vLLM deployments prior to 0.30.0 with prefix caching enabled (the default) fail to carry the caller's cache_salt value across Harmony tool continuations submitted to "POST /v1/responses", so continuation prefixes land in the global unsalted prefix-cache namespace. This lets an authenticated tenant who can reconstruct a victim's low-entropy post-tool conversation history submit the same continuation and read the cached_tokens_per_turn counter as a hit/miss oracle, confirming whether that prefix was previously processed and thereby defeating salt-based tenant isolation of the cache. This is a genuine but low-severity, low-priority issue: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, exploitation requires authenticated access, prefix caching to be on, cache_salt salting to be in use, and the victim's history to be low-entropy and reconstructable, and only the isolation property leaks - no direct model output or prompt content is disclosed. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated remote credential disclosure in SGLang (sgl-project/sglang) up to version 0.5.21, where the /server_info HTTP endpoint and the gRPC GetServerInfo path returned the entire ServerArgs dataclass and thereby exposed the configured api_key, admin_api_key, and ssl_keyfile_password values verbatim to any network-reachable caller. No privileges or user interaction are required (CVSS 4.0 vector PR:N/UI:N, with E:P indicating a proof-of-concept), and publicly available exploit code exists; KEV has not flagged this as actively exploited. Impact is confidentiality-only but potentially severe - a leaked admin API key gives full control of the inference service - with the practical gate being whether the operator actually configured a secret and left the management endpoint exposed. A vendor fix exists only as an unmerged pull request (PR #30343), so released patched versions could not be confirmed at analysis time.
Path traversal in the Totolink A3002MU router's File Upload Handler (firmware 1.0.0-B20230403.1455) allows remote unauthenticated attackers to write files outside the intended upload directory by manipulating the 'filename' argument to /boafrm/formUploadFile. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV). The CVSS 4.0 score is 5.3 with low confidentiality, integrity, and availability impact, and the vector requires passive user interaction (UI:P), so exploitation is not fully unattended. Realistic risk depends on whether the upload interface is reachable from untrusted networks.
Reflected cross-site scripting in FeelCRM OS 1.0.0 allows unauthenticated remote attackers to inject arbitrary script through the keyword parameter in the Department Search endpoint handled by GroupController::index, requiring a victim to visit a crafted link. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV); the independent assessment rates this as low severity with vendor CVSS 4.0 base score 2.1 and assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The primary risk is script execution in the victim's browser context, especially if the victim holds an authenticated CRM session.
Code injection in TallCMS up to and including 4.8.0 lets an authenticated admin-panel user who is not a super admin upload and install a plugin ZIP containing arbitrary PHP that is then autoloaded and executed by the application. Exploitation requires valid credentials at a privilege level below super_admin plus the plugin-upload capability to be enabled (the uploadsAllowed() config flag), so it is not reachable anonymously, but publicly available exploit code exists per the referenced GitHub issue and no CISA KEV entry indicates confirmed active exploitation. Note that the vendor/CVSS 4.0 score (5.3, low confidentiality/integrity/availability impact) substantially understates the issue relative to the independent assessment (CVSS 3.1 8.8, C:H/I:H/A:H), which treats the arbitrary-PHP execution as full compromise of the installation; the signals across sources are mixed and partly contradictory.
Path traversal in the Gerapy project management component allows an authenticated attacker to write arbitrary files via a crafted project_name or malicious ZIP archive upload, affecting versions up to 0.9.13. Publicly available exploit code exists, but there is no evidence of active exploitation at time of analysis. The vulnerability has a moderate CVSS score of 5.3 and requires an authenticated session (CVSS PR:L).
Authenticated SQL injection in feelec-yishu feelcrm-os 1.0.0 lets a low-privileged logged-in user run attacker-controlled SQL through the groups[] array parameter handled by the getMemberByGroups AJAX endpoint in App/Feelcrm/Crm/Controller/AjaxRequestController.class.php. Publicly available exploit code exists (the reporter published details in the project's GitHub issue tracker at https://github.com/feelec-yishu/feelcrm-os/issues/1), but there is no indication of confirmed active exploitation and the flaw is not in CISA KEV. The vendor's CVSS 4.0 score is 2.1 while an independent assessment rates it a genuinely low-priority, remotely reachable SQLi constrained by mandatory valid credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), no user interaction, and the product's rare self-hosted deployment footprint.
