PHP CVE-2025-11422

We need to produce a JSON object with all the fields as specified. Use all the data from the multi-source intelligence. Note the assigned CVSS is CVSS:4.0, not 3.1. There's also a CVSS score 5.5 but it's 4.0 vector. We must synthesize, not just paraphrase. The description: Campcodes Advanced Online Voting Management System 1.0, file /admin/login.php, unknown function, username argument leads to SQL injection, remote, exploit disclosed.

We have EPSS 0.03%, low. POC publicly available. No KEV mentioned. CPE: campcodes:advanced_online_voting_system:1.0. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') but likely SQL injection is CWE-89; they gave CWE-74 which is a parent. Could mention that.

The references: GitHub with exploit (vul/issues/5), vuldb links, campcodes.com.

CVSS:4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. So unauthenticated, network, low complexity, no user interaction, low impact on all three (Confidentiality, Integrity, Availability), but scope is none so only vulnerable system. Exploit maturity is Proof-of-Concept (E:P). So overall base score 5.5, which is medium. The 4.0 score is 5.5 (Base). In our assessed CVSS vectors, we'll need to give both 3.1 and 4.0. We must not just copy; we need to provide our own independent assessment grounded in description. Since the description is a typical SQLi with username parameter, remote, unauthenticated (likely /admin/login.php is login page, so no authentication required to send request), low complexity, but impact? SQL injection can lead to data leakage (confidentiality), maybe data modification (integrity) but might be limited. Possibly could lead to admin access depending on SQL. The CVSS 4.0 they gave says low impact on C/I/A, no scope change. That's plausible for a login page SQLi where you can bypass authentication and maybe extract data. I'd assess similar: CVSS 3.1: maybe AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's ba