Is there a public PoC exploit available for CVE-2025-14531?

Yes, a public proof-of-concept exploit is available for CVE-2025-14531. Prioritise patching immediately. EPSS: 0.1%.

Rental Management System CVE-2025-14531

Q: What is the CVSS score of CVE-2025-14531?

CVE-2025-14531 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-11 cna@vuldb.com

Java Code Injection Rental Management System Carmelo

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:45 vuln.today

DescriptionCVE.org

A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of the component Log Handler. Performing manipulation results in crlf injection. The attack can be initiated remotely. The exploit has been made public and could be used.

AnalysisAI

CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.

Technical ContextAI

CRLF (carriage return/line feed) injection is a CWE-74 code injection vulnerability affecting the Log Handler component within Transaction.java of the Rental Management System. The flaw allows injection of CR/LF sequences into log output, typically enabling log manipulation, log forgery, or bypass of log-based security controls. This is a Java application vulnerability classified as a code injection issue where unsanitized user input reaches logging functions, allowing attackers to insert newline characters that break log record boundaries and inject arbitrary log entries.

RemediationAI

Upgrade to a patched version of Rental Management System if available from the vendor at https://code-projects.org/. No specific patch version number is provided in available sources. As an interim compensating control, implement input validation and sanitization in the Log Handler to reject or escape CR/LF characters (0x0D, 0x0A) before they reach logging functions. Restrict application access to trusted users only by enforcing strong authentication and auditing account grants, limiting the pool of potential attackers. Monitor log files for suspicious patterns such as multiple consecutive newlines or unexpected log entries, which may indicate injection attempts. These controls address the attack surface but do not eliminate the underlying flaw and should not delay patching.