SQL injection in FeelCRM OS 1.0.0 allows an authenticated, low-privileged remote attacker to execute arbitrary SQL by manipulating the group_id argument handled by the index function of App/Feelcrm/Index/Controller/MemberController.class.php, exposing or altering member-related data. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P, and the original report is a public GitHub issue), but there is no evidence of confirmed active exploitation (CISA KEV). Because exploitation requires a valid low-privileged account (CVSS PR:L) and yields only low confidentiality, integrity, and availability impact, this is a low-to-moderate priority issue rather than an unauthenticated critical flaw.
Session fixation in the kishor-23 food-waste-management-system PHP application lets unauthenticated remote attackers take over a logged-in user's session by fixing the PHPSESSID value before the victim authenticates through login.php, because the application never regenerates the session identifier after a successful login. Exploitation requires induced victim interaction (UI:P/UI:R) - the victim must log in while the attacker-controlled or attacker-predicted session ID is active - and impact is confined to that single user's session rather than the underlying host. Publicly available exploit code exists (GitHub issue #16), but this is an unversioned, niche GitHub project with no vendor response and no released patch, so despite the moderate 5.3 CVSS score the practical deployment risk is genuinely low.
Unrestricted file upload in feelec-yishu FeelCRM-OS 1.0.0 allows an authenticated, low-privileged user to write arbitrary files to the server through the UploadTicketFile endpoint at App/Feelcrm/Crm/Controller/UploadController.class.php by manipulating the cmd argument. The issue is reachable remotely over the network, requires no user interaction, and publicly available exploit code exists, but exploitation is gated on holding a valid low-privileged account (CVSS PR:L) and is confined to version 1.0.0 of this narrowly deployed CRM product, so overall risk is low. The vendor/project was notified through an issue report and has not responded, and there is no indication of confirmed active exploitation (no CISA KEV listing).
Authenticated SQL injection in itsourcecode Online Admission System 1.0 lets a user who can reach the administrative interface inject arbitrary SQL through the 'sy' (school year) parameter of /admin/schoolyear.php, allowing read and modification of backend database contents. The attack is network-reachable but requires a valid session on the admin panel (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so unauthenticated internet attackers cannot reach the vulnerable endpoint without first obtaining or bypassing admin credentials. Publicly available exploit code exists (a proof-of-concept has been published via the vendor-adjacent GitHub issue linked from VulDB), but there is no confirmed active exploitation (CISA KEV) and the CWE-89 flaw is assessed as low priority. EPSS data was not provided in this intelligence set.
SQL injection in itsourcecode Online Admission System 1.0 allows an attacker who already holds a valid low-privilege session to manipulate the ID parameter of /admin/key.php and inject arbitrary SQL into the backend database. Exploitation is remote but gated behind authentication and access to the administrative endpoint, so it is a low-priority, low-real-risk issue per our assessment; the practical exposure is confined to insiders or attackers who have already obtained credentials. Publicly available exploit code exists, no public exploit has been confirmed as actively exploited, and no CISA KEV entry is associated with this CVE.
SQL injection in itsourcecode Online Admission System 1.0 lets an authenticated, low-privileged user manipulate the schedid argument on /new.php so that attacker-controlled input is interpreted as part of a backend SQL statement, giving limited confidentiality, integrity and availability impact with no user interaction required. The issue is remotely reachable and publicly available exploit code exists (a public GitHub issue demonstrates the vector), but CISA KEV does not list it and no vendor-released patch was identified in the available data, so this remains a moderate-severity, low-priority issue for most deployments. Exposure is bounded by the authentication prerequisite: an attacker needs a valid low-privileged session in the application, and from the reported vector the injection does not inherently yield full database or host control.
