Is there a public PoC exploit available for CVE-2025-8374?

Yes, a public proof-of-concept exploit is available for CVE-2025-8374. Prioritise patching immediately. EPSS: 0.1%.

Vehicle Management CVE-2025-8374

Q: What is the CVSS score of CVE-2025-8374?

CVE-2025-8374 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Vehicle Management Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated endpoint; confidentiality and integrity impacts limited to application database; no availability impact confirmed from basic SQL injection.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:39 vuln.today

CVE Published

Jul 31, 2025 - 09:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in code-projects Vehicle Management 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /addcompany.php. The manipulation of the argument company leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Management 1.0 exposes the /addcompany.php endpoint to unauthenticated remote attackers who can manipulate the company parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.

Technical ContextAI

The affected product is code-projects Vehicle Management version 1.0, a PHP-based web application (CPE: cpe:2.3:a:code-projects:vehicle_management:1.0). The root cause is CWE-74 (Injection), specifically SQL injection: the company parameter submitted via HTTP to /addcompany.php is incorporated into a backend SQL query without adequate sanitization or use of parameterized queries. This allows an attacker to alter the query's logic, enumerate schema, extract records, or manipulate database contents. The PHP tag confirms server-side scripting with direct database interaction, a classic unsanitized-input-to-query pattern.

RemediationAI

No vendor-released patch has been identified at time of analysis. The primary fix requires modifying /addcompany.php to use parameterized queries or prepared statements (e.g., PHP PDO or MySQLi prepared statements) for the company parameter, which eliminates the injection vector entirely. As a compensating control, a web application firewall (WAF) rule blocking SQL metacharacters (quotes, comment sequences, SQL keywords) in the company parameter can reduce exploitation risk, though overly broad rules may block legitimate company names containing apostrophes. Restricting access to the /addcompany.php endpoint to authenticated administrative sessions - or blocking it at the network perimeter if not required externally - significantly limits the attack surface given that PR:N is the current baseline. Monitor VulDB at https://vuldb.com/?id.318346 and the code-projects repository at https://code-projects.org/ for any upstream patches.