nemoTyrant manong EUVD-2026-103376

No special conditions beyond network reachability of the vulnerable code path - per AV:N/AC:L/PR:N/UI:N the flaw is remotely and unauthenticatedly triggerable once a request reaches the cache/del_cache/arr2sql function in func.php. The practical limiting factors are: the affected application ('nemoTyrant manong') must be deployed and must expose the func.php endpoint invoking arr2sql; because it is a rolling-release project with no version boundaries, defenders cannot scope by version and must assume any current deployment is potentially affected until a fixing commit is identified. Impact is inherently bounded to low confidentiality, integrity, and availability effects, limiting the damage of a successful injection.

Signals point to a LOW real-world priority despite a network-reachable, unauthenticated vector. The single provided CVSS is a CVSS 4.0 vector from VulDB (base 6.9, Medium) with AV:N/AC:L/AT:N/PR:N/UI:N - remote, low-complexity, no privileges or user interaction - but impact is capped at VC:L/VI:L/VA:L (low across confidentiality, integrity, and availability) with no scope change, which is consistent with a constrained SQL injection rather than full database or host compromise. No EPSS score, no CISA KEV listing, and no vendor-confirmed POC are present in the input, so there is no evidence of active or probable exploitation. One reference is a GitHub gist that may contain proof-of-concept or technical detail, but it is not labeled as exploit code in the input and cannot be treated as confirmed POC. The dominant risk-reducing factor is product obscurity: 'nemoTyrant manong' is a tiny, rolling-release GitHub project with negligible deployment footprint, so even a trivially exploitable network bug has limited aggregate exposure. No conflicting severity/version data beyond the inherent ambiguity of a rolling-release model that provides no affected or fixed version numbers.

A remote attacker with no credentials sends a crafted request that reaches the cache/del_cache/arr2sql code path in func.php, injecting attacker-controlled SQL into a dynamically built query to read or tamper with limited database content. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, though reaching the vulnerable function depends on the application exposing that endpoint. A referenced GitHub gist may hold technical detail or proof-of-concept, but no vendor-confirmed exploit is established in the input.