PHP CVE-2025-7128

We need to produce a JSON with all the specified fields. Let's synthesize the data.

First, extract relevant info:

• CVE ID: CVE-2025-7128
• Product: Campcodes Payroll Management System 1.0 (from description, CPE, tags). The product_name field should be "Payroll Management System" (1-3 words). Could be "Campcodes Payroll Management System" if that's the product name? But the description says "Campcodes Payroll Management System 1.0". The product is the Payroll Management System by Campcodes. I'll use "Payroll Management System" as the primary product name, but note it's from Campcodes. I'd go with "Payroll Management System" — 3 words.
• summary: Must be original synthesis. It's SQL injection in the file /ajax.php?action=calculate_payroll via the ID parameter. Remote attack. Exploit disclosed. CVSS 4.0 vector given, but only base score 5.5 with N impacts all low. EPSS 0.06%, very low. POC available but not KEV. No active exploitation known. So summary: "SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=calculate_payroll. Exploit code is publicly available, though no active exploitation has been confirmed. Successful exploitation could lead to data leakage or modification."
• technical_context: CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but SQL injection is a more specific CWE-89. However NVD assigned CWE-74. Underlying technology: PHP web application, using SQL database. CPE confirms exact product version. So explain that the vulnerability arises from improper input validation in the Payroll Management System's AJAX endpoint, leading to SQL injection.
• risk_assessment: Use CVSS 4.0 vector given: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So network vector, low complexity, no privileges, no user interaction, low impact on confidentiality, integrity, availability (all L). No subseq