PHP-Guitar-Shop CVE-2025-14091

Q: What is the CVSS score of CVE-2025-14091?

CVE-2025-14091 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-201422 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-05 cna@vuldb.com

PHP SQLi

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network attack with low complexity, no privileges or user interaction, limited low impact to all three CIA properties.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 15, 2026 - 17:08 euvd

EUVD-2025-201422

Analysis Generated

Mar 15, 2026 - 17:08 vuln.today

CVE Published

Dec 05, 2025 - 16:15 nvd

HIGH 7.3

DescriptionCVE.org

A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555. This vulnerability affects unknown code of the file /product.php of the component Product Details Page. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

SQL injection in PHP-Guitar-Shop allows remote, unauthenticated attackers to manipulate the ID parameter of /product.php, compromising the underlying database with low impact. All rolling-release versions up to commit 6ce0868889 are affected, and a public proof-of-concept exploit is available. Despite the network-accessible attack vector, EPSS indicates a very low probability of real-world exploitation.

Technical ContextAI

The vulnerability exists in the PHP-Guitar-Shop web application, specifically in the Product Details Page component provided by /product.php. The flaw arises from insufficient sanitization of user-supplied input in the ID argument when constructing SQL queries. This is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which in this context manifests as SQL injection. Since the application is built with PHP and likely interacts with a relational database, an attacker can inject arbitrary SQL code, potentially reading, modifying, or deleting data.

RemediationAI

No official vendor-released patch is available as of this analysis because the vendor did not respond to disclosure. As an urgent workaround, deploy a web application firewall rule that blocks SQL injection patterns targeting the ID parameter of /product.php, or temporarily restrict access to the product details page. If feasible, manually apply input sanitization to the ID parameter using parameterized queries or prepared statements within the application code. Note that these mitigations may affect functionality or require code changes without vendor support.