Is there a public PoC exploit available for CVE-2025-12306?

Yes, a public proof-of-concept exploit is available for CVE-2025-12306. Prioritise patching immediately. EPSS: 0.0%.

Nero Social Networking Site CVE-2025-12306

Q: What is the CVSS score of CVE-2025-12306?

CVE-2025-12306 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-27 cna@vuldb.com

PHP SQLi Nero Social Networking Site Fabian

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible unauthenticated SQLi with no user interaction; partial C/I/A impact and no scope change consistent with typical unsanitized query injection without confirmed full-DB compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:11 vuln.today

CVE Published

Oct 27, 2025 - 19:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in code-projects Nero Social Networking Site 1.0. Affected is an unknown function of the file /acceptoffres.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

SQL injection in Nero Social Networking Site 1.0 exposes the /acceptoffres.php endpoint to unauthenticated remote database manipulation via the unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.

Technical ContextAI

The affected product is Nero Social Networking Site version 1.0, a PHP-based social networking application distributed by 'fabian' via code-projects.org (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0:*:*:*:*:*:*:*). The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), which in this instance manifests as a classic SQL injection: the ID parameter passed to /acceptoffres.php is concatenated directly into a backend SQL query without parameterization or input sanitization. This is a well-understood failure pattern in PHP applications that do not use prepared statements or an ORM layer. The CWE-74 classification is the parent of CWE-89 (SQL Injection), indicating the injection point involves a downstream interpreter - the database engine - consuming attacker-controlled SQL syntax.

RemediationAI

No vendor-released patch has been identified at time of analysis. The definitive code-level fix is to replace dynamic SQL string concatenation in /acceptoffres.php with parameterized queries or prepared statements (e.g., PHP PDO or MySQLi with bound parameters), ensuring the ID parameter cannot alter query structure. As an immediate compensating control, restrict access to /acceptoffres.php via web server configuration (Apache .htaccess or nginx location block) using IP allowlisting or an authentication gateway - note this may break legitimate functionality if the endpoint is publicly used. A WAF rule rejecting SQL metacharacters (quotes, comments, UNION keywords) in the ID parameter provides a secondary layer but can be bypassed by encoding-based obfuscation. Given this is a hobbyist-grade application with no apparent maintenance track, replacing it with an actively maintained alternative is the most durable recommendation for any production context. Advisory context is available at https://vuldb.com/?id.329978.