EUVD-2026-31625
GHSA-p36m-2qm6-9pq8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
AnalysisAI
Injection via HTTP GET request parameter manipulation in KLiK SocialMediaWebsite 1.0 allows remote attackers to inject arbitrary content or code through the application's parameter handler, contingent on passive user interaction. The vulnerability carries a CVSS 4.0 base score of 2.1, reflecting limited confidentiality, integrity, and availability impact scoped exclusively to the vulnerable system with no lateral impact. Publicly available exploit code exists per the E:P exploit maturity metric and SSVC poc classification, though EPSS at 0.04% (13th percentile) and the non-KEV status indicate no observed widespread exploitation.
Technical ContextAI
KLiK SocialMediaWebsite 1.0 is identified via CPE cpe:2.3:a:n/a:klik_socialmediawebsite:*:*:*:*:*:*:*:* - the vendor field resolving to 'n/a' indicates this is likely a community or open-source project with no formal vendor namespace in the NVD CPE dictionary. The vulnerability resides in the HTTP GET Request Parameter Handler, the component responsible for processing URL query string parameters before downstream use. CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection) identifies the root cause: user-supplied GET parameter values are not properly sanitized or neutralized before being passed to a downstream context, allowing injected special elements to alter the intended processing logic. This CWE is a parent class covering sub-types such as SQL injection, OS command injection, cross-site scripting, and template injection; the exact downstream context (database, shell, HTML renderer) is not confirmed in available data. The CVSS 4.0 vector specifies AT:N (no attack requirements beyond network access) and AC:L (low attack complexity), indicating the injection point is reliably reachable and does not require unusual application state.
RemediationAI
No vendor-released patch is identified at time of analysis - the CPE vendor field is 'n/a' and no patch references appear in the VulDB submission set (https://vuldb.com/submit/813723, /813730, /813731, /813732) or NVD entry. Given the absence of a maintained vendor, organizations running KLiK SocialMediaWebsite 1.0 should consider replacing it with an actively maintained alternative. As a specific compensating control, input validation and output encoding should be applied to all HTTP GET parameters at the web application firewall or reverse proxy layer (e.g., ModSecurity with OWASP CRS rules targeting CWE-74 injection patterns); note this may block legitimate parameterized requests if rules are too broad and requires tuning. Additionally, restricting the application to authenticated sessions only would eliminate the PR:N attack surface, though this may conflict with intended public-facing functionality. If the application is not in active use, decommissioning or taking it offline eliminates exposure entirely.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today