Pet Grooming Software CVE-2026-75014

The CVSS 4.0 vector specifies PR:N and UI:N, indicating no authentication or user interaction is required per the reporter's assessment. The vulnerable endpoint /admin/get_barcode_data.php must be network-reachable - any internet-facing deployment without additional access controls on the /admin/ path is directly exploitable via a single HTTP request containing a malicious barcode parameter value. A notable discrepancy exists: the /admin/ URL path conventionally implies an administrative interface that may enforce a login session in some deployment configurations; if such a session gate is present and enforced, exploitation would require valid credentials (PR:L or PR:H). The PR:N CVSS rating implies the reporter assessed the endpoint as reachable without authentication, but this should be independently verified against the running application. Exploitation is bounded by: the product's narrow deployment footprint (primarily small or hobbyist installations), any IP-level network restriction on the /admin/ path, and the absence of a documented mass exploitation campaign.

The CVSS 4.0 score of 5.5 (Medium) reflects constrained per-instance impact - confidentiality, integrity, and availability are each rated Low - yet the threat modifier E:P (exploit public) in the provided vector significantly elevates practical urgency. The attack requires no privileges (PR:N), no user interaction (UI:N), and targets a network-accessible endpoint (AV:N/AC:L/AT:N), making any internet-exposed instance trivially reachable by automated scanning tools. Even a mid-sized municipal IT team in boleslawiec deploying this software on a public-facing server should treat this as an urgent remediation rather than a deferred Medium-tier issue, because the published POC eliminates any meaningful skill barrier. The primary structural mitigant is the product's narrow deployment footprint - this is free hobbyist PHP software with no meaningful enterprise presence - which substantially bounds population-level blast radius. No EPSS score was provided in the input data; KEV status is unconfirmed, indicating no documented mass exploitation campaign, though the public POC lowers that threshold. The CVSS PR:N rating warrants independent verification given the /admin/ path, which may imply session-gating in some deployments.

A remote attacker scans for internet-facing instances of Pet Grooming Management Software and sends a crafted HTTP request to /admin/get_barcode_data.php with a SQL injection payload appended to the barcode parameter - for example, injecting a UNION SELECT clause to retrieve credential hashes or administrative data from the database. A published proof-of-concept at https://github.com/niaoniaollll/cve/issues/1 provides ready-made payload templates, enabling exploitation with minimal SQL injection expertise.