SQL injection in itsourcecode Online Admission System 1.0 allows remote attackers to read or alter database contents via the fname argument processed by register1.php. The flaw is tracked as CVE-2026-105181 (CWE-89) with a CVSS 4.0 base score of 5.3 and publicly available exploit code; there is no CISA KEV confirmation of active exploitation. The CVSS vector indicates PR:L, but because register1.php is a registration endpoint, the required privilege level is questionable and may in practice be unauthenticated - defenders should verify.
Stored cross-site scripting in FeelCRM-OS 1.0.0 lets an authenticated low-privileged user inject arbitrary script through the customer_form[remark] field of the Create Customer endpoint, which is persisted after htmlspecialchars_decode processing and executes when another user views the affected customer record. Publicly available exploit code exists (referenced through the vendor's GitHub issue tracker and VulDB), but there is no confirmed active exploitation via CISA KEV and no vendor-released patch has been identified. The issue is a low-to-moderate priority item because exploitation requires valid credentials, a second user to render the stored record, and the product is niche with no known default internet-facing deployment.
Remote code execution in Django Haystack's Elasticsearch backend affects versions up to and including 3.3.0, where an attacker-controlled string reaching the result-deserialization path is passed to `eval()` inside `_to_python()` and executed in the Django application process. Exploitation is conditional rather than blanket: it requires the Elasticsearch backend, at least one `SearchField` declared with an `index_fieldname` alias that differs from its logical field name, and the ability to get a malicious payload indexed into that aliased field and returned by a subsequent search - a second-order/stored injection rather than a direct request-driven one. Publicly available exploit code exists (a GHSA advisory with source-level walkthrough was published alongside the fix), and the input CVSS vector marks PR:H, so under that vector exploitation is treated as authenticated; there is no CISA KEV entry indicating confirmed active exploitation. The vulnerability is patched in 3.4.0, and the reporting signals conflict sharply and must be weighed carefully: VulDB's CVSS 4.0 base of 2.0 contrasts with the upstream advisory's CVSS 3.1 base of 8.5, reflecting the gap between the mild vector assumptions and the full RCE impact when the alias configuration is present.
Cross-site scripting in code-projects HRMS 1.0 allows an authenticated user with admin-area access to inject script via the eventSubject parameter in the Live Event History page, and the payload executes in a victim's browser when that page is viewed. Publicly available exploit code exists, but exploitation requires admin-area access and a separate victim to load the affected page; the assessed impact is integrity-only with no confidentiality or availability loss. This is a low-to-moderate real-world risk that scores higher on paper than in practice.
Stored cross-site scripting (XSS) in code-projects Human Resource Management 1.0 lets an authenticated, low-privileged user inject arbitrary JavaScript through the eventSubject argument handled by /humanresourcemanagementsystem/src/store/EventStore.php, which then executes in the browser of any user who views the affected event. Exploitation requires an account able to reach the Event Creation feature plus a victim who renders the malicious event (UI:P), and publicly available exploit code exists; there is no confirmed active exploitation (not in CISA KEV). Independent assessment rates real-world risk as low because of the authentication prerequisite, the dependence on victim interaction, the scope change toward other users in the same origin, and the very small deployment base of this product.
Code injection in osCommerce2 (versions through 2.3.4.1) allows an attacker who already holds high backend privileges - a store administrator able to edit the payment configuration - to manipulate the MODULE_PAYMENT_INSTALLED parameter and have attacker-controlled content pulled into a PHP include() in includes/classes/payment.php. Because the CVSS 4.0 vector carries PR:H and UI:P, the vulnerable payment flow is not reachable by an anonymous shopper and requires at least passive user interaction, which keeps this a medium-severity, post-authentication issue (base score 4.8) rather than a pre-auth remote takeover. Publicly available exploit code exists, and there is no confirmed upstream fix because the project has not responded to the reporter's early notification; no EPSS or CISA KEV signal is available for this CVE.
Ghost CMS versions 6.14.0 through before 6.27.0 allow an authenticated staff-level user to read files outside the configured local storage directory through a path traversal issue in the default LocalStorageBase storage adapter. The issue is authentication-gated and low severity, requires an existing staff account created by an administrator, and no public exploit identified at time of analysis; the vendor fixed it in Ghost 6.27.0.
