Carmelo
Monthly
Simple Food Order System v1.0 has SQL injection in cancel-order.
Simple Food Order System v1.0 has SQL injection in view-ticket-admin.
Simple Food Order System v1.0 has SQL injection in view-ticket.
Simple Food Order System v1.0 has SQL injection in edit-order.
Simple Gym Management System v1.0 has SQL injection in trainer search.
Simple Student Alumni System v1.0 has a third SQL injection.
Simple Student Alumni System v1.0 has SQL injection in record_search.php.
Simple Student Alumni System v1.0 has SQL injection in modal_view.php.
SQL injection in the Student Web Portal 1.0 /check_user.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. The vulnerability enables attackers to read, modify, or delete sensitive data with public exploit code readily available. This affects PHP-based installations of the Student Web Portal with no patch currently available.
Simple Flight Ticket Booking System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
SQL injection in Student Web Portal 1.0's profile.php allows authenticated attackers to execute arbitrary SQL queries through improper input validation on the User parameter, potentially leading to unauthorized data access or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Student Web Portal 1.0's signup.php password validation function allows unauthenticated remote attackers to manipulate database queries through the reg_passwd parameter. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable unauthorized data access, modification, or deletion.
SQL injection in Simple Flight Ticket Booking System 1.0's SearchResultRoundtrip.php parameter handling enables unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. Public exploit code exists for this vulnerability, increasing exploitation risk. No patch is currently available.
SQL injection in Simple Flight Ticket Booking System 1.0 allows unauthenticated remote attackers to manipulate the SearchResultOneway.php input parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network, enabling attackers to read, modify, or delete sensitive flight booking data.
SQL injection in Simple Flight Ticket Booking System 1.0's /Admindelete.php endpoint allows unauthenticated remote attackers to manipulate the flightno parameter and execute arbitrary database queries, potentially leading to data theft or modification. Public exploit code is available for this vulnerability, and no patch has been released as of now.
SQL injection in Simple Flight Ticket Booking System 1.0's admin update function allows remote attackers with high privileges to manipulate flight parameters and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires administrative credentials but could enable data exfiltration or modification of flight booking records.
SQL injection in Simple Flight Ticket Booking System 1.0's /Adminadd.php allows remote attackers with high privileges to manipulate flight parameters and execute arbitrary SQL queries, potentially compromising flight booking data. Public exploit code exists for this vulnerability, though patches are not yet available. The attack requires administrative credentials but can be exploited over the network without user interaction.
Simple Flight Ticket Booking System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in Simple Flight Ticket Booking System 1.0's login functionality allows unauthenticated attackers to manipulate the Username parameter and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. PHP installations running the affected application should be isolated until a security patch becomes available.
SQL injection in Simple Flight Ticket Booking System 1.0 via the flightno parameter in /Adminsearch.php allows unauthenticated remote attackers to query or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users should immediately restrict access to the admin search functionality or upgrade if a patched version becomes available.
SQL injection in Simple Student Alumni System v1.0's modal_edit.php endpoint allows authenticated administrators to extract sensitive database information through unauthenticated network requests. Public exploit code exists for this vulnerability, though no patch is currently available. The attack requires high-level privileges but can bypass intended access controls to read confidential data.
Simple Student Alumni System v1.0 contains a SQL injection vulnerability in the recordteacher_view.php endpoint that allows authenticated administrators to extract sensitive data from the underlying database. Public exploit code exists for this vulnerability, though a patch is currently unavailable. The attack requires high-level administrative privileges but can be executed remotely without user interaction.
Computer Book Store v1.0 has file upload in admin_add.php.
Intern Membership Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 4.7).
SQL injection in the Intern Membership Management System 1.0 add_activity.php file allows authenticated administrators to manipulate the Title parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables an authenticated attacker with high privileges to compromise data confidentiality and integrity.
SQL injection in the Intern Membership Management System 1.0 admin deletion function allows authenticated attackers with high privileges to manipulate the admin_id parameter and execute arbitrary database queries remotely. Public exploit code is available for this vulnerability, which affects PHP-based deployments. The vulnerability enables unauthorized data access, modification, and potential denial of service with no patch currently available.
SQL injection in the admin panel of code-projects Intern Membership Management System 1.0 allows authenticated attackers with high privileges to manipulate the Username parameter in /intern/admin/add_admin.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should restrict administrative access and consider implementing input validation controls or upgrading to a patched version when available.
