EUVD-2026-31630
GHSA-wq97-gxrp-9qqp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in KLiK SocialMediaWebsite 1.0. This issue affects some unknown processing of the component HTTP POST Request Parameter Handler. Such manipulation leads to injection. The attack can be launched remotely. The exploit is publicly available and might be used.
AnalysisAI
Injection vulnerability in KLiK SocialMediaWebsite 1.0 allows remote unauthenticated attackers to submit crafted HTTP POST request parameters to the application's input handler, achieving partial compromise of confidentiality, integrity, and availability. Classified under CWE-74 and tagged as Code Injection, the flaw carries a CVSS 4.0 score of 5.5 (Medium) with confirmed proof-of-concept exploit code publicly available (E:P). Despite the POC, EPSS places exploitation probability at 0.04% (14th percentile), indicating low observed real-world exploitation activity and a narrow effective target base.
Technical ContextAI
KLiK SocialMediaWebsite is a web application (CPE: cpe:2.3:a:n/a:klik_socialmediawebsite:*:*:*:*:*:*:*:*) with an unregistered vendor namespace in the NVD CPE dictionary, indicating a small or community-maintained project. The root cause is CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component - a broad injection class encompassing SQL injection, command injection, and code injection subtypes. VulDB tags this specifically as Code Injection, suggesting user-supplied POST parameters are passed to an interpreter or evaluator without adequate sanitization or escaping. The CVSS 4.0 vector (AT:N) confirms no special attack requirements beyond network reachability, and the absence of scope change (SC:N/SI:N/SA:N) indicates exploitation is confined to the vulnerable application tier with no lateral impact to adjacent systems.
RemediationAI
No vendor-released patch has been identified at time of analysis; the CPE entry carries no registered vendor, and the VulDB submission references (https://vuldb.com/submit/813734, https://vuldb.com/submit/813736) do not confirm a fixed version. As a compensating control, operators should implement a web application firewall (WAF) with rules targeting injection payloads in POST body parameters, accepting the trade-off that WAF rules may produce false positives requiring tuning. Input validation and output encoding should be applied at all POST parameter entry points within the application code, prioritizing parameters processed by interpreters or template engines. If the application is not actively used, taking it offline or restricting access to trusted IP ranges eliminates the network attack vector entirely with no functional trade-off for non-users. Refer to https://vuldb.com/vuln/365403 and https://nvd.nist.gov/vuln/detail/CVE-2026-9422 for updated advisory information as the vendor situation evolves.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today