Is there a public PoC exploit available for CVE-2025-8239?

Yes, a public proof-of-concept exploit is available for CVE-2025-8239. Prioritise patching immediately. EPSS: 0.1%.

Exam Form Submission CVE-2025-8239

Q: What is the CVSS score of CVE-2025-8239?

CVE-2025-8239 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-27 cna@vuldb.com

SQLi Exam Form Submission Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Remote, low complexity, no privileges or user interaction, limited impact on all three security properties.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:10 vuln.today

CVE Published

Jul 27, 2025 - 19:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical was found in code-projects Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.

Technical ContextAI

The vulnerability lies in a PHP-based web application (Code-Projects Exam Form Submission) that handles form data. The CWE-74 (Injection) root cause points to improper neutralization of user-supplied email input within the administrative interface (/admin/). The email parameter is directly embedded in SQL queries without parameterization or sanitization, enabling classic SQL injection. The CPE cpe:2.3:a:code-projects:exam_form_submission:1.0:*:*:*:*:*:*:* identifies the sole affected version.

RemediationAI

No vendor-released patch is available. As an immediate workaround, restrict access to the /admin/ endpoint by IP whitelisting at the web server or WAF level, though this may block legitimate administrative users. Deploy a WAF rule that sanitizes or rejects SQL metacharacters in the email parameter. Consider migrating to a maintained alternative, as the project appears unmaintained by the original developer (code-projects).