Anisha
Monthly
A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. [CVSS 7.3 HIGH]
Online Guitar Store versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. [CVSS 7.3 HIGH]
A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. [CVSS 7.3 HIGH]
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Farm System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Online Farm System 1.0 (/categoryvalue.php) exposes remote unauthenticated attackers a direct path to read, modify, or delete underlying database contents by manipulating the Value parameter. The affected product is a PHP web application identified under CPE cpe:2.3:a:anisha:online_farm_system:1.0. A public proof-of-concept exploit exists on GitHub, though EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate negligible observed exploitation, consistent with the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.
SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint `/forgot_pass.php` to remote attackers who can manipulate the `email` parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
CVE-2025-7612 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /login.php file's email parameter, allowing remote unauthenticated attackers to execute arbitrary SQL queries and potentially extract or modify sensitive data. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild. With a CVSS score of 7.3 and demonstrated public PoC availability, this represents an immediate threat to deployments of this product.
CVE-2025-7611 is a critical SQL injection vulnerability in code-projects Wedding Reservation version 1.0, affecting the /global.php file's 'lu' parameter. Remote unauthenticated attackers can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, significantly increasing real-world exploitation risk.
CVE-2025-7610 is a critical SQL injection vulnerability in code-projects Electricity Billing System 1.0 affecting the password change functionality at /user/change_password.php. An unauthenticated remote attacker can inject arbitrary SQL commands through the new_password parameter to read, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation highly probable.
CVE-2025-7606 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /city.php file, where the 'city' parameter is improperly sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.3 (High) with confirmed public exploit disclosure and active exploitation potential, enabling attackers to read, modify, or delete database contents without authentication.
CVE-2025-7605 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /profile.php endpoint via the first_name parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. Public exploit code is available and the vulnerability is likely to be actively exploited given its network-accessible nature, low attack complexity, and lack of authentication requirements.
A critical SQL injection vulnerability exists in code-projects Job Diary 1.0 via the ID parameter in /view-cad.php, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, and while the CVSS score is 7.3 (High), the unauthenticated attack vector and low complexity suggest active exploitation is likely. No patch has been confirmed available as of this analysis.
CVE-2025-7594 is a critical SQL injection vulnerability in code-projects Job Diary version 1.0 affecting the /view-emp.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the low attack complexity combined with network accessibility makes this a high-priority threat requiring immediate patching.
CVE-2025-7593 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-all.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate sensitive data, modify records, or disrupt application availability. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high impact across confidentiality, integrity, and availability. This represents an active threat requiring immediate patching.
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.
CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.
SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).
Remote SQL injection in Jonnys Liquor 1.0 allows unauthenticated attackers to manipulate the drink parameter of the admin-area.php endpoint, potentially extracting or modifying database contents. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.05%).
SQL injection in code-projects Jonnys Liquor 1.0 allows remote attackers to manipulate database content via the ID parameter in /admin/delete-row.php. The exploit is publicly available and requires no authentication, enabling malicious database actions. No active exploitation has been confirmed, and EPSS indicates very low exploitation probability.
SQL injection in Jonnys Liquor 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search parameter of /browse.php. Exploit code is publicly available; however, the impact is assessed as low (only partial data exposure or modification). No evidence of active exploitation has been identified.
SQL injection in Online Note Sharing 1.0 login page allows remote unauthenticated attackers to inject malicious SQL via username/password fields, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but EPSS indicates very low exploitation probability (0.06%).
