Which versions of PHP are affected by EUVD-2025-21333?

A critical SQL injection vulnerability in Job Diary 1.0 allows remote attackers to compromise database integrity and potentially exfiltrate sensitive data without authentication.

Is there a public PoC exploit available for EUVD-2025-21333?

Yes, a public proof-of-concept exploit is available for EUVD-2025-21333. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2025-21333?

Within 24 hours: Inventory all systems running Job Diary 1.0 and restrict network access to /view-cad.php via firewall rules. Within 7 days: Deploy Web Application Firewall (WAF) rules to block SQL injection patterns targeting the ID parameter, and implement input validation if accessible. Within 30 days: Plan migration to a patched version or alternative solution when vendor releases a security update, or consider decommissioning the application if business-critical.

PHP EUVD-2025-21333

Q: What is the CVSS score of EUVD-2025-21333?

EUVD-2025-21333 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2025-7595 MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-07-14 cna@vuldb.com

PHP SQLi Job Diary Anisha

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

HIGH MEDIUM

CVSS changed

Apr 29, 2026 - 01:11 NVD

7.3 (HIGH) 5.5 (MEDIUM)

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21333

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

PoC Detected

Jul 15, 2025 - 18:27 vuln.today

Public exploit code

CVE Published

Jul 14, 2025 - 11:15 nvd

HIGH 7.3

DescriptionCVE.org

A vulnerability was found in code-projects Job Diary 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /view-cad.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

A critical SQL injection vulnerability exists in code-projects Job Diary 1.0 via the ID parameter in /view-cad.php, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, and while the CVSS score is 7.3 (High), the unauthenticated attack vector and low complexity suggest active exploitation is likely. No patch has been confirmed available as of this analysis.

Technical ContextAI

Job Diary 1.0 is a PHP-based web application (CPE likely: cpe:2.3:a:code-projects:job_diary:1.0:*:*:*:*:*:*:*). The vulnerability stems from CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, 'Injection'), specifically SQL injection (CWE-89). The /view-cad.php endpoint fails to properly sanitize or parameterize the ID parameter before incorporating it into SQL queries. This is a classic first-order SQL injection vulnerability where user-supplied input is directly concatenated into SQL statements without using prepared statements or proper input validation.

RemediationAI

{'type': 'Primary', 'action': 'Apply vendor patch or upgrade', 'details': 'Contact code-projects for patched version > 1.0. Check project repository (if public) for security updates. Upgrade immediately if patch is available.'} {'type': 'Immediate (Pre-Patch)', 'action': 'Implement parameterized queries', 'details': "Modify /view-cad.php to use prepared statements (mysqli prepared statements or PDO with bound parameters) for all SQL queries involving the ID parameter. Example: $stmt = $mysqli->prepare('SELECT * FROM table WHERE ID = ?'); $stmt->bind_param('i', $_GET['ID']); $stmt->execute();"} {'type': 'Input Validation', 'action': 'Whitelist ID parameter format', 'details': "If ID is numeric, enforce integer-only validation: if (!ctype_digit($_GET['ID'])) { exit('Invalid ID'); }. Validate against expected data types before any database operation."} {'type': 'Network Segmentation', 'action': 'Restrict access to Job Diary', 'details': 'Place application behind WAF or IP whitelist. Disable /view-cad.php access if not currently required.'} {'type': 'Database Hardening', 'action': 'Principle of least privilege', 'details': 'Ensure database user running Job Diary queries has minimal required permissions. Disable statement-level backup/restore capabilities if possible.'}