Is there a public PoC exploit available for CVE-2025-8376?

Yes, a public proof-of-concept exploit is available for CVE-2025-8376. Prioritise patching immediately. EPSS: 0.1%.

Vehicle Management CVE-2025-8376

Q: What is the CVSS score of CVE-2025-8376?

CVE-2025-8376 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-31 cna@vuldb.com

PHP SQLi Vehicle Management Code Projects

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated SQL injection with no user interaction; impact limited to partial data read and write, with no described availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 11:38 vuln.today

CVE Published

Jul 31, 2025 - 10:15 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability classified as critical has been found in code-projects Vehicle Management 1.0. Affected is an unknown function of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

SQL injection in code-projects Vehicle Management 1.0 exposes the /updatebal.php endpoint to remote, unauthenticated database manipulation via the unsanitized company parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.

Technical ContextAI

The affected product is a PHP-based web application, code-projects Vehicle Management 1.0 (CPE: cpe:2.3:a:code-projects:vehicle_management:1.0:*:*:*:*:*:*:*), distributed via code-projects.org as a demo or educational codebase. The root cause is CWE-74 (Injection): specifically, the /updatebal.php script incorporates the HTTP-supplied company parameter directly into a SQL query without parameterization or input sanitization, allowing an attacker to append arbitrary SQL syntax. This class of vulnerability arises from the absence of prepared statements or equivalent defense in the PHP data-access layer, a pervasive pattern in rudimentary PHP projects that bypass modern frameworks.

RemediationAI

No vendor-released patch has been identified at the time of analysis. Developers should immediately refactor /updatebal.php to use prepared statements with bound parameters via PHP's PDO or MySQLi extensions, eliminating the SQL injection surface at the root cause. As a compensating control, web server access controls (e.g., Apache .htaccess or nginx location blocks) or firewall rules should restrict access to /updatebal.php to trusted IP ranges, reducing exposure until a code fix is deployed - note this does not eliminate the vulnerability but limits who can reach the endpoint. Input validation rejecting SQL metacharacters in the company field provides a shallow additional layer but should not be treated as a primary mitigation. The public POC is documented at https://github.com/wllovemy/cve/issues/4 and VulDB entry https://vuldb.com/?ctiid.318348.