Intern Membership Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in the Intern Membership Management System 1.0 admin panel allows authenticated attackers with high privileges to manipulate the activity_id parameter in edit_activity.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, though no patch is currently available.
SQL injection in the Intern Membership Management System 1.0 admin panel allows authenticated attackers with high privileges to manipulate the admin_id parameter in /intern/admin/edit_students.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling attackers to read, modify, or delete sensitive data. No patch is currently available to remediate this issue.
SQL injection in the Intern Membership Management System 1.0 admin panel allows remote attackers with high privileges to manipulate the admin_id parameter in /intern/admin/edit_admin.php, potentially enabling unauthorized data access or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.
Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
Stored cross-site scripting (XSS) in Simple Stock System 1.0 via the /market/chatuser.php endpoint allows remote attackers to inject malicious scripts without authentication. User interaction is required for payload execution. Publicly available exploit code exists; EPSS score of 0.08% indicates low statistical exploitation probability despite XSS classification.
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).
CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.
SQL injection in Daily Time Recording System 4.5.0 allows remote authenticated (low‑privilege) attackers to inject arbitrary SQL via the detail_Id parameter of /admin/add_payroll.php, enabling limited data disclosure, modification, or service disruption. A public proof‑of‑concept exploit exists, though the EPSS score of 0.04% suggests very low exploitation probability and no active exploitation has been confirmed.
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Question Paper Generator 1.0 allows remote authenticated attackers to manipulate the subid parameter in /selectquestionuser.php, leading to limited data disclosure, modification, or service disruption. Exploit code is publicly available, though the EPSS score of 0.04% indicates extremely low probability of widespread exploitation.
A weakness has been identified in code-projects Question Paper Generator 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the judge_id parameter in /edit_judge.php, with publicly available exploit code demonstrating the vulnerability. The low CVSS score (2.1) reflects limited confidentiality impact and required authentication, but the SQL injection itself is a high-severity vulnerability class that could enable data exfiltration or modification depending on database permissions and downstream query construction.
SQL injection in code-projects Online Event Judging System 1.0 via the crit_id parameter in /edit_criteria.php allows authenticated remote attackers to manipulate database queries with low confidentiality and integrity impact. Exploitation requires valid user authentication but can be executed remotely with no user interaction. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) indicates this vulnerability has minimal real-world exploitation probability despite public disclosure.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the contestant_id parameter in /edit_contestant.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a publicly available exploit and low EPSS score (0.03%), suggesting it poses minimal real-world risk despite public exploit availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_contestant.php, enabling database queries with limited data access. The vulnerability has low real-world risk despite public exploit availability, as it requires valid user authentication and produces only limited information disclosure (CVSS 2.1, EPSS 0.03%), though organizations running this application should apply fixes promptly to eliminate the attack vector entirely.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_judge.php, enabling limited data extraction with low confidentiality impact. The CVSS 2.1 score reflects the authentication requirement and bounded scope, but publicly available exploit code exists; however, the 0.03% EPSS percentile indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the content parameter in /ajax/action.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite public POC availability. The vulnerability requires prior authentication, significantly limiting practical attack surface.
Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.
SQL injection in code-projects Student Result Manager 1.0 allows authenticated remote attackers to manipulate roll, name, or GPA parameters in Database.java, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid login credentials and has been publicly disclosed with exploit code available, but carries very low exploitation probability (EPSS 0.03%) and minimal security impact due to restricted scope.
code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Online Event Judging System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting (XSS) in Intern Membership Management System 1.0 allows remote attackers to inject malicious scripts via the email parameter in fill_details.php, executable only with user interaction. The vulnerability has a publicly available exploit and affects the error message handler, resulting in integrity impact (CVSS 2.1, EPSS 0.07%). While the attack vector is network-accessible and requires minimal complexity, the low CVSS and EPSS scores reflect the necessity for user interaction and limited technical impact.
SQL injection in code-projects Intern Membership Management System 1.0 allows unauthenticated remote attackers to manipulate the `user_name` and `password` parameters of the `/student_login.php` login endpoint, injecting arbitrary SQL logic into the backend database query. The flaw (CWE-74) can enable authentication bypass, unauthorized access to intern records, and potential data manipulation. Publicly available exploit code exists on GitHub, though EPSS sits at 0.07% (20th percentile) and the product is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.
