github.com/endrazine/lean-cve-poc-14484 confirms exploitability. No CISA KEV listing exists, but the POC's public availability and the ecosystem's reliance on kernel soundness for formal guarantees make this a high-priority upgrade for any organization using Lean 4 for verified software or mathematical proofs.
Arbitrary account takeover in the miniOrange OAuth Client extension for Joomla (versions before 3.2.0) lets a remote unauthenticated attacker authenticate as any user, including administrators, by manipulating a single cookie value. The flaw is an authorization/identity check that trusts a client-controlled cookie to establish the logged-in account, so tampering with it grants full session control. No public exploit has been identified at time of analysis, but the trivial network-based vector and CVSS 10.0 rating make it a high-priority patch.
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape.
Arbitrary file upload in the UltimateAI WordPress plugin (versions up to and including 3.1.0) lets any authenticated Subscriber-level user upload files with attacker-controlled types, per Patchstack (CVE-2026-32559, CWE-434). Because the plugin fails to validate uploaded file types, a low-privileged account can place a malicious PHP payload on the server, and with a CVSS 3.1 base score of 9.9 and scope change this typically escalates to full remote code execution and site takeover. No public exploit identified at time of analysis.
Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it.
Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis.
PHP Object Injection in the ACPT (Pro) - Custom Post Types plugin for WordPress affects all versions up to and including 2.0.63, allowing an attacker to inject a serialized PHP object that the plugin deserializes. The vendor advisory (Patchstack) frames this as a 'Subscriber' level issue, meaning a low-privileged authenticated account can supply crafted serialized data; where a suitable POP gadget chain exists in the plugin or its dependencies, this can escalate to code execution, data theft, or site compromise. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Insecure deserialization in weDevs WP Project Manager (WordPress plugin) versions up to and including 4.0.6 allows remote unauthenticated attackers to inject crafted PHP objects (CWE-502) into the application. With CVSS:3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact, successful exploitation can lead to arbitrary object instantiation and, given a suitable POP gadget chain in the plugin or WordPress core, remote code execution or data compromise. Reported by Patchstack and tracked as ENISA EUVD-2026-65169; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Header-injection in the Apache Camel camel-atmosphere-websocket producer lets an external sender hijack WebSocket message dispatch in routes that bridge an HTTP consumer into the producer. Because the dispatch headers (websocket.connectionKey, websocket.connectionKey.list, websocket.sendToAll, websocket.eventType, websocket.errorType) use dotted names outside the filtered Camel namespace, the inherited HttpHeaderFilterStrategy admits them in both directions, so an attacker-supplied header overrides the recipient the route selected - suppressing a notification meant for one client or redirecting it to another client whose connection key the sender knows. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and it is not in CISA KEV, though the vendor rates it CVSS 9.8.
Header-filter bypass in the Apache Camel Undertow component (4.11.0-4.14.8, 4.15.0-4.18.3, and 4.19.0-4.21.x) lets remote senders smuggle legacy 'websocket.' dispatch headers across the undertow transport boundary. Because UndertowEndpoint overwrote the UndertowHeaderFilterStrategy with the base HttpHeaderFilterStrategy, undertow-specific filtering never ran on endpoint-configured routes, so an undertow HTTP consumer maps attacker-controlled 'websocket.*' wire headers onto the Exchange and a downstream undertow WebSocket producer can be steered to deliver to a peer other than the one the route selected. No public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and the fix is available from Apache.
Arbitrary code execution in libtiff's tiffcrop utility (commit 85f2ac8e) stems from the process_command_opts() function in tools/tiffcrop.c, classified as CWE-94 code injection. An attacker who can influence the input processed by tiffcrop can trigger execution of arbitrary code. Publicly referenced proof-of-concept material appears to exist via a linked gist, but the flaw is not in CISA KEV and EPSS is low (0.16%, 5th percentile), indicating no evidence of widespread active exploitation.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated privilege escalation in the Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin (versions up to and including 8.9.1) lets remote, unauthenticated attackers improperly acquire elevated privileges on affected WordPress sites. Reported by Patchstack and tracked as EUVD-2026-64804, the flaw carries a critical CVSS 9.8 with a fully network-exploitable vector and no user interaction. No public exploit identified at time of analysis, but the low attack complexity and unauthenticated nature make it a high-priority patching target.
Unauthenticated privilege escalation in the Digits WordPress plugin (versions 9.2 and earlier by UnitedOver, LLC) allows remote attackers to elevate their privileges without any authentication or user interaction, per Patchstack's disclosure. Digits is an OTP/phone-based login and registration plugin, so a flaw in its privilege-handling logic can let an outsider gain elevated account access. CVSS is rated 9.8 (critical); there is no public exploit identified at time of analysis and it is not on CISA KEV.
OS command injection in 4MOSAn GCB Doctor allows unauthenticated remote attackers to execute arbitrary system commands via a leftover ADOdb test page whose parameter is passed into a shell context. The vulnerable component is a debug/test artifact (an ADOdb connection test page) that was never removed from production builds, so any internet-reachable instance before build 20260621 is exploitable with a single crafted request. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.3 and the fully unauthenticated network vector make this a high-priority patch.
Prototype pollution in ractivejs/ractive through version 1.4.4 allows remote attackers to modify JavaScript Object.prototype attributes via the Ractive#set function's Keypath Handler component. A publicly available proof-of-concept exists (GitHub issue #3448), and the maintainers have not yet responded to the coordinated disclosure. No vendor-released patch is available at time of analysis, leaving all users of the 1.4.x branch exposed with no official remediation path.
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
SQL injection in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System (all versions through 300R004C00B300) allows remote unauthenticated attackers to manipulate backend database queries by injecting payloads into the order or sort parameter of the PlanController.getImmediatePlans API endpoint at /xbreport/api/v1/plamange/plansImmediate. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication or user interaction is required, and a public exploit has been disclosed via a Feishu document referenced in the VulDB entry, lowering the technical barrier for exploitation. No vendor-released patch has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/view_prod.php` endpoint to remote unauthenticated database manipulation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network exploitation with no prerequisites, yielding partial confidentiality, integrity, and availability impact against the backend database. A public proof-of-concept exploit is available on GitHub (referenced via VulDB), though the product's extremely narrow deployment footprint as a SourceCodester tutorial application limits real-world blast radius significantly.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=add_to_cart` endpoint to unauthenticated remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (PR:N) confirms no authentication is required despite the admin path, and a public exploit has been disclosed via GitHub. The CIA impact is rated limited across all three dimensions, consistent with a read/write SQL injection that does not achieve full system compromise.