EUVD-2025-201694Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request to /request.php
-
ExploitInject SQL payload via staff_id parameter
-
ExecutionExecute arbitrary SQL commands
-
ImpactAccess or modify leave management data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Simple Leave Manager 1.0 is possible by sending crafted requests to the /request.php endpoint with the staff_id parameter. The lack of authentication and default low complexity mean exploitation is trivial, but the low impact (only partial control over the database) limits the severity. |
| Impact | CVSS 4.0 rates the vulnerability with a network attack vector, low attack complexity, no privileges or user interaction, and low impact on confidentiality, integrity, and availability (VC:L/VI:L/VA:L). EPSS probability is very low (0.04%, 11th percentile), suggesting unlikely widespread exploitation. The public exploit (PoC) exists but CISA KEV does not list it, indicating no known active exploitation. The missing patch elevates risk slightly, but the overall real-world urgency is moderate due to the low-impact, niche product, and low exploitation probability. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP POST/GET request to /request.php containing a malicious SQL payload in the staff_id parameter. When the application processes the request without sanitization, the injected SQL executes, allowing the attacker to enumerate the database schema, extract sensitive data, modify leave records, or even delete data. A publicly available proof-of-concept exploit on GitHub demonstrates this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
Earlier versions of this analysis (1)
RemediationAI
No vendor-released patch is available. As immediate mitigation, implement parameterized queries or input validation for the staff_id parameter in /request.php. Deploy a web application firewall (WAF) rule to block SQL injection patterns targeting this parameter. Restrict access to /request.php by IP whitelisting if feasible. Review database permissions for the application's database user to enforce least privilege. The absence of an official fix means an upgrade to any future patched version should be prioritized when released, but no advisory or release date exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in a PHP web application, Simple Leave Manager, which processes leave requests. The file /request.php handles staff-related data, and the staff_id parameter is directly inserted into SQL queries without proper sanitization or parameterization, leading to an injection (CWE-74). The affected product is identified by CPE cpe:2.3:a:carmelo:simple_leave_manager:1.0.
Know when Simple Leave Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network exploitable with low complexity, no privileges, no interaction; low impact on all CIA dimensions.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in code-projects Simple Leave Manager 1.0. Affected by this vulnerability is an unknown functionality of the file /request.php. Such manipulation of the argument staff_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
Organizations using A vulnerability face moderate risk from CVE-2025-14223, a injection vulnerability rated CVSS 7.3. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. Proof-of-concept code is publicly available, increasing the risk of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB