Is there a public PoC exploit available for CVE-2025-14585?

Yes, a public proof-of-concept exploit is available for CVE-2025-14585. Prioritise patching immediately. EPSS: 0.1%.

Covid Tracking System CVE-2025-14585

Q: What is the CVSS score of CVE-2025-14585?

CVE-2025-14585 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-12 cna@vuldb.com

SQLi Covid Tracking System Angeljudesuarez

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:23 vuln.today

CVE Published

Dec 12, 2025 - 23:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=zone. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.

AnalysisAI

SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID parameter in the admin zone page. Exploit code is publicly available, though no active exploitation is confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and a low EPSS probability (0.07%), indicating limited real-world risk despite the public exploit.