Archive extraction in GnuPG's gpgtar tool (all versions before 2.5.19) can write outside the intended output path: when a user extracts an untrusted archive with the --directory (-C) option into an already-existing, non-empty directory that contains or resolves through a pre-existing symlink, gpgtar follows that link and creates or overwrites a file elsewhere on the filesystem. Exploitation demands substantial victim-side prerequisites - local delivery of a malicious archive, an active extraction the victim must perform, and a target directory that is both non-empty and already symlink-exposed - so the assessed impact is limited to low-integrity and low-availability effects (CVSS 3.1 score 3.6, AV:L/AC:H/PR:N/UI:R), bounded by the extracting user's own filesystem permissions; extraction into a fresh empty directory is expressly not affected. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Front-end request desynchronization in Progress Telerik Fiddler Classic for Windows (versions prior to v6.0.20262.10021) allows a locally positioned, low-privileged actor to send a single malformed request through the proxy's forwarding component and have it split into two requests delivered to the origin server, returning an extra smuggled response on the reused client connection. Exploitation is constrained: it requires local access to the Fiddler proxy (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 3.6), depends on the exact condition of a request carrying both Content-Length and Transfer-Encoding headers combined with connection reuse and pipelining behavior, and is limited to shared or multi-user developer environments rather than production edge deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor-released fix is v6.0.20262.10021.
An out-of-bounds read in Android's camera3 stream splitter (DeprecatedCamera3StreamSplitter.cpp, returnOutputBufferLocked) lets a locally installed, low-privileged application read a small amount of adjacent process memory while camera output buffers are being returned, potentially disclosing limited information on Android 14, 15, 16, 16-qpr2, and 17. The flaw is a missing bounds check reachable only from local code already running on the device (CVSS 3.1 base 3.3, AV:L/PR:L/UI:N, C:L/I:N/A:N), and no public exploit identified at time of analysis, with SSVC assessing exploitation as 'none' and not automatable. The issue is fixed in the October 2026 Android Security Bulletin (2026-10-01) patch level, and this is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform.
Any authenticated staff-level user on a self-hosted Ghost instance running versions 0.7.2 through 6.63.x could infer the relative ordering of other staff users' hashed password values through admin API query options, a low-severity side-channel disclosed as CWE-203 (Observable Discrepancy). The exposure is limited: raw hashes and passwords are never returned, and turning ordering metadata into a usable credential requires substantial additional effort, which is reflected in the CVSS:3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - a trusted staff account is a prerequisite, attack complexity is high, and only low confidentiality impact is assessed. There is no public exploit identified at time of analysis and no indication of active exploitation; the issue is fixed in Ghost 6.64.0 via the upstream PR and commit referenced in the advisory.
Unlimited credential-guessing against the linlinjava litemall admin login endpoint is possible because the application imposes no lockout, throttling, CAPTCHA, or failed-attempt limit on the AdminAuthController in the litemall-admin-api module (CWE-307), affecting versions up to and including 1.8.0. A remote, unauthenticated attacker (CVSS 4.0 vector PR:N) can repeatedly submit password guesses, but exploitation is rated difficult and high-complexity: the flaw only removes the brute-force barrier rather than bypassing authentication, so it still depends on weak, default, or guessable admin credentials and on the admin-api component being deployed and network-reachable. Publicly available exploit code exists, and the vendor has not responded to the issue report; impact is confined to low confidentiality with no integrity or availability effect, making this a genuinely low-priority issue despite the public documentation.
Server-side request forgery in the Ghost CMS webhooks feature (versions 1.18.0 through releases prior to 6.27.0) allows an authenticated staff user who can create or edit webhooks to point a webhook target_url at internal hosts and force the Ghost server to issue requests to them. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) confirms this is a network-reachable but privileged-account-required issue whose impact is limited to low confidentiality loss - blind or semi-blind probing rather than response retrieval or code execution - and there is no public exploit identified at time of analysis. Ghost 6.27.0 fixes the issue by routing webhook delivery through a request library that blocks internal IPs unless the operator explicitly opts in via a new configuration flag.
