MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
SQL injection in PHPGurukul Student Information System 1.0 exposes the `/student_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter. Remote attackers with low-privilege application credentials can read, alter, or partially disrupt data stored in the backend database. A public proof-of-concept is available on GitHub, lowering the technical barrier for opportunistic exploitation against internet-facing deployments.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.