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
We need to produce a JSON object with fields as specified. The CVE data: CVE-2025-6903, description, CVSS Score 5.5 but it says CVSS:4.0 vector which is new. So we need to incorporate that. The CVSS vector provided is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So the base score presumably corresponds to the parts before /E:P. So AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The description says "The attack can be launched remotely." and "The manipulation of the argument ID leads to sql injection." So it's an SQL injection. CWE: CWE-74 (improper neutralization of special elements in output used by a downstream component). But SQL injection is usually CWE-89, but they gave CWE-74. Might be a mistake. We'll reference CWE-74 but note SQL injection is a subset. EPSS 0.05% (low), POC publicly available. No KEV. Reported by VulDB. Affected product: Car Rental System 1.0 by code-projects (PHP). So we need to synthesize all. Now fields: - product_name: "Car Rental System" (3 words, product name). - summary: 2-3 sentences, original synthesis. Mention SQL injection, remote attack, low EPSS but public exploit, no KEV. Example: "SQL injection in Car Rental System 1.0 via the ID parameter in /admin/approve.php allows remote attackers to manipulate database queries. Exploit code is publicly available but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited real-world exploitation likelihood." - technical_context: Explain underlying technology: PHP-based web application, SQL injection due to improper sanitization of input in a PHP script, CWE-74 (but SQL injection is a specific form of injection). Affected product per CPE: anisha:car_rental_system:1.0. This is a code-projects.org project, likely a simple PHP app. The CWE might actually be CWE-89 but they assigned CWE-74, but we can mention it's injection. So: "The vulnerability resides in a PHP script that constructs SQL queries using unsanitised us
Unrestricted file upload in code-projects Car Rental System 1.0 allows remote attackers to upload arbitrary files via the image parameter in /admin/add_cars.php. A publicly available exploit exists, potentially leading to remote code execution, though exploitation requires low-privileged access to the admin panel. The vulnerability is not listed in CISA KEV, and EPSS predicts low exploitation probability (0.09%).
CVE-2025-6579 is a critical SQL injection vulnerability in code-projects Car Rental System 1.0 affecting the /message_admin.php file's Message parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available and may be actively exploited in the wild.
A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Fantasy-Cricket 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Fantasy-Cricket 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Admission Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /login.php. [CVSS 7.3 HIGH]
Online Guitar Store versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. [CVSS 7.3 HIGH]
A vulnerability has been found in code-projects Online Guitar Store 1.0. This impacts an unknown function of the file /admin/Create_category.php. [CVSS 7.3 HIGH]
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.
A security flaw has been discovered in code-projects Jonnys Liquor 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Diary 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Farm System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Online Farm System 1.0 (/categoryvalue.php) exposes remote unauthenticated attackers a direct path to read, modify, or delete underlying database contents by manipulating the Value parameter. The affected product is a PHP web application identified under CPE cpe:2.3:a:anisha:online_farm_system:1.0. A public proof-of-concept exploit exists on GitHub, though EPSS at 0.07% (20th percentile) and absence from CISA KEV indicate negligible observed exploitation, consistent with the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Online Farm System 1.0 allows unauthenticated remote attackers to manipulate backend database queries by supplying crafted input to the Username parameter of the /register.php registration endpoint. The vulnerability is confirmed as critical by the reporter and a public proof-of-concept exploit is documented in a GitHub issue. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche footprint despite the low technical barrier to exploitation.
SQL injection in Online Farm System 1.0 exposes the unauthenticated password-reset endpoint `/forgot_pass.php` to remote attackers who can manipulate the `email` parameter to inject arbitrary SQL commands against the backend database. A public exploit PoC was disclosed on GitHub (https://github.com/wllovemy/cve/issues/10) at time of reporting, lowering the technical barrier for exploitation. Despite the straightforward, unauthenticated attack surface, EPSS is very low at 0.07% (20th percentile), consistent with the product's minimal real-world deployment footprint and niche audience; no CISA KEV listing exists.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the clinic parameter in /admin/addmanagerclinic.php. The vulnerability has a publicly available proof-of-concept exploit, though EPSS probability is low (0.07%) and it is not listed in CISA KEV, indicating limited active exploitation in the wild.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'clinic' parameter in /admin/deletedoctorclinic.php. Attackers can potentially access, modify, or delete database contents. A public exploit is available, but no evidence of active exploitation has been published.
SQL injection in Online Appointment Booking System 1.0 enables remote attackers to execute arbitrary SQL commands via the Username parameter of the /admin/adddoctor.php endpoint. Public exploit code is available, though no active exploitation has been reported. The vulnerability could allow unauthorized database manipulation, potentially exposing patient data.
We are tasked with synthesizing a JSON analysis for CVE-2025-7752. Let's collect data: - CVE ID: CVE-2025-7752 - Description: A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/deletedoctor.php. The manipulation of the argument did leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. - CVSS Score: 5.5 (Note: the string says "CVSS Score: 5.5" but the vector is CVSS 4.0, so maybe it's a CVSS 4.0 score? I see vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. So the base score is 5.5 (CVSS 4.0). CVSS 4.0 score 5.5 is medium? The base metric is AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So it's a low impact on all vulnerable system components. So indeed 5.5. - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). This is generic injection; SQL injection is a subset. - EPSS: 0.07%, percentile 21%. Very low exploitation probability. - POC/Exploit: Publicly available (exploit disclosed to public) - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0:*:*:*:*:*:*:* - Tags: PHP, SQLi, Online Appointment Booking System - References: code-projects.org, github exploit, vuldb entries. - KEV status: Not provided in input. No mention of KEV, so assume not in KEV. I'll state "no public exploit identified at time of analysis" would be wrong because POC is available. But "publicly available exploit code exists" is correct. And no KEV, so not actively exploited per CISA KEV. So exploitation status: "publicly available exploit code exists". Not "confirmed actively exploited". - CVSS vector for 3.1? Not provided, need to assess independently. The given vector is CVSS 4.0. We'll need to output our own assessed CVSS 3.1 vector. From the description: Remote attack, SQL injection in /admin/deletedoctor.php via parameter "did". There's no mention of authentication required, but the file is under /admin/ which might imply authentication is needed to reach that page. The description says "unknown functionality", but most admin pages require admin login. However, the CVSS 4.0 vector says PR:N (no privileges required), meaning unauthenticated. So maybe the page is accessible without auth? The input CVSS 4.0 says PR:N. I should consider that as the assessment from the reporter. I'll craft my own assessed CVSS 3.1: AV:N, AC:L, PR:N, UI:N, S:U, C:L/I:L/A:L? SQL injection could lead to data leakage (confidentiality low), modification (integrity low), maybe availability low if data corruption. The vector they gave VC:L/VI:L/VA:L. So I'll mirror that in 3.1: C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. But the description says "manipulation of the argument did leads to sql injection". No details on impact, but SQLi could allow reading db, maybe RCE? But low impact seems appropriate. I'll use that. Assessed CVSS 3.1 rationale: "Unprotected admin endpoint, no authentication (PR:N), low impact on all CIA." But I must ensure it's grounded. The CVSS 4.0 says PR:N, so I'll use that. I'll explain: "Remote accessible admin page without authentication, easy to exploit, limited impact on data due to SQL injection." Actually SQL injection often leads to full compromise if database permissions allow. But the vendor gave low impact, so I'll keep low. So assessed CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CVSS 4.0 assessed vector: The same as given, but they gave base only. I'll output the same vector but since they included environmental/time metrics, I'll just give the base vector I assess, which is consistent with my 3.1. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. So that works. Now prevalence: The product is "code-projects Online Appointment Booking System 1.0", likely a small open-source project, not widely deployed. So prevalence "low". Prevalence basis: "niche open-source project with limited adoption". I'll write that. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But wait: is it truly unauthenticated? The vector PR:N, so yes. I'll state that. However, I should check if the endpoint /admin/deletedoctor.php is directly accessible without login. The description does not explicitly say authentication required. So I'll go with PR:N. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." That is allowed. Attack chain: Recon → Access admin endpoint → Send malicious SQL via 'did' parameter → Trigger SQL injection → Extract/modify data in database. I'll condense into 5 steps: Recon → Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in did → SQL injection executed → Exfiltrate or manipulate database → Impact. I'll write: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL via did parameter → Execute SQL injection → Extract or modify sensitive data". That's 4 steps: Access (send request) → Exploit (inject SQL) → Execution (SQL injection) → Impact (extract/modify). Simplify: "Identify target system → Send crafted HTTP GET/POST with malicious 'did' parameter → SQL injection executed → Dump or alter database tables". I'll do 4-step: Access → Exploit → Execution → Impact. So: "Send crafted HTTP request to /admin/deletedoctor.php → Inject SQL payload via did parameter → Execute SQL injection → Exfiltrate sensitive information from database". That's fine. Remediation: No specific patch mentioned. The product appears to be a code-projects project, maybe no official patch. I'll suggest: "No vendor-released patch identified at time of analysis. As a workaround, restrict access to the /admin/ directory via .htaccess or web server configuration to trusted IPs, and consider rewriting the vulnerable SQL query with parameterized statements. If the system is not in production, disable the entire application." More precisely, "No patch available from the vendor; apply input validation and parameterized queries manually." I'll phrase: "No vendor patch available. Mitigations: disable the admin panel or restrict access to /admin/ to trusted IPs via web server configuration. Additionally, manually fix the SQL query in deletedoctor.php to use prepared statements. The system is unsupported; consider replacing it." I need a concise paragraph. Confidence notes: "CVE details from VulDB; exploit publicly available. No CISA KEV listing. Patch status unknown — no official fix from vendor. Remote unauthenticated access confirmed by CVSS 4.0 vector PR:N, but endpoint under /admin may imply authentication is required in some deployments; this is ambiguous." I'll mention that the CVSS says PR:N, but admin URL suggests auth, so there might be inconsistency. I'll state: "VulDB report claims unauthenticated remote access (PR:N), but /admin path suggests admin authentication may be required in some configurations. Vendor advisory missing. Confidence in impact limited due to sparse information." Good. Now product_name: "Online Appointment Booking System" - not too wordy. It's a single product. So "Online Appointment Booking System". I'll put that. Summary: I need a 2-3 sentence synthesis that doesn't copy description. Start with specific impact verb: "SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate database queries via the 'did' parameter in /admin/deletedoctor.php." Add exploitation status: "A public exploit is available, but exploitation probability is low (EPSS 0.07%)." Add who is affected: "Affected is version 1.0, no patch available." Summarize risk: "While CVSS 4.0 rates it medium, real-world risk is low due to limited deployment footprint and low exploitation probability." Technical context: "The vulnerability is an SQL injection in a PHP-based appointment booking application. The /admin/deletedoctor.php script takes a 'did' parameter and uses it directly in an SQL query without sanitization, allowing injection. CWE-74 indicates improper neutralization of special elements used in a downstream component. CPE shows the vendor is Anisha, product Online Appointment Booking System 1.0. PHP MySQL is the likely technology stack." I'll phrase. Risk assessment: Compare CVSS 4.0 score 5.5 (Medium), EPSS 0.07% (very low), no KEV, POC available, SSVC: exploitation available, automatable (AV:N, AC:L, AT:N), technical impact low (L/L/L). So risk is low despite public exploit. I'll say: "CVSS 4.0 base score 5.5 indicates medium severity with low impact on all CIA. EPSS probability of exploitation is only 0.07%, placing it in the 21st percentile — unlikely to be exploited in the wild. A public proof-of-concept exists, but no active exploitation reported. The product is a niche application, reducing mass exploitation risk. Overall, a low real-world priority." Affected products: "Online Appointment Booking System 1.0 (CPE: cpe:2.3:a:anisha:online_appointment_booking_system:1.0). Vendor site: https://code-projects.org/. No specific patched version exists. Affected file /admin/deletedoctor.php." I'll write a paragraph. Remediation paragraph: "No official patch is available. Isolate the admin interface by restricting access to /admin/ to trusted IP addresses via web server configuration (Apache: Require ip x.x.x.x). Manually edit deletedoctor.php to use parameterized queries with prepared statements. If the application is not essential, disable it entirely. Consider migrating to a maintained alternative." That's a good actionable guidance. Exploit scenario: "An unauthenticated attacker sends a crafted HTTP request to /admin/deletedoctor.php with a SQL payload in the 'did' parameter. Successful injection exfiltrates database contents, potentially exposing user credentials and appointment data. The publicly disclosed proof-of-concept facilitates exploitation." Not too long. Exploitation conditions: I already said above. So "No special conditions — remote unauthenticated exploitation against default configurations of Online Appointment Booking System 1.0." But maybe the admin page isn't exposed by default; the description says "attack may be launched remotely", so likely no special conditions. I'll add that if the admin interface is not internet-facing, risk is reduced. However, requirement is to state concrete conditions. I'll phrase: "Requires the /admin/deletedoctor.php endpoint to be exposed and reachable without authentication, which is the default configuration." I'll output that. Attack chain: As above: "Send crafted HTTP request to /admin/deletedoctor.php with SQL payload in 'did' parameter → SQL injection executes arbitrary SQL commands → Retrieve, modify, or delete data from the application database." Good. Confidence notes: I need to state confirmed/unknown. "Public exploit confirmed via GitHub. Vendor patch status unknown. Authentication requirements ambiguous—CVSS vector indicates unauthenticated (PR:N) but typical admin pages require login; this discrepancy is noted from NVD/exploit source. No official advisory from vendor exists." That covers it. Prevalence: "low" — niche product. basis: "small open-source project with minimal production use." Assessed CVSS 4.0 vector: I gave earlier, so
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote unauthenticated attackers to manipulate database queries via the cid parameter in /admin/addclinic.php. Public exploit code exists, but exploitation probability is low (EPSS 0.07%) and no active exploitation has been confirmed.
SQL injection in Online Appointment Booking System 1.0 allows remote attackers to manipulate the clinic parameter in /admin/adddoctorclinic.php, potentially extracting or modifying database data. The vulnerability has a publicly available exploit but no KEV listing, and EPSS suggests low exploitation probability.
SQL injection in the admin panel of Appointment Booking System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the city parameter in /admin/getmanagerregion.php. Exploit code is publicly available, but no active exploitation is confirmed; EPSS predicts low exploitation probability (0.07%).
CVE-2025-7612 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /login.php file's email parameter, allowing remote unauthenticated attackers to execute arbitrary SQL queries and potentially extract or modify sensitive data. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild. With a CVSS score of 7.3 and demonstrated public PoC availability, this represents an immediate threat to deployments of this product.
CVE-2025-7611 is a critical SQL injection vulnerability in code-projects Wedding Reservation version 1.0, affecting the /global.php file's 'lu' parameter. Remote unauthenticated attackers can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, significantly increasing real-world exploitation risk.
CVE-2025-7610 is a critical SQL injection vulnerability in code-projects Electricity Billing System 1.0 affecting the password change functionality at /user/change_password.php. An unauthenticated remote attacker can inject arbitrary SQL commands through the new_password parameter to read, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation highly probable.
CVE-2025-7606 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /city.php file, where the 'city' parameter is improperly sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has a CVSS score of 7.3 (High) with confirmed public exploit disclosure and active exploitation potential, enabling attackers to read, modify, or delete database contents without authentication.
CVE-2025-7605 is a critical SQL injection vulnerability in code-projects AVL Rooms 1.0 affecting the /profile.php endpoint via the first_name parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. Public exploit code is available and the vulnerability is likely to be actively exploited given its network-accessible nature, low attack complexity, and lack of authentication requirements.
A critical SQL injection vulnerability exists in code-projects Job Diary 1.0 via the ID parameter in /view-cad.php, allowing unauthenticated remote attackers to execute arbitrary SQL commands and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, and while the CVSS score is 7.3 (High), the unauthenticated attack vector and low complexity suggest active exploitation is likely. No patch has been confirmed available as of this analysis.
CVE-2025-7594 is a critical SQL injection vulnerability in code-projects Job Diary version 1.0 affecting the /view-emp.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the low attack complexity combined with network accessibility makes this a high-priority threat requiring immediate patching.
CVE-2025-7593 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-all.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate sensitive data, modify records, or disrupt application availability. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high impact across confidentiality, integrity, and availability. This represents an active threat requiring immediate patching.
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.
CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.
SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).
Remote SQL injection in Jonnys Liquor 1.0 allows unauthenticated attackers to manipulate the drink parameter of the admin-area.php endpoint, potentially extracting or modifying database contents. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.05%).
SQL injection in code-projects Jonnys Liquor 1.0 allows remote attackers to manipulate database content via the ID parameter in /admin/delete-row.php. The exploit is publicly available and requires no authentication, enabling malicious database actions. No active exploitation has been confirmed, and EPSS indicates very low exploitation probability.
SQL injection in Jonnys Liquor 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search parameter of /browse.php. Exploit code is publicly available; however, the impact is assessed as low (only partial data exposure or modification). No evidence of active exploitation has been identified.
SQL injection in Online Note Sharing 1.0 login page allows remote unauthenticated attackers to inject malicious SQL via username/password fields, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but EPSS indicates very low exploitation probability (0.06%).
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
We need to produce a JSON object with fields as specified. The CVE data: CVE-2025-6903, description, CVSS Score 5.5 but it says CVSS:4.0 vector which is new. So we need to incorporate that. The CVSS vector provided is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So the base score presumably corresponds to the parts before /E:P. So AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The description says "The attack can be launched remotely." and "The manipulation of the argument ID leads to sql injection." So it's an SQL injection. CWE: CWE-74 (improper neutralization of special elements in output used by a downstream component). But SQL injection is usually CWE-89, but they gave CWE-74. Might be a mistake. We'll reference CWE-74 but note SQL injection is a subset. EPSS 0.05% (low), POC publicly available. No KEV. Reported by VulDB. Affected product: Car Rental System 1.0 by code-projects (PHP). So we need to synthesize all. Now fields: - product_name: "Car Rental System" (3 words, product name). - summary: 2-3 sentences, original synthesis. Mention SQL injection, remote attack, low EPSS but public exploit, no KEV. Example: "SQL injection in Car Rental System 1.0 via the ID parameter in /admin/approve.php allows remote attackers to manipulate database queries. Exploit code is publicly available but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited real-world exploitation likelihood." - technical_context: Explain underlying technology: PHP-based web application, SQL injection due to improper sanitization of input in a PHP script, CWE-74 (but SQL injection is a specific form of injection). Affected product per CPE: anisha:car_rental_system:1.0. This is a code-projects.org project, likely a simple PHP app. The CWE might actually be CWE-89 but they assigned CWE-74, but we can mention it's injection. So: "The vulnerability resides in a PHP script that constructs SQL queries using unsanitised us
Unrestricted file upload in code-projects Car Rental System 1.0 allows remote attackers to upload arbitrary files via the image parameter in /admin/add_cars.php. A publicly available exploit exists, potentially leading to remote code execution, though exploitation requires low-privileged access to the admin panel. The vulnerability is not listed in CISA KEV, and EPSS predicts low exploitation probability (0.09%).
CVE-2025-6579 is a critical SQL injection vulnerability in code-projects Car Rental System 1.0 affecting the /message_admin.php file's Message parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available and may be actively exploited in the wild.
A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Job Recruitment 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Fantasy-Cricket 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Fantasy-Cricket 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Admission Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.