What is the CVSS score of CVE-2025-11514?

CVE-2025-11514 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-11514?

Yes, a public proof-of-concept exploit is available for CVE-2025-11514. Prioritise patching immediately. EPSS: 0.0%.

Online Complaint Site CVE-2025-11514

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-09 cna@vuldb.com

PHP SQLi Online Complaint Site Fabian

2.1

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with valid credentials
Delivery

Navigate to /cms/users/index.php
Exploit

Submit SQL injection payload in Username parameter
Execution

Execute arbitrary SQL query
Impact

Extract or modify application data

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions	SPECIFIC CONDITIONS REQUIRED: (1) Attacker must possess valid login credentials to the Online Complaint Site application (PR:L from CVSS vector); (2) The vulnerable /cms/users/index.php endpoint must be accessible after authentication; (3) The application must fail to sanitize or parameterize the Username input parameter before use in SQL query construction. LIMITING FACTORS: Authentication requirement (PR:L) prevents unauthenticated exploitation. Low impact ratings (VC:L/VI:L/VA:L) indicate SQL injection is constrained, possibly by limited database permissions or output filtering. No data suggests the application runs with administrative database privileges, which would unlock higher-impact data exfiltration. Default installation assumed; no indication non-default configuration is required to trigger the flaw.
Impact	Risk is low despite public exploit availability. CVSS 4.0 vector specifies AV:N (network), AC:L (low complexity), and PR:L (low privilege required), confirming remote exploitation requires authentication. EPSS 0.03% (8th percentile) indicates minimal historical exploitation probability. The impact scope is limited to low confidentiality, low integrity, and low availability (VC:L/VI:L/VA:L) with no scope change. CVSS E:P (exploit proof-of-concept exists) aligns with GitHub POC references but does not elevate real-world priority given the authentication gate and constrained impact. This appears a documented but low-priority issue suitable for queued patching rather than emergency response. The mismatch between public POC and low EPSS suggests the vulnerability requires valid credentials and the targeted application has limited deployment footprint.
Exploit ScenarioDerived	An authenticated user with low-privilege access to the Online Complaint Site application crafts a malicious SQL injection payload in the Username field of /cms/users/index.php (e.g., Username=admin' OR '1'='1). If the application concatenates this input into an unparameterized SQL query, the attacker can bypass authentication logic or extract user data from the database.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 29, 2026

SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate remediation requires either upgrading to a patched version from the developer (if available) or implementing input validation and parameterized queries in the Username parameter handler. Specific compensating controls: (1) Apply Web Application Firewall (WAF) rules to detect and block SQL injection payloads in the Username field (trade-off: false positives may block legitimate usernames with special characters); (2) Restrict /cms/users/index.php access by IP allowlist to authorized administrators only (trade-off: reduces operational flexibility for remote administration); (3) Enforce prepared statements and stored procedures in the PHP code if source is available. Contact code-projects.org for patch availability status. Monitor vuldb.com entry #327639 for updates.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a SQL injection flaw (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affecting a PHP application endpoint. The issue stems from unsanitized user input in the Username parameter passed to /cms/users/index.php without proper parameterized query usage or input validation. The affected product is a complaint management system (cpe:2.3:a:fabian:online_complaint_site:1.0:*:*:*:*:*:*:*) developed by fabian, suggesting a small-scale or educational web application rather than enterprise software.

Know when Online Complaint Site gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A vulnerability was identified in code-projects Online Complaint Site 1.0. This vulnerability affects unknown code of the file /cms/users/index.php. Such manipulation of the argument Username leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.