Church Donation System
Monthly
Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'mobile' parameter in /members/add_members.php. Exploit code is publicly available but there is no evidence of active exploitation; EPSS indicates a low 0.07% probability of exploitation. Despite a 'critical' label, impact is limited to low confidentiality, integrity, and availability effects.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands through the fname parameter in /members/edit_Members.php, potentially leading to data exposure or modification. Publicly available exploit code exists, though no evidence of active exploitation has been identified.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'firstname' parameter in /members/edit_user.php. Exploit code is publicly available, though EPSS (0.07%) indicates a low probability of widespread exploitation, and no KEV listing confirms inactive targeting at this time.
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/giving.php, leading to arbitrary SQL execution. The vulnerability is publicly disclosed with exploit code available (EPSS 0.07%), but there is no indication of active exploitation in CISA KEV. Attackers can use this to extract or modify donation records and other database contents.
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/offering.php. The vulnerability is remotely exploitable without authentication, and a publicly available exploit exists. However, EPSS indicates a low probability of widespread exploitation (0.07%), suggesting limited real-world impact despite disclosure.
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/Tithes.php. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed. EPSS indicates a very low (0.07%) likelihood of real-world exploitation.
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Let's extract data from the input: - CVE: CVE-2025-7830 - Description: Vulnerability in code-projects Church Donation System 1.0, file /reg.php, argument mobile leads to SQL injection. Remote attack, exploit disclosed. - CVSS Score: 5.5 (but vector is CVSS 4.0, not 3.1) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/... - CWE: CWE-74 (Injection, broader than SQL injection? Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but often used for injection in general; SQL injection is CWE-89, but they used CWE-74. We'll note that.) - EPSS: 0.07% (percentile 20%) - low risk of exploitation - POC/Exploit: Publicly available - Reported by cna@vuldb.com - CPE: cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:* - Tags: SQLi, PHP, Church Donation System - References: - code-projects.org (vendor/product site) - github.com/n0name-yang/myCVE/issues/6 (exploit) - vuldb.com/?ctiid.316934 - vuldb.com/?id.316934 - vuldb.com/?submit.616886 We need to produce a synthesis. No KEV, so not actively exploited per CISA. POC is publicly available. EPSS low. Product name: "Church Donation System" (3 words). Should be specific. Summary: No "A vulnerability...", start with impact verb. E.g., "SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the mobile parameter in reg.php." Mention exploit available, EPSS low. Since it's a simple SQL injection, impact is data manipulation/extraction. The CVSS 4.0 vector indicates low impact on confidentiality, integrity, availability (VC:L/VI:L/VA:L), so likely limited to injection context, maybe not high-severity data breach but still critical rating. We'll describe that. Technical context: PHP application, SQL injection in the mobile parameter. CWE-74 injec
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /login.php. The vulnerability has a publicly available exploit but no confirmed active exploitation. EPSS score is low (0.07%), indicating limited exploitation probability in the wild.
Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.
Remote unrestricted file upload in code-projects Church Donation System 1.0 allows unauthenticated attackers to upload arbitrary PHP shells via the /members/admin_pic.php endpoint, achieving remote code execution as the web server. A public exploit is available, but EPSS (0.09%) indicates low active exploitation probability.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'mobile' parameter in /members/add_members.php. Exploit code is publicly available but there is no evidence of active exploitation; EPSS indicates a low 0.07% probability of exploitation. Despite a 'critical' label, impact is limited to low confidentiality, integrity, and availability effects.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the database by injecting SQL commands through the fname parameter in /members/edit_Members.php, potentially leading to data exposure or modification. Publicly available exploit code exists, though no evidence of active exploitation has been identified.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the 'firstname' parameter in /members/edit_user.php. Exploit code is publicly available, though EPSS (0.07%) indicates a low probability of widespread exploitation, and no KEV listing confirms inactive targeting at this time.
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
SQL injection in Church Donation System 1.0 allows remote attackers to manipulate the Amount parameter in /members/giving.php, leading to arbitrary SQL execution. The vulnerability is publicly disclosed with exploit code available (EPSS 0.07%), but there is no indication of active exploitation in CISA KEV. Attackers can use this to extract or modify donation records and other database contents.
SQL injection in Church Donation System 1.0 allows remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/offering.php. The vulnerability is remotely exploitable without authentication, and a publicly available exploit exists. However, EPSS indicates a low probability of widespread exploitation (0.07%), suggesting limited real-world impact despite disclosure.
SQL injection in Church Donation System 1.0 enables remote attackers to execute arbitrary SQL commands via the trcode parameter in /members/Tithes.php. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed. EPSS indicates a very low (0.07%) likelihood of real-world exploitation.
We are tasked with synthesizing a CVE analysis for CVE-2025-7830. We must output a JSON object with specific fields. Let's extract data from the input: - CVE: CVE-2025-7830 - Description: Vulnerability in code-projects Church Donation System 1.0, file /reg.php, argument mobile leads to SQL injection. Remote attack, exploit disclosed. - CVSS Score: 5.5 (but vector is CVSS 4.0, not 3.1) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/... - CWE: CWE-74 (Injection, broader than SQL injection? Actually CWE-74 is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", but often used for injection in general; SQL injection is CWE-89, but they used CWE-74. We'll note that.) - EPSS: 0.07% (percentile 20%) - low risk of exploitation - POC/Exploit: Publicly available - Reported by cna@vuldb.com - CPE: cpe:2.3:a:carmelo:church_donation_system:1.0:*:*:*:*:*:*:* - Tags: SQLi, PHP, Church Donation System - References: - code-projects.org (vendor/product site) - github.com/n0name-yang/myCVE/issues/6 (exploit) - vuldb.com/?ctiid.316934 - vuldb.com/?id.316934 - vuldb.com/?submit.616886 We need to produce a synthesis. No KEV, so not actively exploited per CISA. POC is publicly available. EPSS low. Product name: "Church Donation System" (3 words). Should be specific. Summary: No "A vulnerability...", start with impact verb. E.g., "SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the mobile parameter in reg.php." Mention exploit available, EPSS low. Since it's a simple SQL injection, impact is data manipulation/extraction. The CVSS 4.0 vector indicates low impact on confidentiality, integrity, availability (VC:L/VI:L/VA:L), so likely limited to injection context, maybe not high-severity data breach but still critical rating. We'll describe that. Technical context: PHP application, SQL injection in the mobile parameter. CWE-74 injec
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /login.php. The vulnerability has a publicly available exploit but no confirmed active exploitation. EPSS score is low (0.07%), indicating limited exploitation probability in the wild.