Argument injection in the OpenPrinting CUPS mailto notifier can let a low-privileged user or authorized subscription creator influence the configured sendmail command when CUPS email notifications are enabled. Exploitation requires a crafted notify-recipient-uri beginning with '-' and an MTA that interprets it as an option; the assessed risk is low because email notification is non-default, CUPS is typically local-only (AV:L), complexity is high, and impact is limited to low confidentiality and integrity in the assessed vector. No public exploit identified at time of analysis. Affected deployments include upstream OpenPrinting CUPS and CUPS in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images.
Use-after-free in the TXTP file handler of vgmstream (the open-source video-game audio decoding library) affects builds up to and including revision r2117, specifically the make_group_random function in src/meta/txtp_process.c. The flaw is triggered when a locally processed TXTP playlist file uses a random group definition, causing a stale VGMSTREAM pointer to be dereferenced after the group structure is rebuilt; the vendor rates it CVSS 4.0 2.4 (AV:L/PR:L/UI:P), and the independent assessment agrees on local-only, user-interaction-gated reachability with limited impact (C:L/I:L/A:L), making a crash/denial-of-service the most plausible outcome rather than code execution. There is no CISA KEV entry and no public exploit identified at time of analysis. An upstream fix exists as commit ae37662ad626254ddd96ad69ac263792d7a92024.
Zabbix Server and Proxy can be crashed by a crafted binary item value containing a NULL byte, causing loss of monitoring availability on deployments that use MySQL or MariaDB as the Zabbix backend database. Exploitation is not anonymous: the CVSS vector (PR:L) indicates an authenticated, low-privileged user able to submit binary item values is required, and the attack additionally depends on a specific input condition (AT:P), which is why the vendor-assigned severity is low (CVSS 4.0 base 2.3) and our independent assessment matches at CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV); impact is confined to availability, with no confirmed data exposure, integrity loss, or code execution.
Request forgery in MongoDB Controllers for Kubernetes allows an authenticated user who can modify an OpsManager custom resource to cause unintended administrative changes in Enterprise Ops Manager when backup reconciliation is enabled. The flaw involves insufficient escaping of Ops Manager backup store identifiers when the controller builds admin API request paths. It is a low-severity issue with no public exploit identified at time of analysis, and the vendor fixed it in MongoDB Controllers for Kubernetes 1.13.0.
Trailing-slash directory redirects emitted by Chainguard Academy's nginx configuration downgrade clients to plaintext HTTP, because the redirect is built from the $scheme variable and TLS terminates at the Cloud Run load balancer in front of Nginx, making $scheme evaluate to "http". An attacker who already holds an on-path (MITM) network position can therefore read or modify documentation content delivered to a victim who requests a slashless directory path over HTTPS, but only when the client does not enforce HSTS - command-line HTTP clients and scripts that follow redirects are affected, while HSTS-preload browsers are not, since the .dev top-level domain is on the preload list. This is a low-severity issue (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R with low integrity impact only), and no public exploit was identified at time of analysis.
Reflected cross-site scripting in feelcrm-os 1.0.0 lets remote attackers execute arbitrary script in a victim's browser by crafting a URL whose redirect_url argument is rendered unsanitized by IndexController::index in App/ThinkPHP/Common/functions.php. Exploitation requires no authentication of the attacker (CVSS PR:N in both the vendor and independent vectors) but does require victim interaction - a user must open the attacker-supplied link, which sharply limits mass exploitation, and impact is integrity-only on the client side with no server-side confidentiality or availability loss. Publicly available exploit code exists and the issue was reported to the maintainers via GitHub issue #2, but the project has not responded; no vendor-released patch or KEV listing is identified at time of analysis, and EPSS or KEV corroboration is absent.
Mass assignment in Jeebase 0.0.1 allows an authenticated remote attacker to inject unintended object attributes through the updateUser function of UserService, reachable at /user/update/info via the user/tempUser parameter. The flaw (CWE-913) lets an attacker set properties on the bound object beyond intended profile fields, producing low-impact data manipulation or information disclosure, and publicly available exploit code exists. The vendor has not responded to the issue report and no official patch is available at time of analysis; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, making this a low-priority, high-noise finding typical of small-project disclosures.
