Which versions of PHP are affected by CVE-2025-7514?

A publicly disclosed SQL injection vulnerability in Modern Bag 1.0 allows remote attackers to compromise the administrative contact list function without authentication.

Is there a public PoC exploit available for CVE-2025-7514?

Yes, a public proof-of-concept exploit is available for CVE-2025-7514. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-7514?

Within 24 hours: Identify all systems running Modern Bag 1.0 and isolate affected instances from production networks if possible; enable enhanced logging on affected systems. Within 7 days: Deploy Web Application Firewall (WAF) rules to block malicious requests to /admin/contact-list.php with idStatus parameters; implement network segmentation to restrict admin interface access. Within 30 days: Evaluate alternative solutions or upgrade to a patched version when available; conduct forensic audit of access logs for signs of exploitation.

PHP CVE-2025-7514

Q: What is the CVSS score of CVE-2025-7514?

CVE-2025-7514 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-21243 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-13 cna@vuldb.com

PHP SQLi Modern Bag Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:18 euvd

EUVD-2025-21243

Analysis Generated

Mar 16, 2026 - 09:18 vuln.today

PoC Detected

Jul 15, 2025 - 17:41 vuln.today

Public exploit code

CVE Published

Jul 13, 2025 - 04:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Modern Bag 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/contact-list.php. The manipulation of the argument idStatus leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.

Technical ContextAI

This vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), specifically manifesting as SQL injection in a web application context. The vulnerable code in /admin/contact-list.php fails to properly parameterize or sanitize the 'idStatus' parameter before incorporating it into SQL queries. Modern Bag 1.0 is a PHP-based project management or contact management application (based on file naming convention). The attack exploits the application's direct concatenation of user input into SQL statement construction, a fundamental input validation failure. CPE identifier would be: cpe:2.3:a:code-projects:modern_bag:1.0:*:*:*:*:*:*:* (or similar variation). The PHP application likely uses deprecated MySQL extensions or improper prepared statement implementation.

RemediationAI

{'type': 'Primary', 'action': 'Patch Application', 'description': 'Update Modern Bag to a patched version released by code-projects. Check official project repository/website for security updates beyond 1.0.'} {'type': 'Immediate Workaround', 'action': 'Input Validation & Parameterization', 'description': 'Implement prepared statements/parameterized queries for all database interactions in /admin/contact-list.php. Replace direct SQL concatenation with parameterized query placeholders (e.g., PDO prepared statements or mysqli prepared statements in PHP).'} {'type': 'Mitigation', 'action': 'Web Application Firewall (WAF) Rules', 'description': 'Deploy WAF rules to block SQL injection patterns in the idStatus parameter. Block requests containing SQL keywords (SELECT, UNION, OR, AND, DROP, etc.) in that parameter.'} {'type': 'Mitigation', 'action': 'Access Control', 'description': 'Restrict access to /admin/ directory via IP whitelisting, require strong authentication, or move admin interface behind VPN/additional authentication layer until patched.'} {'type': 'Detection', 'action': 'Input Sanitization', 'description': 'Apply SQL escaping functions (mysqli_real_escape_string or equivalent) as a temporary stopgap, though parameterized queries are the definitive solution.'}