What is the CVSS score of CVE-2025-14647?

CVE-2025-14647 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2025-14647?

Yes, a public proof-of-concept exploit is available for CVE-2025-14647. Prioritise patching immediately. EPSS: 0.1%.

Computer Book Store CVE-2025-14647

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-14 cna@vuldb.com

PHP SQLi Computer Book Store Carmelo

5.5

CVSS 4.0 · Vendor: vuldb

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send HTTP request to /admin_delete.php
Delivery

Inject SQL via bookisbn parameter
Exploit

Exploit database query
Execution

Extract or manipulate data
Impact

Impact confidentiality/integrity/availability

Vulnerability Assessment

Weakness	CWE CWE-74 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Input neutralization, injection prevention
Exploitation Conditions	No special conditions-remote unauthenticated exploitation against any instance of Computer Book Store 1.0 with the /admin_delete.php endpoint exposed. The CVSS vector (AV:N/PR:N/UI:N) confirms no authentication or user interaction is required. There are no known limiting factors such as configuration dependencies or platform restrictions.
Impact	CVSS 4.0 base score 5.5 (medium) with AV:N/PR:N/UI:N indicates easy remote unauthenticated exploitation. However, the EPSS probability is only 0.05% (15th percentile), signaling low exploitation likelihood in the wild. While public exploit code is available, there is no inclusion in CISA KEV or vendor confirmation of active attacks. The product is niche, reducing the attack surface. Thus, the vulnerability presents moderate risk-prioritize patching if deployed, but urgency is low.
Exploit ScenarioDerived	An attacker sends a crafted HTTP request to /admin_delete.php with a malicious 'bookisbn' value (e.g., '1 UNION SELECT ...'). This triggers SQL injection, allowing the attacker to extract sensitive data from the database or delete records. A public proof-of-concept is available (GitHub issue #2), lowering the barrier for exploitation.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.

RemediationAI

No vendor-released patch identified at time of analysis. The application is a PHP project; therefore, implement input validation and parameterized queries (e.g., using prepared statements) for the 'bookisbn' parameter in /admin_delete.php. As a workaround, restrict access to /admin_delete.php via web server configuration (e.g., .htaccess IP whitelist) or remove the script if not essential. Note that disabling the script may break administrative functionality.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-74 describes the failure to neutralize special elements in SQL commands. In this PHP-based application, the 'bookisbn' parameter passed to /admin_delete.php is directly concatenated into a SQL query without sanitization. CPE data confirms the exact affected package is carmelo:computer_book_store:1.0, a small project hosted on code-projects.org.

Know when Computer Book Store gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vuldb) PRIMARY 5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 7.3 HIGH

Remote unauthenticated SQL injection with low impact to all three CIA dimensions (consistent with CVSS 4.0 metrics).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vuldb).

CVSS VectorVendor: vuldb

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

A weakness has been identified in code-projects Computer Book Store 1.0. Affected is an unknown function of the file /admin_delete.php. This manipulation of the argument bookisbn causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be exploited.

Threat Intelligence Overview

EPSS Score

0.1%

Top 85% exploitable

Prevalence

Rare

Obscure PHP project, minimal production deployment

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.