An authenticated low-privilege user of a dotnet eShop (.NET 8) deployment can read order records belonging to other customers by manipulating the OrderNumber argument accepted by the GetOrderAsync function in the Ordering API (src/Ordering.API/Apis/OrdersApi.cs). The flaw is an improper control of resource identifiers issue (CWE-99) tagged as Information Disclosure and scored only 2.1 by the CNA (CVSS 4.0 vector), with our independent assessment at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - confidentiality-only impact with no code execution or data modification. Exploitation requires a valid account (PR:L), no CISA KEV evidence of active exploitation is present, and no vendor-released patch has been identified because the maintainers have not yet responded to the report (GitHub issue #996); note that the CNA's CVSS 4.0 vector marks exploit maturity as E:P, indicating publicly available exploit code exists, but that eShop is a Microsoft reference sample application rarely run in production, which keeps realistic risk low.
Server-side request forgery in O2OA up to and including 10.0.1-ce lets an authenticated, low-privileged user force the application server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted fileUrl argument to the ActionUploadExcelWithUrl handler in the General Module. Publicly available exploit code exists and the flaw is remotely reachable, but impact is limited to low confidentiality exposure (CVSS 3.1 base of 2.1, PR:L, C:L with no integrity or availability effect), so this is a low-priority issue despite the SSRF classification. The vendor was notified through a GitHub issue report and has not responded, so no patched release is identified at time of analysis.
Authorization bypass in the kishor-23 Food Waste Management System (a PHP web application) allows an authenticated low-privilege user to send a crafted remote request to admin/admin.php and manipulate the 'Name' argument processed by the Role Attribute Handler, thereby obtaining elevated role attributes and reaching administrative functionality across multiple endpoints. Upstream has not responded to the early issue report, the project does not use versioning, and publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept), though the issue is not listed in CISA KEV and no active exploitation is confirmed. Consistent with our independent assessment, impact is limited to low confidentiality, integrity and availability loss, so this is a low-priority but still remediable flaw that requires only a standard authenticated account and no user interaction.
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
Authenticated code injection in osCommerce 2.x through 2.3.4.1 allows an attacker who already holds administrator credentials to manipulate the 'module' argument processed by the include logic in admin/newsletters.php (Newsletter Management component), causing attacker-influenced code to be injected into the PHP execution path. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, only users with valid admin-level access to the backend can reach the vulnerable code, and the realistic impact is limited to low confidentiality, integrity and availability effects rather than full server takeover. Publicly available exploit code exists per the CVSS 4.0 E:P metric and the vendor disclosure, but there is no confirmed active exploitation (no CISA KEV listing), and the project has not responded to the issue report, so no fixed release is currently published.
SourceCodester Drug Recommendation System 1.0 does not encrypt passwords submitted through the Password Handler in Admin/add_user.php, so an authenticated administrator can cause sensitive password data to be handled without cryptographic protection. Exploitation requires a high-privilege admin session (PR:H) and yields only low confidentiality impact, and the independent assessment classifies this as a low-priority, high-noise issue rather than a genuine threat. Publicly available exploit code exists, but no confirmed active exploitation is indicated by the supplied data.
Stored cross-site scripting in the 'Microsoft Exchange mailbox' field of the Mitel MiVoice Office 400 web portal lets a high-privileged authenticated user persist JavaScript that executes when another administrator opens the affected user's properties, disrupting access to user-management functions rather than enabling broad system compromise. The issue is rated low severity (CVSS 1.9; assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and there is no indication of confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. Exploitation requires access to Configuration → Users → Users List over HTTPS on TCP 443 and a subsequent victim viewing the record, so it is not remotely triggerable against unauthenticated or default-facing surfaces.
Authenticated users with high privileges can inject persistent JavaScript into the MiVoice Office 400 web portal's Configuration → Domains 'Description' field, leading to stored XSS that executes in the browser of any other administrator viewing the page. This can alter page content, facilitate phishing within the trusted application context, and potentially steal session data, though the impact is confined to the browser context with no OS-level compromise or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the issue carries a low severity rating (CVSS 3.1 ~3.9; CVSS 4.0 1.9).