CWE-74

SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.

Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.

SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the supplier edit endpoint `/pages/sup_edit.php` to authenticated remote attackers who can manipulate the `ID` parameter to interact with the underlying database. The vulnerability allows low-privileged authenticated users to read, modify, or potentially delete database records via crafted SQL payloads. A public exploit has been released (reflected in CVSS 4.0 E:P), though no active exploitation or CISA KEV listing has been identified; the realistic risk is bounded by the product's narrow deployment footprint as a student/demo PHP codebase.

SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.

Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.

Injection via unsanitized namespace identifiers in the MongoDB Rust Driver's Client::bulk_write operation allows an authenticated actor who can influence database or collection name arguments to redirect write operations to an unintended database within the same MongoDB deployment, using the application's own credentials. All versions of the mongodb crate prior to v3.8.2 are affected per vendor release notes; no public exploit or CISA KEV listing exists at time of analysis. The high integrity impact (VI:H in the CVSS 4.0 vector) reflects the potential for unauthorized modification of co-tenanted or privileged data across application-enforced logical boundaries.

Input injection in MongoDB libmongocrypt's automatic-encryption context setup permits caller-supplied database and collection name arguments containing '.' or NUL bytes to pass without sanitization, causing incorrect schema selection during Client-Side Field Level Encryption (CSFLE) operations. Affected callers - those with local access and low privileges - may obtain limited unauthorized disclosure or modification of data processed under the wrong encryption schema. No public exploit code exists and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.0 reflects the constrained real-world impact.

Unauthenticated arbitrary PHP function invocation in the Tutor LMS WordPress plugin before 4.0.6 lets remote attackers overwrite internal template variables via request data and call any zero-argument PHP function, returning its output to the attacker. This enables information disclosure and potentially broader compromise depending on which functions are reachable. Publicly available exploit code exists (reported by WPScan), though the flaw is not listed in CISA KEV.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin login endpoint to unauthenticated remote exploitation via the email parameter in /admin/ajax.php?action=login2. The flaw allows attackers to manipulate SQL queries sent to the backend database, enabling authentication bypass and potential data exfiltration or modification. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing is present, but the exploit's public availability materially lowers the barrier to exploitation.

Injection via improper neutralization of special elements in Plesk's DNS zone management functionality enables remote authenticated users to read arbitrary local files and escalate privileges on the hosting server. Affecting all tracked versions of WebPros Plesk (CPE wildcard), this flaw combines information disclosure and privilege escalation into a single exploitable path, making it a high-impact post-authentication threat. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact across confidentiality, integrity, and availability warrant prompt remediation.