Is there a public PoC exploit available for CVE-2025-14834?

Yes, a public proof-of-concept exploit is available for CVE-2025-14834. Prioritise patching immediately. EPSS: 0.0%.

Simple Stock System CVE-2025-14834

Q: What is the CVSS score of CVE-2025-14834?

CVE-2025-14834 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-12-17 cna@vuldb.com

PHP SQLi Simple Stock System Carmelo

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:48 vuln.today

DescriptionCVE.org

A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.

Technical ContextAI

Simple Stock System 1.0 is a PHP-based web application vulnerable to CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, aka Injection). The /checkuser.php endpoint fails to properly sanitize or parameterize the Username input parameter before incorporating it into SQL queries. CWE-74 encompasses multiple injection types; in this case SQL injection (SQLi) allows an authenticated user to craft malicious SQL syntax within the Username field to alter query logic, potentially bypassing authentication, reading unauthorized data, or modifying database contents.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation requires implementing parameterized queries (prepared statements) in the /checkuser.php endpoint to neutralize SQL injection; if the application source code is accessible (code-projects.org hosts open-source projects), apply input validation using allowlist-based filtering on the Username parameter to accept only alphanumeric characters and underscore, rejecting or escaping SQL metacharacters. If modifying source code is not feasible, restrict network access to /checkuser.php via web application firewall rules blocking requests with SQL syntax patterns (e.g., UNION, SELECT, OR 1=1), and enforce strong authentication controls to limit who can reach the endpoint. Upgrade to any patched version released by the vendor, or consider switching to an actively maintained inventory management system if no patch timeline is provided.