Code Projects
Monthly
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.
A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
CVE-2025-7513 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slideupdate.php endpoint, where unsanitized idSlide parameter input allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploits available, enabling attackers to read, modify, or delete database records with moderate confidentiality, integrity, and availability impact.
CVE-2025-7512 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting the /contact-back.php file's contact-name parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential with a CVSS score of 7.3.
CVE-2025-7510 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/productadd_back.php file, where the 'namepro' parameter is improperly sanitized allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, and carries a CVSS 7.3 score indicating moderate-to-high real-world risk with low attack complexity. An attacker can extract, modify, or delete database contents without authentication, compromising confidentiality, integrity, and availability of the application.
CVE-2025-7509 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slide.php endpoint via the idSlide parameter. An unauthenticated remote attacker can exploit this with no user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7508 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/product-update.php endpoint, where the 'idProduct' parameter is improperly validated before database queries. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially exfiltrating sensitive data, modifying product information, or gaining further system access. The vulnerability has public exploit disclosure and active real-world exploitation is likely given the low attack complexity and lack of authentication requirements.
CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.
CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
SQL injection in Code-projects Student Enrollment System 1.0 allows unauthenticated remote attackers to inject SQL via the Username parameter in login.php, potentially leading to data theft or authentication bypass. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The EPSS score is very low, suggesting limited real-world exploitation likelihood.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
SQL injection in code-projects Crime Reporting System 1.0 allows remote attackers to inject arbitrary SQL via the email parameter of /headlogin.php. A public exploit exists but active exploitation is not confirmed; the EPSS probability is very low (0.07%). This vulnerability can lead to limited data exposure or manipulation.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter of /policelogin.php, potentially leading to authentication bypass and sensitive data exposure. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). EPSS indicates very low risk of widespread exploitation (0.06%, 19th percentile).
SQL injection in the registration form of Code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries by injecting SQL into the Name parameter. The exploit is publicly available but not currently listed in CISA KEV, and EPSS probability of exploitation remains low (0.06%). Although the vulnerability is trivial to exploit, the intrinsic impact is limited, affecting only the local database with low confidentiality, integrity, and availability repercussions.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'location' parameter of /complainer_page.php. A public exploit is available, though EPSS indicates extremely low likelihood of widespread exploitation and no active attacks are confirmed.
SQL injection in Crime Reporting System 1.0 allows remote unauthenticated attackers to manipulate database queries via the email parameter on the /userlogin.php page. The vulnerability has been publicly disclosed and exploit code is available, although the EPSS score is low (0.06%) and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
Unrestricted file upload in code-projects Library System 1.0's /profile.php allows authenticated remote attackers with low privileges to upload arbitrary files, likely resulting in remote code execution. Exploit code is publicly available, but active exploitation is not confirmed (no CISA KEV listing) and EPSS predicts a low exploitation probability (0.11%).
SQL injection in code-projects Library System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the phone parameter in /profile.php. The vulnerability has a publicly available proof-of-concept, though no active exploitation is confirmed and EPSS estimates low short-term exploitation probability (0.06%). Impact is limited per CVSS scoring, primarily posing a risk of data theft or tampering.
SQL injection in Code-Projects Library System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'reg' parameter in /student-issue-book.php. Public exploit code is available, enabling potential data tampering or unauthorized access. Despite a network attack vector, CVSS 4.0 rates overall severity as medium (5.5) due to limited impact.
SQL injection in Inventory Management System 1.0 allows unauthorized database manipulation via the orderId parameter. An unauthenticated remote attacker can exploit the /php_action/editPayment.php endpoint to execute arbitrary SQL statements. Public exploit code is available, though no active exploitation has been confirmed, and the EPSS probability is low.
We need to generate a JSON object with the specified fields. Let's extract information from the provided data. - CVE ID: CVE-2025-6828 - Description: "A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used." - CVSS Score: 5.5 (but vector is CVSS 4.0, given) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (base part: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.06% (18th percentile) - POC/Exploit: Publicly available - KEV: not mentioned (so not in KEV) - Tags: PHP, SQLi - CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:* - Affected versions: "Inventory Management System 1.0" - References: many, including vuldb entries and github exploit. We need to produce a comprehensive analysis. Fields to fill: product_name: "Inventory Management System" (code-projects Inventory Management System, but 1-3 words only: "Inventory Management System" might be too generic? Could be "Code-Projects Inventory Management System", but that's 4 words. The instruction: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." Here vendor is "code-projects", product is "Inventory Management System". That's 3 words if you count "Code-Projects" as one? Usually hyphenated. I'll go with "Inventory Management System" (3 words) or "Code-Projects Inventory Management System" (4 words). Need 1-3 words, so "Inventory Management S
SQL injection in code-projects Inventory Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the editOrder.php file. Public exploit code exists, though EPSS indicates low exploitation probability (0.06%) and no active exploitation has been confirmed.
SQL injection in Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the editProductName parameter in /php_action/editProduct.php. A public proof-of-concept exploit exists, but no active exploitation has been confirmed. The vulnerability has a medium CVSS 4.0 score and low EPSS likelihood, indicating limited practical risk outside of exposed installations.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the productId parameter in /php_action/removeProduct.php. An unauthenticated attacker can potentially access or modify database contents, though impact is rated low. A public proof-of-concept exists, but EPSS indicates low exploitation probability.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the /php_action/createOrder.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed. The issue affects a niche open-source project with limited real-world deployment, resulting in low overall risk despite easy exploitability.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to interfere with database queries via the productName parameter in /php_action/createProduct.php. Exploit code is publicly available, though the EPSS score of 0.06% indicates a low probability of widespread exploitation at this time.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate the brandId parameter in removeBrand.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available but no active exploitation has been confirmed, and EPSS risk is low.
CVE-2025-6668 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/fetchSelectedBrand.php endpoint via the brandId parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, with disclosed public exploits and active exploitation potential. The CVSS 7.3 score reflects moderate impact across confidentiality, integrity, and availability, though the attack requires no privileges or user interaction.
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
CVE-2025-6612 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/removeCategories.php endpoint. An unauthenticated remote attacker can manipulate the 'categoriesId' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available and demonstrates active exploitation potential with a CVSS 7.3 score indicating moderate-to-high severity.
CVE-2025-6611 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createBrand.php endpoint via the brandStatus parameter. The vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially resulting in unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation risk are confirmed.
CVE-2025-6503 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/fetchSelectedCategories.php file where the 'categoriesId' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly elevating exploitation risk in production environments.
CVE-2025-6502 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/changePassword.php file where the user_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, increasing immediate risk of active exploitation.
CVE-2025-6501 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createCategories.php file, where the 'categoriesStatus' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and proof-of-concept availability indicate active threat potential with low barrier to exploitation.
CVE-2025-6500 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editCategories.php file where the 'editCategoriesName' parameter is inadequately sanitized. An unauthenticated attacker can exploit this remotely to read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Public exploit disclosure and confirmed proof-of-concept availability increase real-world risk significantly.
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
CVE-2025-6354 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the customer signup functionality (/function/customer_signup.php). An unauthenticated remote attacker can manipulate the email parameter to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability and demonstrates active exploitation potential.
CVE-2025-6344 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /contactus.php file's email parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public disclosure and exploit code availability increase the real-world threat level significantly.
CVE-2025-6343 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_product.php file where the 'pid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the shoe store's database. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-6342 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0, specifically in the /admin/admin_football.php file where the 'pid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.
CVE-2025-6317 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /admin/confirm.php file's ID parameter. An unauthenticated remote attacker can execute arbitrary SQL commands with low complexity, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active attack feasibility significantly elevate real-world risk despite the moderate CVSS score of 7.3.
CVE-2025-6316 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_running.php file where the 'qty' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score is 7.3 (high), the attack vector is network-based with low complexity, indicating active exploitation is feasible.
CVE-2025-6315 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /cart2.php endpoint via an unsanitized ID parameter. An unauthenticated remote attacker can exploit this over the network with low complexity to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. A public proof-of-concept has been disclosed and the vulnerability may be actively exploited.
CVE-2025-6307 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /function/edit_customer.php file, where the 'firstname' parameter is insufficiently sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept details available, and while rated 7.3 (High) in CVSS v3.1, the network-accessible attack vector combined with no authentication requirement and demonstrated public exploitation significantly elevates real-world risk. Other parameters in the same function are suspected to be vulnerable to the same injection pattern.
CVE-2025-6306 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the admin authentication mechanism in /admin/admin_index.php. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data theft, or data manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
CVE-2025-6305 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /admin/admin_feature.php endpoint via the product_code parameter. An unauthenticated remote attacker can execute arbitrary SQL commands to read, modify, or delete database contents. The vulnerability has public exploit disclosure and carries a CVSS 7.3 score with confirmed exploitation potential.
CVE-2025-6304 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /cart.php file's qty[] parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept exploits available, presenting immediate exploitation risk to unpatched instances of this e-commerce application.
CVE-2025-6303 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /contactus1.php file's Message parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
Critical authentication bypass vulnerability in code-projects Laundry System 1.0 affecting the /data/ endpoint, allowing unauthenticated remote attackers to read, modify, and potentially disrupt system availability. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity, the network-based attack vector (AV:N), lack of privilege requirement (PR:N), and absence of user interaction (UI:N) make this immediately exploitable in production environments. Active exploitation is likely given public POC availability and the ease of attack execution.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated attackers to inject arbitrary web scripts via the 'Type' parameter in /data/insert_type.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated users to inject arbitrary web scripts via the 'Type' parameter in /data/edit_type.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or manipulate database contents via the itr_no parameter in /view_dental.php. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.04%), indicating limited exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no or comp_id parameters in /birthing.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.04%).
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request and requires user interaction. A public exploit is available, but no active exploitation has been reported.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/edit_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/insert_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no parameter in view_hematology.php. A public exploit exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.04%), suggesting limited real-world risk.
A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/users.php. The manipulation of the argument delete leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s7.php` endpoint to remote database manipulation through an unsanitized `ID` parameter, enabling unauthenticated attackers to read, modify, or delete backend database content. The CVSS 4.0 vector confirms no authentication and no user interaction are required, making this trivially exploitable from the network; a public proof-of-concept has been disclosed on GitHub at https://github.com/vullis0/cve/issues/1. Despite accessible attack conditions, an EPSS score of 0.07% (20th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis, likely reflecting the product's extremely limited deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the underlying database through the `credits` parameter of `/admin/update_s8.php`. The CVSS 4.0 vector assigns PR:N (no privileges required), though the admin-path endpoint raises questions about whether authentication is enforced - a detail not resolved by available data. A publicly available proof-of-concept exploit exists (GitHub issue linked in references), but EPSS remains very low at 0.09% (25th percentile), indicating negligible observed exploitation activity at this time. No vendor-released patch has been identified.
SQL injection in code-projects Exam Form Submission 1.0 exposes the backend database to unauthorized read and write operations via the unsanitized `credits` parameter in `/admin/update_fst.php`. A publicly available proof-of-concept on GitHub (referenced in NVD) documents the exact injection point, lowering the bar for opportunistic attacks against any internet-exposed instance. Despite a moderate CVSS 4.0 score of 5.5 and a low EPSS of 0.09% (25th percentile), the combination of a network-accessible vector, no complexity barriers, and public exploit code makes this actionable for any deployment - no public exploit identified as confirmed active exploitation (not in CISA KEV), but publicly available exploit code exists.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s3.php` endpoint to remote manipulation via an unsanitized `ID` parameter, enabling attackers to read, alter, or destroy database records. The CVSS 4.0 base vector confirms no authentication or user interaction is required (PR:N/UI:N/AV:N), though the endpoint's placement under `/admin/` raises questions about whether real-world deployments enforce access controls. A public proof-of-concept has been disclosed on GitHub; exploitation is not confirmed in CISA KEV and EPSS sits at a low 0.09%, consistent with the product's negligible enterprise footprint.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s2.php endpoint to remote exploitation via an unsanitized `ID` parameter, enabling arbitrary SQL query execution against the backend database. Public exploit code has been disclosed via GitHub (CVE-ZhuChengQing/issues/6), confirming practical exploitability despite an EPSS score of 0.09% (25th percentile) that reflects the product's narrow deployment footprint rather than low technical risk. The vulnerability is not listed in CISA KEV, and no vendor-released patch has been identified at time of analysis.
SQL injection in code-projects Exam Form Submission 1.0 exposes the /admin/delete_s1.php endpoint to remote database manipulation via an unsanitized ID parameter. The vulnerability (CWE-74, Injection) allows a remote attacker to craft malicious HTTP requests that alter the intended SQL query, potentially reading, modifying, or deleting records in the underlying database. A public proof-of-concept has been disclosed on GitHub; however, EPSS stands at just 0.09% (25th percentile) and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis.
