Rental Management System
CVE-2025-14531
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid credentials
-
DeliveryAuthenticate to application
-
ExploitSubmit input with CRLF sequences
-
ExecutionLog Handler processes unsanitized input
-
PersistNewlines injected into log file
-
ImpactArbitrary log entries forged
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires prior authentication to the Rental Management System (PR:L in CVSS vector). The attacker must have a valid user account and the ability to submit input that reaches the Log Handler component in Transaction.java, typically through normal application functionality. The vulnerability is triggered when unsanitized input containing CR/LF characters is processed by the logging mechanism. No special configuration or non-default settings are required; the flaw exists in default deployments of version 2.0. Unauthenticated remote exploitation is not possible due to the PR:L requirement, and the attack cannot execute without a valid session. |
| Impact | Risk is LOW despite public exploit availability. CVSS 2.1 with PR:L (requires login) and VI:L (low integrity impact) indicates this is a low-severity issue confined to authenticated users. EPSS score of 0.07% (20th percentile) confirms minimal real-world exploitation probability, suggesting the vulnerability is primarily a log tampering risk rather than a vector for widespread compromise. The public POC does not translate to active exploitation campaigns. CVSS vector shows AV:N/AC:L (network-accessible, low complexity) but PR:L requirement is the critical limiting factor - unauthenticated remote attacks are impossible. Defenders should prioritize this below network-accessible vulnerabilities with PR:N, but should not ignore it in environments where application access is broadly granted. No compensating controls can fully remediate log injection without patching. |
| Exploit ScenarioDerived | An authenticated application user (e.g., employee or contractor with login credentials) sends a crafted request containing CRLF sequences through a function handled by Transaction.java. The Log Handler processes this input without sanitization and writes the injected newlines to application logs, allowing the attacker to forge log entries that obscure their activity or create false audit trails. This could be used to hide malicious actions or frame other users in environments with log-based access controls. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 29, 2026
CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.
RemediationAI
Upgrade to a patched version of Rental Management System if available from the vendor at https://code-projects.org/. No specific patch version number is provided in available sources. As an interim compensating control, implement input validation and sanitization in the Log Handler to reject or escape CR/LF characters (0x0D, 0x0A) before they reach logging functions. Restrict application access to trusted users only by enforcing strong authentication and auditing account grants, limiting the pool of potential attackers. Monitor log files for suspicious patterns such as multiple consecutive newlines or unexpected log entries, which may indicate injection attempts. These controls address the attack surface but do not eliminate the underlying flaw and should not delay patching.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CRLF (carriage return/line feed) injection is a CWE-74 code injection vulnerability affecting the Log Handler component within Transaction.java of the Rental Management System. The flaw allows injection of CR/LF sequences into log output, typically enabling log manipulation, log forgery, or bypass of log-based security controls. This is a Java application vulnerability classified as a code injection issue where unsanitized user input reaches logging functions, allowing attackers to insert newline characters that break log record boundaries and inject arbitrary log entries.
Know when Rental Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of the component Log Handler. Performing manipulation results in crlf injection. The attack can be initiated remotely. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB