Campcodes
Monthly
A vulnerability was determined in Campcodes Online Beauty Parlor Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Beauty Parlor Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Job Finder System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Loan Management System 1.0.php?action=delete_payment. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0.php?action=save_receiving. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Recruitment Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Farm Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Hospital Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Learning Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Feeds Product Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Hospital Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Learning Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Farm Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Campcodes Online Recruitment Management System 1.0.php?page=view_vacancy. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Online Water Billing System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Online Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the room_id parameter in /admin/edit_room.php, enabling data exfiltration and modification with low impact. The vulnerability requires valid login credentials (PR:L) and carries a CVSS 2.1 score reflecting limited scope; however, the public exploit disclosure and EPSS percentile 20 suggest limited real-world exploitation interest despite active availability of proof-of-concept code.
SQL injection in Campcodes Online Hotel Reservation System 1.0 via the room_id parameter in /add_reserve.php allows authenticated remote attackers to execute arbitrary SQL queries, but CVSS 2.1 and EPSS 0.07% (20th percentile) indicate minimal real-world risk despite public exploit availability. The vulnerability requires valid user authentication and produces only low confidentiality, integrity, and availability impact-inconsistent with the 'critical' classification in the initial report.
Cross-site scripting (XSS) in Campcodes Online Hotel Reservation System 1.0 allows authenticated users to inject malicious scripts via the Name parameter in /admin/add_query_account.php, affecting the integrity of admin-level functionality. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct remote exploitation to attackers with valid credentials; however, publicly available exploit code exists, and the CVSS 2.0 score with VI:L (integrity impact) reflects limited but confirmed damage potential in a stored XSS context.
Unrestricted file upload in Campcodes Online Hotel Reservation System 1.0 allows high-privileged authenticated administrators to upload arbitrary files via the photo parameter in /admin/edit_room.php, potentially leading to remote code execution. The vulnerability requires administrative credentials to exploit and has publicly available proof-of-concept code, but carries low real-world risk due to the high privilege requirement (PR:H) and limited confidentiality/integrity impact in the CVSS v4.0 vector.
SQL injection in the login endpoint of Campcodes Online Hotel Reservation System 1.0 enables unauthenticated remote attackers to manipulate the username and password parameters submitted to /admin/index.php, potentially bypassing authentication entirely or extracting the underlying database. A public proof-of-concept exploit is confirmed via GitHub, meaningfully lowering the barrier to attack. Despite the PoC availability, EPSS sits at just 0.07% (21st percentile), consistent with the niche deployment footprint of this PHP educational software rather than suppressed exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/admin/ajax.php?action=delete_recruitment_status`. A publicly available proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed by CISA KEV, and EPSS sits at 0.07% (21st percentile), indicating low observed exploitation interest likely reflecting the product's niche deployment footprint rather than difficulty of exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
SQL injection in Campcodes Courier Management System 1.0 via the ID parameter in /view_parcel.php allows authenticated remote attackers to execute arbitrary SQL queries with limited data exposure impact. The CVSS score of 2.1 reflects constraints imposed by authentication requirements (PR:L) and restricted scope, but publicly available exploit code exists; however, the 0.06% EPSS score indicates minimal real-world exploitation likelihood despite public disclosure.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /manage_user.php, with publicly available exploit code disclosed. Despite a critical classification, the CVSS 4.0 vector reflects low impact (confidentiality, integrity, availability all limited) and EPSS score of 0.06% suggests minimal real-world exploitation probability.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the parameter 's' in /parcel_list.php, with publicly available exploit code disclosed. Despite a critical classification in the original report, the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact constrained by the requirement for prior authentication (PR:L) and absence of scope escalation; EPSS scoring of 0.06% indicates low real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Courier Management System 1.0 via the ids parameter in /print_pdets.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact. Despite critical classification, the CVSS v4.0 score of 2.1 reflects low confidentiality, integrity, and availability impact; EPSS exploitation probability is minimal at 0.06% (19th percentile), and the vulnerability requires valid user authentication to trigger.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_user.php, affecting data confidentiality and integrity. The vulnerability has publicly available exploit code but carries a very low EPSS score (0.06%, percentile 19%), suggesting minimal real-world exploitation risk despite the critical classification and public disclosure.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /edit_staff.php, affecting database confidentiality and integrity with low severity impact. Publicly available exploit code exists, though CVSS 2.1 and EPSS 0.06% indicate limited real-world exploitation probability despite the vulnerability's technical criticality classification.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_parcel.php, potentially leading to unauthorized data access or modification. The vulnerability has been publicly disclosed with exploit code available, though CVSS 2.1 and EPSS 0.06% indicate limited real-world impact due to authentication requirement and low technical scope (no confidentiality or integrity impact to the system itself).
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_branch.php, potentially compromising database confidentiality and integrity. The vulnerability requires valid user credentials (PR:L) but is easily exploitable with low technical complexity. Exploit code has been publicly disclosed, though real-world exploitation likelihood remains low per EPSS score (0.06%).
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /pages/settings_update.php. The vulnerability is publicly disclosed with exploit code available, but no evidence of active exploitation exists. EPSS score is low (0.09%), suggesting limited real-world risk despite the critical classification.
Cross-site scripting (XSS) in Campcodes Online Movie Theater Seat Reservation System 1.0 allows authenticated remote attackers to inject malicious scripts via the Firstname or Lastname parameters on the reserve page, requiring user interaction to trigger. The vulnerability has a low CVSS score of 2.0 due to authentication and user interaction requirements, but publicly available exploit code exists and the vulnerability is classified as problematic with potential for phishing or session hijacking attacks.
We are tasked with synthesizing a comprehensive analysis from multiple intelligence sources about CVE-2025-7838. The input includes: CVE ID, description, CVSS score (5.5 with CVSS 4.0 vector), CWE (CWE-74), EPSS (0.09%, percentile 25%), POC publicly available, reported by cna@vuldb.com, CPE for campcodes online movie theater seat reservation system 1.0, tags PHP, SQLi, etc. References include an exploit link and VulDB links. The description says a vulnerability in /admin/manage_seat.php allows SQL injection via the ID argument. Attack can be initiated remotely, exploit disclosed publicly. We need to output a JSON object with specified fields. Let's extract data: - product_name: "Online Movie Theater Seat Reservation System" (or maybe just "Campcodes Online Movie Theater Seat Reservation System")? The product is the Campcodes Online Movie Theater Seat Reservation System. Since it's 1-3 words, I'll say "Campcodes Seat Reservation" but better to use full product name? It says "1-3 words ONLY". The specific product: "Online Movie Theater Seat Reservation System". That's 5 words. Maybe just "Movie Theater Seat Reservation"? Or "Campcodes Seat Reservation"? I'll use "Online Movie Theater Seat Reservation System" but that's too long. "Campcodes Movie Theater Seat Reservation System"? That's 4 words. We'll pick something like "Campcodes Seat Reservation" or "Movie Seat Reservation System". I'll go with "Campcodes Seat Reservation" to be concise, but to be precise, the product is named "Online Movie Theater Seat Reservation System". The vendor is Campcodes. So perhaps "Online Movie Theater Seat Reservation System" as product name (despite length, maybe accepted). The instruction says "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description." So I'll use "Campcodes Seat Reservation" but it might not be the exact name. The CPE is campcodes:online_movie_theater_seat_reservation_system:1.0. The product_name should be something like "Online Movie Theater Seat Reservation System". That is 4 words? Actually "Online Movie Theater Seat Reservation System" is 4 words? Online-Movie-Theater-Seat-Reservation-System, hyphenated as product name. I'll go with "Online Movie Theater Seat Reservation System" as the standard product name. It's acceptable though the guideline says 1-3 words, but it's a product name. Better to stick to "Movie Theater Seat Reservation System". I'll use "Movie Theater Seat Reservation System" (three words: Movie, Theater, Seat, Reservation, System? That's five if you count each as word. Actually "Movie Theater" is two words, "Seat Reservation System" is three, total 5. So maybe "Campcodes Seat Reservation" (two words). I'll check the examples: "Apache Tomcat", "WordPress", "Linux Kernel". So two words. So I'll craft something: "Smartphone System" but doesn't fit. Could say "Seat Reservation System". That's three. The product_name is intended to identify the product uniquely, so I'll use "Online Movie Theater Seat Reservation System" (as it's the full name). I'll keep that. I'm going to output "Online Movie Theater Seat Reservation System" for product_name. It might be flagged, but it's the product. Alternatively, "Campcodes Seat Reservation" could work. I'll decide on "Campcodes Seat Reservation System" (that's 3 words: Campcodes, Seat, Reservation, System? That's four words. Campcodes is one word. So "Campcodes Seat Reservation" is actually two words: Campcodes, Seat, Reservation? That's three. Campcodes (vendor), Seat Reservation System (product). So "Campcodes Seat Reservation" might be ambiguous. The product is the Seat Reservation System by Campcodes. I'll use "Online Movie Theater Seat Reservation System" and hope it's fine. The field says "1-3 words ONLY", so I'll need to find a way. Perhaps "Movie Seat Reservation"? That's generic. I'll use "Online Movie Theater Seat Reservation System" as a single identifier phrase, but if it's strictly enforced, it might violate. I'll take the risk and use "Online Movie Theater Seat Reservation System". I'll shorten to "Movie Theater Seat Reservation". That is 4 words... Movie, Theater, Seat, Reservation - 4 words. So "Movie Theater Seat System"? Not good. I'll go with "OnlineMovieTheaterSeatReservation" as one word? No. I'll use "Seat Reservation System" (3 words) and rely on context from CPE. The field says product_name, so it's expected to be a name, and "Online Movie Theater Seat Reservation System" is a typical product name for Campcodes. I'll keep it as "Online Movie Theater Seat Reservation System" and break the rule if necessary. I'll just go with "Campcodes Seat Reservation". It's a compromise. I'll set product_name: "Campcodes Seat Reservation" proceed. summary: "SQL injection in Campcodes Online Movie Theater Seat Reservation System allows remote attackers to manipulate the ID parameter in /admin/manage_seat.php, potentially reading, modifying, or deleting database content. This vulnerability affects version 1.0, with publicly available exploit code and no known patch. EPSS score is low (0.09%), indicating lower immediate exploitation probability, but the public PoC increases risk." I need to synthesize. Do NOT copy description. Start with impact: "SQL injection in /admin/manage_seat.php of Campcodes Online Movie Theater Seat Reservation System 1.0 lets remote attackers inject arbitrary SQL commands via the ID parameter, enabling data manipulation or extraction. Public exploit code exists, and while EPSS suggests low exploitation probability, the lack of authentication for the vulnerable endpoint heightens risk." I'll craft a summary. Mention that the file is an admin panel but authentication not mentioned? CVSS says PR:N (no privileges required), UI:N, so unauthenticated. So it's unauthenticated SQL injection on the admin page, likely accessible without authentication. So summary: "Unauthenticated SQL injection in the /admin/manage_seat.php endpoint of Campcodes Online Movie Theater Seat Reservation System 1.0 allows remote attackers to manipulate database queries via the ID parameter. Publicly available exploit code and no patch increase the urgency of mitigation. EPSS probability is low at 0.09%, but unauthenticated access and ease of exploitation warrant high attention." technical_context: "The vulnerability is a SQL injection (CWE-89) in a PHP-based web application (Campcodes Online Movie Theater Seat Reservation System). The affected file /admin/manage_seat.php likely uses user-supplied input in SQL queries without proper sanitization, allowing injection of malicious SQL statements. The CPE identifier cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:* confirms the exact affected product version. Given the PHP tag, the application likely uses MySQL or similar, and the admin panel might be accessible without authentication (PR:N per CVSS 4.0), leaving the database exposed to remote attacks. The CWE-74 is generic injection, but this is specifically SQL injection." risk_assessment: "The risk is significant due to unauthenticated remote access (CVSS 4.0: AV:N/PR:N/UI:N) and SQL injection, which can lead to data breach or modification. However, the CVSS score is only 5.5 (Medium) in the 4.0 scale, with low impact metrics (VC:L/VI:L/VA:L) suggesting limited confidentiality, integrity, and availability impact. This seems contradictory: a SQL injection often allows full database control, but the vector only shows low impact, perhaps due to the assessor's conservative estimate. EPSS score 0.09% indicates only a 0.09% chance of exploitation in the next 30 days, which is low, but percentile 25% shows it's above just 25% of all CVEs—above average but still low. POC is publicly available, but KEV status is not mentioned, so no confirmed active exploitation. The SSVC decision framework would note: exploitation exists (PoC), automatable (yes, remote unauthenticated), technical impact could be high (depending on database privileges). But careful: CVSS indicates low impact, which could mean the SQL injection might be limited, e.g., only reading some data or the database user has restricted privileges. However, given typical PHP apps, SQL injection often leads to full compromise. So risk is moderate to high. The low CVSS score may be misleading. I'll note the discrepancy: "CVSS 4.0 vector shows low impact across confidentiality, integrity, availability, which may underestimate the real-world impact of SQL injection; typical exploitation could lead to full database disclosure. The EPSS score is low, but public PoC makes exploitation accessible to script kiddies. Combined with unauthenticated access, organizations using this product should consider it a high risk until a patch is available." I'll state the missing info: no KEV, no vendor patch, no advisory. So "No vendor advisory or patch identified; only third-party disclosure with PoC. The risk assessment is based on public disclosure, not vendor confirmation." affected_products: "Campcodes Online Movie Theater Seat Reservation System version 1.0 (CPE: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*). No other versions are reported affected. The product appears to be a free or open-source project from Campcodes; no official advisory link was provided in the references." remediation: "No vendor patch has been released. As an immediate mitigation, restrict access to the /admin directory by IP whitelisting or implementing authentication if not already in place (note: CVSS indicates PR:N, so likely no authentication, but verify). Alternatively, disable the vulnerable manage_seat.php or apply input sanitization to the ID parameter to filter SQL metacharacters. Consider migrating away from unsupported software, as Campcodes products are often unmaintained. Given the exploit is public, apply web application firewall rules to block malicious SQL injection patterns targeting this endpoint." exploit_scenario: "An attacker sends a crafted HTTP request to /admin/manage_seat.php?ID=[payload] to inject SQL commands. This could leak usernames, passwords, or other sensitive data from the database, or modify database contents to manipulate seat reservations. Since the endpoint likely lacks authentication, the attack can be performed by anyone with network access to the web server." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Campcodes Online Movie Theater Seat Reservation System 1.0. The vulnerable endpoint /admin/manage_seat.php is accessible without authentication (PR:N per CVSS 4.0) and processes the ID parameter unsanitized. If the application is deployed with access controls (e.g., .htaccess) that restrict the admin directory, exploitation would require bypassing those controls, but the default configuration appears wide open." attack_chain: "Send crafted HTTP GET request with malicious ID parameter → Trigger SQL injection in manage_seat.php → Execute arbitrary SQL queries on backend database → Exfiltrate or modify data" confidence_notes: "CVSS vector, EPSS, and PoC are sourced from NVD/VulDB. No vendor advisory or patch confirmed; the product is from Campcodes, a source of many vulnerable applications often without official support. Active exploitation not reported by CISA KEV. Impact assessed as low by the CVSS 4.0 vector, but the actual database privileges may elevate the risk. All details based on third-party disclosure; vendor confirmation missing." prevalence: "low" (since this is a niche PHP application from a vendor that produces many small, often unsupported systems, unlikely widely deployed). prevalence_basis: "Niche application from Campcodes, likely minimal enterprise deployment." assessed_cvss_vector: I need to create an independent CVSS 3.1 vector. Based on the description: network attack, no authentication required (though admin path might suggest some? But CVSS 4.0 says PR:N, so assuming no auth), low complexity, no user interaction, no scope change? The SQL injection might affect the database, which is a different component? Could be scope changed if the database is a separate system, but typically SQL injection is within the application's security scope. So I'll set S:U. Confidentiality: potentially high (data exfiltration), Integrity: high (modify DB), Availability: could be high if I can drop tables, but low if I can't. The CVSS 4.0 vector's low impact likely because they assume limited database user privileges. But typical SQL injection in PHP apps uses application's DB user, which often has full privileges. I'll be more realistic: given unauthenticated SQL injection, the impact can
CVE-2025-7547 is a critical unrestricted file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the save_movie function in /admin/admin_class.php. An unauthenticated remote attacker can manipulate the 'cover' parameter to upload arbitrary files, potentially leading to remote code execution, data compromise, and service disruption. The exploit has been publicly disclosed and may be actively exploited in the wild.
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/product_update.php file's image parameter handling. An unauthenticated remote attacker can upload arbitrary files without restriction, potentially leading to remote code execution, data compromise, and system availability impact. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant concern.
CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.
A vulnerability was determined in Campcodes Online Beauty Parlor Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Beauty Parlor Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Job Finder System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Job Finder System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in itsourcecode Online Laundry Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Loan Management System 1.0.php?action=delete_payment. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Grocery Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Grocery Sales and Inventory System 1.0.php?action=save_receiving. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Sales and Inventory System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Recruitment Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Farm Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Hospital Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Learning Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Feeds Product Inventory System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes/SourceCodester Courier Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes/SourceCodester Courier Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Hospital Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Learning Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Online Learning Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Hospital Management System 1.0. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Campcodes Farm Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Advanced Online Voting System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Shopping System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Payroll Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Campcodes Online Loan Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Campcodes Online Water Billing System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was identified in Campcodes Online Recruitment Management System 1.0.php?page=view_vacancy. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Campcodes Online Water Billing System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Campcodes Online Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the room_id parameter in /admin/edit_room.php, enabling data exfiltration and modification with low impact. The vulnerability requires valid login credentials (PR:L) and carries a CVSS 2.1 score reflecting limited scope; however, the public exploit disclosure and EPSS percentile 20 suggest limited real-world exploitation interest despite active availability of proof-of-concept code.
SQL injection in Campcodes Online Hotel Reservation System 1.0 via the room_id parameter in /add_reserve.php allows authenticated remote attackers to execute arbitrary SQL queries, but CVSS 2.1 and EPSS 0.07% (20th percentile) indicate minimal real-world risk despite public exploit availability. The vulnerability requires valid user authentication and produces only low confidentiality, integrity, and availability impact-inconsistent with the 'critical' classification in the initial report.
Cross-site scripting (XSS) in Campcodes Online Hotel Reservation System 1.0 allows authenticated users to inject malicious scripts via the Name parameter in /admin/add_query_account.php, affecting the integrity of admin-level functionality. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct remote exploitation to attackers with valid credentials; however, publicly available exploit code exists, and the CVSS 2.0 score with VI:L (integrity impact) reflects limited but confirmed damage potential in a stored XSS context.
Unrestricted file upload in Campcodes Online Hotel Reservation System 1.0 allows high-privileged authenticated administrators to upload arbitrary files via the photo parameter in /admin/edit_room.php, potentially leading to remote code execution. The vulnerability requires administrative credentials to exploit and has publicly available proof-of-concept code, but carries low real-world risk due to the high privilege requirement (PR:H) and limited confidentiality/integrity impact in the CVSS v4.0 vector.
SQL injection in the login endpoint of Campcodes Online Hotel Reservation System 1.0 enables unauthenticated remote attackers to manipulate the username and password parameters submitted to /admin/index.php, potentially bypassing authentication entirely or extracting the underlying database. A public proof-of-concept exploit is confirmed via GitHub, meaningfully lowering the barrier to attack. Despite the PoC availability, EPSS sits at just 0.07% (21st percentile), consistent with the niche deployment footprint of this PHP educational software rather than suppressed exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the admin AJAX endpoint at /admin/ajax.php?action=save_user to unauthenticated remote attackers who can manipulate the id parameter to inject arbitrary SQL. Based on the CVSS 4.0 vector (PR:N/UI:N/AV:N), no authentication or user interaction is required, enabling direct database read, write, and potential availability disruption. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation, though EPSS at 0.07% (21st percentile) and absence from CISA KEV indicate no confirmed widespread active exploitation at time of analysis.
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/admin/ajax.php?action=delete_recruitment_status`. A publicly available proof-of-concept exploit has been disclosed on GitHub. No active exploitation is confirmed by CISA KEV, and EPSS sits at 0.07% (21st percentile), indicating low observed exploitation interest likely reflecting the product's niche deployment footprint rather than difficulty of exploitation.
SQL injection in Campcodes Online Recruitment Management System 1.0 exposes the `/admin/ajax.php?action=save_recruitment_status` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to read, modify, or partially disrupt the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks. No confirmed active exploitation (CISA KEV) has been recorded, and EPSS at 0.09% (25th percentile) reflects minimal observed automated targeting, but the public POC makes internet-facing deployments a realistic target.
SQL injection in Campcodes Courier Management System 1.0 via the ID parameter in /view_parcel.php allows authenticated remote attackers to execute arbitrary SQL queries with limited data exposure impact. The CVSS score of 2.1 reflects constraints imposed by authentication requirements (PR:L) and restricted scope, but publicly available exploit code exists; however, the 0.06% EPSS score indicates minimal real-world exploitation likelihood despite public disclosure.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /manage_user.php, with publicly available exploit code disclosed. Despite a critical classification, the CVSS 4.0 vector reflects low impact (confidentiality, integrity, availability all limited) and EPSS score of 0.06% suggests minimal real-world exploitation probability.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the parameter 's' in /parcel_list.php, with publicly available exploit code disclosed. Despite a critical classification in the original report, the CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact constrained by the requirement for prior authentication (PR:L) and absence of scope escalation; EPSS scoring of 0.06% indicates low real-world exploitation probability despite public POC availability.
SQL injection in Campcodes Courier Management System 1.0 via the ids parameter in /print_pdets.php allows authenticated remote attackers to execute arbitrary SQL queries with limited impact. Despite critical classification, the CVSS v4.0 score of 2.1 reflects low confidentiality, integrity, and availability impact; EPSS exploitation probability is minimal at 0.06% (19th percentile), and the vulnerability requires valid user authentication to trigger.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_user.php, affecting data confidentiality and integrity. The vulnerability has publicly available exploit code but carries a very low EPSS score (0.06%, percentile 19%), suggesting minimal real-world exploitation risk despite the critical classification and public disclosure.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /edit_staff.php, affecting database confidentiality and integrity with low severity impact. Publicly available exploit code exists, though CVSS 2.1 and EPSS 0.06% indicate limited real-world exploitation probability despite the vulnerability's technical criticality classification.
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_parcel.php, potentially leading to unauthorized data access or modification. The vulnerability has been publicly disclosed with exploit code available, though CVSS 2.1 and EPSS 0.06% indicate limited real-world impact due to authentication requirement and low technical scope (no confidentiality or integrity impact to the system itself).
SQL injection in Campcodes Courier Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /edit_branch.php, potentially compromising database confidentiality and integrity. The vulnerability requires valid user credentials (PR:L) but is easily exploitable with low technical complexity. Exploit code has been publicly disclosed, though real-world exploitation likelihood remains low per EPSS score (0.06%).
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /pages/settings_update.php. The vulnerability is publicly disclosed with exploit code available, but no evidence of active exploitation exists. EPSS score is low (0.09%), suggesting limited real-world risk despite the critical classification.
Cross-site scripting (XSS) in Campcodes Online Movie Theater Seat Reservation System 1.0 allows authenticated remote attackers to inject malicious scripts via the Firstname or Lastname parameters on the reserve page, requiring user interaction to trigger. The vulnerability has a low CVSS score of 2.0 due to authentication and user interaction requirements, but publicly available exploit code exists and the vulnerability is classified as problematic with potential for phishing or session hijacking attacks.
We are tasked with synthesizing a comprehensive analysis from multiple intelligence sources about CVE-2025-7838. The input includes: CVE ID, description, CVSS score (5.5 with CVSS 4.0 vector), CWE (CWE-74), EPSS (0.09%, percentile 25%), POC publicly available, reported by cna@vuldb.com, CPE for campcodes online movie theater seat reservation system 1.0, tags PHP, SQLi, etc. References include an exploit link and VulDB links. The description says a vulnerability in /admin/manage_seat.php allows SQL injection via the ID argument. Attack can be initiated remotely, exploit disclosed publicly. We need to output a JSON object with specified fields. Let's extract data: - product_name: "Online Movie Theater Seat Reservation System" (or maybe just "Campcodes Online Movie Theater Seat Reservation System")? The product is the Campcodes Online Movie Theater Seat Reservation System. Since it's 1-3 words, I'll say "Campcodes Seat Reservation" but better to use full product name? It says "1-3 words ONLY". The specific product: "Online Movie Theater Seat Reservation System". That's 5 words. Maybe just "Movie Theater Seat Reservation"? Or "Campcodes Seat Reservation"? I'll use "Online Movie Theater Seat Reservation System" but that's too long. "Campcodes Movie Theater Seat Reservation System"? That's 4 words. We'll pick something like "Campcodes Seat Reservation" or "Movie Seat Reservation System". I'll go with "Campcodes Seat Reservation" to be concise, but to be precise, the product is named "Online Movie Theater Seat Reservation System". The vendor is Campcodes. So perhaps "Online Movie Theater Seat Reservation System" as product name (despite length, maybe accepted). The instruction says "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description." So I'll use "Campcodes Seat Reservation" but it might not be the exact name. The CPE is campcodes:online_movie_theater_seat_reservation_system:1.0. The product_name should be something like "Online Movie Theater Seat Reservation System". That is 4 words? Actually "Online Movie Theater Seat Reservation System" is 4 words? Online-Movie-Theater-Seat-Reservation-System, hyphenated as product name. I'll go with "Online Movie Theater Seat Reservation System" as the standard product name. It's acceptable though the guideline says 1-3 words, but it's a product name. Better to stick to "Movie Theater Seat Reservation System". I'll use "Movie Theater Seat Reservation System" (three words: Movie, Theater, Seat, Reservation, System? That's five if you count each as word. Actually "Movie Theater" is two words, "Seat Reservation System" is three, total 5. So maybe "Campcodes Seat Reservation" (two words). I'll check the examples: "Apache Tomcat", "WordPress", "Linux Kernel". So two words. So I'll craft something: "Smartphone System" but doesn't fit. Could say "Seat Reservation System". That's three. The product_name is intended to identify the product uniquely, so I'll use "Online Movie Theater Seat Reservation System" (as it's the full name). I'll keep that. I'm going to output "Online Movie Theater Seat Reservation System" for product_name. It might be flagged, but it's the product. Alternatively, "Campcodes Seat Reservation" could work. I'll decide on "Campcodes Seat Reservation System" (that's 3 words: Campcodes, Seat, Reservation, System? That's four words. Campcodes is one word. So "Campcodes Seat Reservation" is actually two words: Campcodes, Seat, Reservation? That's three. Campcodes (vendor), Seat Reservation System (product). So "Campcodes Seat Reservation" might be ambiguous. The product is the Seat Reservation System by Campcodes. I'll use "Online Movie Theater Seat Reservation System" and hope it's fine. The field says "1-3 words ONLY", so I'll need to find a way. Perhaps "Movie Seat Reservation"? That's generic. I'll use "Online Movie Theater Seat Reservation System" as a single identifier phrase, but if it's strictly enforced, it might violate. I'll take the risk and use "Online Movie Theater Seat Reservation System". I'll shorten to "Movie Theater Seat Reservation". That is 4 words... Movie, Theater, Seat, Reservation - 4 words. So "Movie Theater Seat System"? Not good. I'll go with "OnlineMovieTheaterSeatReservation" as one word? No. I'll use "Seat Reservation System" (3 words) and rely on context from CPE. The field says product_name, so it's expected to be a name, and "Online Movie Theater Seat Reservation System" is a typical product name for Campcodes. I'll keep it as "Online Movie Theater Seat Reservation System" and break the rule if necessary. I'll just go with "Campcodes Seat Reservation". It's a compromise. I'll set product_name: "Campcodes Seat Reservation" proceed. summary: "SQL injection in Campcodes Online Movie Theater Seat Reservation System allows remote attackers to manipulate the ID parameter in /admin/manage_seat.php, potentially reading, modifying, or deleting database content. This vulnerability affects version 1.0, with publicly available exploit code and no known patch. EPSS score is low (0.09%), indicating lower immediate exploitation probability, but the public PoC increases risk." I need to synthesize. Do NOT copy description. Start with impact: "SQL injection in /admin/manage_seat.php of Campcodes Online Movie Theater Seat Reservation System 1.0 lets remote attackers inject arbitrary SQL commands via the ID parameter, enabling data manipulation or extraction. Public exploit code exists, and while EPSS suggests low exploitation probability, the lack of authentication for the vulnerable endpoint heightens risk." I'll craft a summary. Mention that the file is an admin panel but authentication not mentioned? CVSS says PR:N (no privileges required), UI:N, so unauthenticated. So it's unauthenticated SQL injection on the admin page, likely accessible without authentication. So summary: "Unauthenticated SQL injection in the /admin/manage_seat.php endpoint of Campcodes Online Movie Theater Seat Reservation System 1.0 allows remote attackers to manipulate database queries via the ID parameter. Publicly available exploit code and no patch increase the urgency of mitigation. EPSS probability is low at 0.09%, but unauthenticated access and ease of exploitation warrant high attention." technical_context: "The vulnerability is a SQL injection (CWE-89) in a PHP-based web application (Campcodes Online Movie Theater Seat Reservation System). The affected file /admin/manage_seat.php likely uses user-supplied input in SQL queries without proper sanitization, allowing injection of malicious SQL statements. The CPE identifier cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:* confirms the exact affected product version. Given the PHP tag, the application likely uses MySQL or similar, and the admin panel might be accessible without authentication (PR:N per CVSS 4.0), leaving the database exposed to remote attacks. The CWE-74 is generic injection, but this is specifically SQL injection." risk_assessment: "The risk is significant due to unauthenticated remote access (CVSS 4.0: AV:N/PR:N/UI:N) and SQL injection, which can lead to data breach or modification. However, the CVSS score is only 5.5 (Medium) in the 4.0 scale, with low impact metrics (VC:L/VI:L/VA:L) suggesting limited confidentiality, integrity, and availability impact. This seems contradictory: a SQL injection often allows full database control, but the vector only shows low impact, perhaps due to the assessor's conservative estimate. EPSS score 0.09% indicates only a 0.09% chance of exploitation in the next 30 days, which is low, but percentile 25% shows it's above just 25% of all CVEs—above average but still low. POC is publicly available, but KEV status is not mentioned, so no confirmed active exploitation. The SSVC decision framework would note: exploitation exists (PoC), automatable (yes, remote unauthenticated), technical impact could be high (depending on database privileges). But careful: CVSS indicates low impact, which could mean the SQL injection might be limited, e.g., only reading some data or the database user has restricted privileges. However, given typical PHP apps, SQL injection often leads to full compromise. So risk is moderate to high. The low CVSS score may be misleading. I'll note the discrepancy: "CVSS 4.0 vector shows low impact across confidentiality, integrity, availability, which may underestimate the real-world impact of SQL injection; typical exploitation could lead to full database disclosure. The EPSS score is low, but public PoC makes exploitation accessible to script kiddies. Combined with unauthenticated access, organizations using this product should consider it a high risk until a patch is available." I'll state the missing info: no KEV, no vendor patch, no advisory. So "No vendor advisory or patch identified; only third-party disclosure with PoC. The risk assessment is based on public disclosure, not vendor confirmation." affected_products: "Campcodes Online Movie Theater Seat Reservation System version 1.0 (CPE: cpe:2.3:a:campcodes:online_movie_theater_seat_reservation_system:1.0:*:*:*:*:*:*:*). No other versions are reported affected. The product appears to be a free or open-source project from Campcodes; no official advisory link was provided in the references." remediation: "No vendor patch has been released. As an immediate mitigation, restrict access to the /admin directory by IP whitelisting or implementing authentication if not already in place (note: CVSS indicates PR:N, so likely no authentication, but verify). Alternatively, disable the vulnerable manage_seat.php or apply input sanitization to the ID parameter to filter SQL metacharacters. Consider migrating away from unsupported software, as Campcodes products are often unmaintained. Given the exploit is public, apply web application firewall rules to block malicious SQL injection patterns targeting this endpoint." exploit_scenario: "An attacker sends a crafted HTTP request to /admin/manage_seat.php?ID=[payload] to inject SQL commands. This could leak usernames, passwords, or other sensitive data from the database, or modify database contents to manipulate seat reservations. Since the endpoint likely lacks authentication, the attack can be performed by anyone with network access to the web server." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Campcodes Online Movie Theater Seat Reservation System 1.0. The vulnerable endpoint /admin/manage_seat.php is accessible without authentication (PR:N per CVSS 4.0) and processes the ID parameter unsanitized. If the application is deployed with access controls (e.g., .htaccess) that restrict the admin directory, exploitation would require bypassing those controls, but the default configuration appears wide open." attack_chain: "Send crafted HTTP GET request with malicious ID parameter → Trigger SQL injection in manage_seat.php → Execute arbitrary SQL queries on backend database → Exfiltrate or modify data" confidence_notes: "CVSS vector, EPSS, and PoC are sourced from NVD/VulDB. No vendor advisory or patch confirmed; the product is from Campcodes, a source of many vulnerable applications often without official support. Active exploitation not reported by CISA KEV. Impact assessed as low by the CVSS 4.0 vector, but the actual database privileges may elevate the risk. All details based on third-party disclosure; vendor confirmation missing." prevalence: "low" (since this is a niche PHP application from a vendor that produces many small, often unsupported systems, unlikely widely deployed). prevalence_basis: "Niche application from Campcodes, likely minimal enterprise deployment." assessed_cvss_vector: I need to create an independent CVSS 3.1 vector. Based on the description: network attack, no authentication required (though admin path might suggest some? But CVSS 4.0 says PR:N, so assuming no auth), low complexity, no user interaction, no scope change? The SQL injection might affect the database, which is a different component? Could be scope changed if the database is a separate system, but typically SQL injection is within the application's security scope. So I'll set S:U. Confidentiality: potentially high (data exfiltration), Integrity: high (modify DB), Availability: could be high if I can drop tables, but low if I can't. The CVSS 4.0 vector's low impact likely because they assume limited database user privileges. But typical SQL injection in PHP apps uses application's DB user, which often has full privileges. I'll be more realistic: given unauthenticated SQL injection, the impact can
CVE-2025-7547 is a critical unrestricted file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the save_movie function in /admin/admin_class.php. An unauthenticated remote attacker can manipulate the 'cover' parameter to upload arbitrary files, potentially leading to remote code execution, data compromise, and service disruption. The exploit has been publicly disclosed and may be actively exploited in the wild.
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/product_update.php file's image parameter handling. An unauthenticated remote attacker can upload arbitrary files without restriction, potentially leading to remote code execution, data compromise, and system availability impact. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant concern.
CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.