SQL injection in code-projects Food Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the occasion parameter in /admin/approve_reservation.php, resulting in limited data confidentiality and integrity impact. Despite a critical classification in the source database, the CVSS 4.0 score of 2.1 reflects the requirement for authenticated access (PR:L) and limited technical impact scope. Publicly available exploit code exists and the vulnerability has been publicly disclosed.
SQL injection in Food Ordering Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the reg_Id parameter in /user/reservation_page.php, with publicly available exploit code disclosed but low real-world exploitation risk due to CVSS 2.1 score, authentication requirement, and limited confidentiality impact.
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'mobile' parameter in /members/add_members.php. Exploit code is publicly available but there is no evidence of active exploitation; EPSS indicates a low 0.07% probability of exploitation. Despite a 'critical' label, impact is limited to low confidentiality, integrity, and availability effects.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands through the fname parameter in /members/edit_Members.php, potentially leading to data exposure or modification. Publicly available exploit code exists, though no evidence of active exploitation has been identified.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'firstname' parameter in /members/edit_user.php. Exploit code is publicly available, though EPSS (0.07%) indicates a low probability of widespread exploitation, and no KEV listing confirms inactive targeting at this time.
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/giving.php, leading to arbitrary SQL execution. The vulnerability is publicly disclosed with exploit code available (EPSS 0.07%), but there is no indication of active exploitation in CISA KEV. Attackers can use this to extract or modify donation records and other database contents.
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/offering.php. The vulnerability is remotely exploitable without authentication, and a publicly available exploit exists. However, EPSS indicates a low probability of widespread exploitation (0.07%), suggesting limited real-world impact despite disclosure.
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/Tithes.php. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed. EPSS indicates a very low (0.07%) likelihood of real-world exploitation.
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Let's extract data from the input: - CVE: CVE-2025-7830 - Description: Vulnerability in code-projects Church Donation System 1.0, file /reg.php, argument mobile leads to SQL injection. Remote attack, exploit disclosed. - CVSS Score: 5.5 (but vector is CVSS 4.0, not 3.1) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/... - CWE: CWE-74 (Injection, broader than SQL injection? Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but often used for injection in general; SQL injection is CWE-89, but they used CWE-74. We'll note that.) - EPSS: 0.07% (percentile 20%) - low risk of exploitation - POC/Exploit: Publicly available - Reported by cna@vuldb.com - CPE: cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:* - Tags: SQLi, PHP, Church Donation System - References: - code-projects.org (vendor/product site) - github.com/n0name-yang/myCVE/issues/6 (exploit) - vuldb.com/?ctiid.316934 - vuldb.com/?id.316934 - vuldb.com/?submit.616886 We need to produce a synthesis. No KEV, so not actively exploited per CISA. POC is publicly available. EPSS low. Product name: "Church Donation System" (3 words). Should be specific. Summary: No "A vulnerability...", start with impact verb. E.g., "SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the mobile parameter in reg.php." Mention exploit available, EPSS low. Since it's a simple SQL injection, impact is data manipulation/extraction. The CVSS 4.0 vector indicates low impact on confidentiality, integrity, availability (VC:L/VI:L/VA:L), so likely limited to injection context, maybe not high-severity data breach but still critical rating. We'll describe that. Technical context: PHP application, SQL injection in the mobile parameter. CWE-74 injec
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /login.php. The vulnerability has a publicly available exploit but no confirmed active exploitation. EPSS score is low (0.07%), indicating limited exploitation probability in the wild.
SQL injection in code-projects Food Ordering Review System 1.0 through the signup form's fname parameter allows remote attackers to execute arbitrary SQL commands. Exploit code is publicly available, though no active exploitation has been confirmed by CISA. EPSS probability is low at 0.07%.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
SQL injection in code-projects Staff Audit System 1.0 allows unauthenticated remote attackers to manipulate login queries via the User parameter in /login.php, potentially leading to unauthorized data access or authentication bypass. A public exploit is available, but EPSS probability is low (0.06%), suggesting limited exploitation pressure. No CISA KEV listing exists.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
Simple Food Order System v1.0 has SQL injection in cancel-order.
Simple Food Order System v1.0 has SQL injection in view-ticket-admin.
Simple Food Order System v1.0 has SQL injection in view-ticket.
Simple Food Order System v1.0 has SQL injection in edit-order.
Simple Gym Management System v1.0 has SQL injection in trainer search.
Simple Student Alumni System v1.0 has a third SQL injection.
Simple Student Alumni System v1.0 has SQL injection in record_search.php.
Simple Student Alumni System v1.0 has SQL injection in modal_view.php.
SQL injection in the Student Web Portal 1.0 /check_user.php endpoint allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. The vulnerability enables attackers to read, modify, or delete sensitive data with public exploit code readily available. This affects PHP-based installations of the Student Web Portal with no patch currently available.
Simple Flight Ticket Booking System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
SQL injection in Student Web Portal 1.0's profile.php allows authenticated attackers to execute arbitrary SQL queries through improper input validation on the User parameter, potentially leading to unauthorized data access or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Student Web Portal 1.0's signup.php password validation function allows unauthenticated remote attackers to manipulate database queries through the reg_passwd parameter. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable unauthorized data access, modification, or deletion.
SQL injection in Simple Flight Ticket Booking System 1.0's SearchResultRoundtrip.php parameter handling enables unauthenticated remote attackers to manipulate database queries and potentially extract, modify, or delete sensitive data. Public exploit code exists for this vulnerability, increasing exploitation risk. No patch is currently available.
SQL injection in Simple Flight Ticket Booking System 1.0 allows unauthenticated remote attackers to manipulate the SearchResultOneway.php input parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and can be executed over the network, enabling attackers to read, modify, or delete sensitive flight booking data.
SQL injection in Simple Flight Ticket Booking System 1.0's /Admindelete.php endpoint allows unauthenticated remote attackers to manipulate the flightno parameter and execute arbitrary database queries, potentially leading to data theft or modification. Public exploit code is available for this vulnerability, and no patch has been released as of now.
SQL injection in Simple Flight Ticket Booking System 1.0's admin update function allows remote attackers with high privileges to manipulate flight parameters and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires administrative credentials but could enable data exfiltration or modification of flight booking records.
SQL injection in Simple Flight Ticket Booking System 1.0's /Adminadd.php allows remote attackers with high privileges to manipulate flight parameters and execute arbitrary SQL queries, potentially compromising flight booking data. Public exploit code exists for this vulnerability, though patches are not yet available. The attack requires administrative credentials but can be exploited over the network without user interaction.
Simple Flight Ticket Booking System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in Simple Flight Ticket Booking System 1.0's login functionality allows unauthenticated attackers to manipulate the Username parameter and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. PHP installations running the affected application should be isolated until a security patch becomes available.
SQL injection in Simple Flight Ticket Booking System 1.0 via the flightno parameter in /Adminsearch.php allows unauthenticated remote attackers to query or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available. Affected users should immediately restrict access to the admin search functionality or upgrade if a patched version becomes available.
SQL injection in Simple Student Alumni System v1.0's modal_edit.php endpoint allows authenticated administrators to extract sensitive database information through unauthenticated network requests. Public exploit code exists for this vulnerability, though no patch is currently available. The attack requires high-level privileges but can bypass intended access controls to read confidential data.
Simple Student Alumni System v1.0 contains a SQL injection vulnerability in the recordteacher_view.php endpoint that allows authenticated administrators to extract sensitive data from the underlying database. Public exploit code exists for this vulnerability, though a patch is currently unavailable. The attack requires high-level administrative privileges but can be executed remotely without user interaction.
Computer Book Store v1.0 has file upload in admin_add.php.
Intern Membership Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 4.7).
SQL injection in the Intern Membership Management System 1.0 add_activity.php file allows authenticated administrators to manipulate the Title parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables an authenticated attacker with high privileges to compromise data confidentiality and integrity.
SQL injection in the Intern Membership Management System 1.0 admin deletion function allows authenticated attackers with high privileges to manipulate the admin_id parameter and execute arbitrary database queries remotely. Public exploit code is available for this vulnerability, which affects PHP-based deployments. The vulnerability enables unauthorized data access, modification, and potential denial of service with no patch currently available.
SQL injection in the admin panel of code-projects Intern Membership Management System 1.0 allows authenticated attackers with high privileges to manipulate the Username parameter in /intern/admin/add_admin.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected organizations should restrict administrative access and consider implementing input validation controls or upgrading to a patched version when available.
Intern Membership Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in the Intern Membership Management System 1.0 admin panel allows authenticated attackers with high privileges to manipulate the activity_id parameter in edit_activity.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, though no patch is currently available.
SQL injection in the Intern Membership Management System 1.0 admin panel allows authenticated attackers with high privileges to manipulate the admin_id parameter in /intern/admin/edit_students.php and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling attackers to read, modify, or delete sensitive data. No patch is currently available to remediate this issue.
SQL injection in the Intern Membership Management System 1.0 admin panel allows remote attackers with high privileges to manipulate the admin_id parameter in /intern/admin/edit_admin.php, potentially enabling unauthorized data access or modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.
Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
Stored cross-site scripting (XSS) in Simple Stock System 1.0 via the /market/chatuser.php endpoint allows remote attackers to inject malicious scripts without authentication. User interaction is required for payload execution. Publicly available exploit code exists; EPSS score of 0.08% indicates low statistical exploitation probability despite XSS classification.
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).
CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.
SQL injection in Daily Time Recording System 4.5.0 allows remote authenticated (low‑privilege) attackers to inject arbitrary SQL via the detail_Id parameter of /admin/add_payroll.php, enabling limited data disclosure, modification, or service disruption. A public proof‑of‑concept exploit exists, though the EPSS score of 0.04% suggests very low exploitation probability and no active exploitation has been confirmed.
SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.
SQL injection in code-projects Question Paper Generator 1.0 allows remote authenticated attackers to manipulate the subid parameter in /selectquestionuser.php, leading to limited data disclosure, modification, or service disruption. Exploit code is publicly available, though the EPSS score of 0.04% indicates extremely low probability of widespread exploitation.
A weakness has been identified in code-projects Question Paper Generator 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the judge_id parameter in /edit_judge.php, with publicly available exploit code demonstrating the vulnerability. The low CVSS score (2.1) reflects limited confidentiality impact and required authentication, but the SQL injection itself is a high-severity vulnerability class that could enable data exfiltration or modification depending on database permissions and downstream query construction.
SQL injection in code-projects Online Event Judging System 1.0 via the crit_id parameter in /edit_criteria.php allows authenticated remote attackers to manipulate database queries with low confidentiality and integrity impact. Exploitation requires valid user authentication but can be executed remotely with no user interaction. Publicly available exploit code exists; however, the EPSS score of 0.03% (8th percentile) indicates this vulnerability has minimal real-world exploitation probability despite public disclosure.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the contestant_id parameter in /edit_contestant.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a publicly available exploit and low EPSS score (0.03%), suggesting it poses minimal real-world risk despite public exploit availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_contestant.php, enabling database queries with limited data access. The vulnerability has low real-world risk despite public exploit availability, as it requires valid user authentication and produces only limited information disclosure (CVSS 2.1, EPSS 0.03%), though organizations running this application should apply fixes promptly to eliminate the attack vector entirely.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to manipulate the fullname parameter in /add_judge.php, enabling limited data extraction with low confidentiality impact. The CVSS 2.1 score reflects the authentication requirement and bounded scope, but publicly available exploit code exists; however, the 0.03% EPSS percentile indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in code-projects Online Event Judging System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the content parameter in /ajax/action.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite public POC availability. The vulnerability requires prior authentication, significantly limiting practical attack surface.
Authentication bypass via SQL injection in code-projects Computer Laboratory System 1.0 allows a remote unauthenticated attacker to log in as a valid user by submitting a crafted 'universal password' in the login form's Password field. The injected SQL manipulates the login query so the authentication check always evaluates true, granting access without valid credentials. Publicly available exploit code exists (PoC published on GitHub), though the low EPSS score (0.42%, 34th percentile) and absence from CISA KEV indicate no confirmed active exploitation at time of analysis.
SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.
SQL injection in code-projects Student Result Manager 1.0 allows authenticated remote attackers to manipulate roll, name, or GPA parameters in Database.java, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid login credentials and has been publicly disclosed with exploit code available, but carries very low exploitation probability (EPSS 0.03%) and minimal security impact due to restricted scope.
code-projects Computer Laboratory System 1.0 has a file upload vulnerability. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Online Event Judging System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Online Event Judging System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting (XSS) in Intern Membership Management System 1.0 allows remote attackers to inject malicious scripts via the email parameter in fill_details.php, executable only with user interaction. The vulnerability has a publicly available exploit and affects the error message handler, resulting in integrity impact (CVSS 2.1, EPSS 0.07%). While the attack vector is network-accessible and requires minimal complexity, the low CVSS and EPSS scores reflect the necessity for user interaction and limited technical impact.
SQL injection in code-projects Intern Membership Management System 1.0 allows unauthenticated remote attackers to manipulate the `user_name` and `password` parameters of the `/student_login.php` login endpoint, injecting arbitrary SQL logic into the backend database query. The flaw (CWE-74) can enable authentication bypass, unauthorized access to intern records, and potential data manipulation. Publicly available exploit code exists on GitHub, though EPSS sits at 0.07% (20th percentile) and the product is absent from CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.
SQL injection in code-projects Food Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the occasion parameter in /admin/approve_reservation.php, resulting in limited data confidentiality and integrity impact. Despite a critical classification in the source database, the CVSS 4.0 score of 2.1 reflects the requirement for authenticated access (PR:L) and limited technical impact scope. Publicly available exploit code exists and the vulnerability has been publicly disclosed.
SQL injection in Food Ordering Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the reg_Id parameter in /user/reservation_page.php, with publicly available exploit code disclosed but low real-world exploitation risk due to CVSS 2.1 score, authentication requirement, and limited confidentiality impact.
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'mobile' parameter in /members/add_members.php. Exploit code is publicly available but there is no evidence of active exploitation; EPSS indicates a low 0.07% probability of exploitation. Despite a 'critical' label, impact is limited to low confidentiality, integrity, and availability effects.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands through the fname parameter in /members/edit_Members.php, potentially leading to data exposure or modification. Publicly available exploit code exists, though no evidence of active exploitation has been identified.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'firstname' parameter in /members/edit_user.php. Exploit code is publicly available, though EPSS (0.07%) indicates a low probability of widespread exploitation, and no KEV listing confirms inactive targeting at this time.
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/giving.php, leading to arbitrary SQL execution. The vulnerability is publicly disclosed with exploit code available (EPSS 0.07%), but there is no indication of active exploitation in CISA KEV. Attackers can use this to extract or modify donation records and other database contents.
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/offering.php. The vulnerability is remotely exploitable without authentication, and a publicly available exploit exists. However, EPSS indicates a low probability of widespread exploitation (0.07%), suggesting limited real-world impact despite disclosure.
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/Tithes.php. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed. EPSS indicates a very low (0.07%) likelihood of real-world exploitation.
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Let's extract data from the input: - CVE: CVE-2025-7830 - Description: Vulnerability in code-projects Church Donation System 1.0, file /reg.php, argument mobile leads to SQL injection. Remote attack, exploit disclosed. - CVSS Score: 5.5 (but vector is CVSS 4.0, not 3.1) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/... - CWE: CWE-74 (Injection, broader than SQL injection? Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but often used for injection in general; SQL injection is CWE-89, but they used CWE-74. We'll note that.) - EPSS: 0.07% (percentile 20%) - low risk of exploitation - POC/Exploit: Publicly available - Reported by cna@vuldb.com - CPE: cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:* - Tags: SQLi, PHP, Church Donation System - References: - code-projects.org (vendor/product site) - github.com/n0name-yang/myCVE/issues/6 (exploit) - vuldb.com/?ctiid.316934 - vuldb.com/?id.316934 - vuldb.com/?submit.616886 We need to produce a synthesis. No KEV, so not actively exploited per CISA. POC is publicly available. EPSS low. Product name: "Church Donation System" (3 words). Should be specific. Summary: No "A vulnerability...", start with impact verb. E.g., "SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the mobile parameter in reg.php." Mention exploit available, EPSS low. Since it's a simple SQL injection, impact is data manipulation/extraction. The CVSS 4.0 vector indicates low impact on confidentiality, integrity, availability (VC:L/VI:L/VA:L), so likely limited to injection context, maybe not high-severity data breach but still critical rating. We'll describe that. Technical context: PHP application, SQL injection in the mobile parameter. CWE-74 injec
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /login.php. The vulnerability has a publicly available exploit but no confirmed active exploitation. EPSS score is low (0.07%), indicating limited exploitation probability in the wild.
SQL injection in code-projects Food Ordering Review System 1.0 through the signup form's fname parameter allows remote attackers to execute arbitrary SQL commands. Exploit code is publicly available, though no active exploitation has been confirmed by CISA. EPSS probability is low at 0.07%.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
SQL injection in code-projects Staff Audit System 1.0 allows unauthenticated remote attackers to manipulate login queries via the User parameter in /login.php, potentially leading to unauthorized data access or authentication bypass. A public exploit is available, but EPSS probability is low (0.06%), suggesting limited exploitation pressure. No CISA KEV listing exists.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.