Unrestricted file upload in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `image` parameter of the `/register.php` registration endpoint. If uploaded files are stored in a web-accessible, script-executable directory (the typical deployment pattern for this PHP application), this flaw enables full remote code execution on the underlying server. A publicly available proof-of-concept exploit exists per a GitHub issue reference; EPSS is low at 0.12% (30th percentile), reflecting the product's limited deployment footprint rather than low exploitability. No active exploitation is confirmed in CISA KEV.
SQL injection in code-projects Exam Form Submission 1.0 exposes the `/admin/delete_s6.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the application's database. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication barrier and no complexity hurdle, making exploitation straightforward for any internet-reachable deployment. A public proof-of-concept exploit has been disclosed on GitHub, though EPSS sits at just 0.07% (20th percentile) and no CISA KEV listing exists, reflecting the product's extremely limited real-world deployment footprint.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /admin/delete_s5.php. Authentication is not required, and a public proof-of-concept exploit is available. Despite high CVSS severity, the EPSS exploitation probability is very low (0.07%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Exam Form Submission 1.0 allows remote unauthenticated attackers to extract or modify database contents via the /admin/delete_s4.php endpoint. Public exploit code is available, increasing the risk of scanning and exploitation, though no active exploitation has been confirmed (not listed in CISA KEV). The EPSS score is low (0.09%), indicating a lower likelihood of mass exploitation at this time.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the 'credits' parameter in /admin/update_s4.php, potentially leading to unauthorized data modification or extraction. Publicly available exploit code exists, but EPSS indicates a low exploitation probability (0.09%).
SQL injection in code-projects Exam Form Submission 1.0 via the 'credits' parameter of /admin/update_s3.php enables remote attackers to interact with the backend database without authentication. A public exploit exists but no active exploitation (CISA KEV) has been reported; EPSS probability is very low at 0.09%. The CVSS 4.0 base score of 5.5 reflects low-impact confidentiality, integrity, and availability compromises.
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the phone parameter in /user/dashboard.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though EPSS scores predict low widespread exploitation risk.
SQL injection in Code-Projects Exam Form Submission 1.0 allows remote attackers to inject SQL commands via the email parameter of the /admin/ endpoint. A public exploit is available, but the vulnerability has a low EPSS score (0.07%) and affects a niche project with limited deployment, reducing real-world urgency despite the critical classification.
SQL injection in code-projects Exam Form Submission 1.0 allows authenticated administrative attackers to inject SQL via the 'credits' parameter in /admin/update_s2.php, potentially leading to data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation (CISA KEV) has been confirmed, and EPSS exploitation probability is very low (0.07%).
SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to inject malicious SQL via the 'credits' parameter of /admin/update_s1.php. This can lead to unauthorized data access, modification, or deletion. A publicly available exploit exists, but the vulnerability has a low EPSS score (0.07%) indicating limited exploitation likelihood.
A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
CVE-2025-7513 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slideupdate.php endpoint, where unsanitized idSlide parameter input allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploits available, enabling attackers to read, modify, or delete database records with moderate confidentiality, integrity, and availability impact.
CVE-2025-7512 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting the /contact-back.php file's contact-name parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential with a CVSS score of 7.3.
CVE-2025-7510 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/productadd_back.php file, where the 'namepro' parameter is improperly sanitized allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, and carries a CVSS 7.3 score indicating moderate-to-high real-world risk with low attack complexity. An attacker can extract, modify, or delete database contents without authentication, compromising confidentiality, integrity, and availability of the application.
CVE-2025-7509 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slide.php endpoint via the idSlide parameter. An unauthenticated remote attacker can exploit this with no user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7508 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/product-update.php endpoint, where the 'idProduct' parameter is improperly validated before database queries. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially exfiltrating sensitive data, modifying product information, or gaining further system access. The vulnerability has public exploit disclosure and active real-world exploitation is likely given the low attack complexity and lack of authentication requirements.
CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.
CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
SQL injection in Code-projects Student Enrollment System 1.0 allows unauthenticated remote attackers to inject SQL via the Username parameter in login.php, potentially leading to data theft or authentication bypass. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The EPSS score is very low, suggesting limited real-world exploitation likelihood.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
SQL injection in code-projects Crime Reporting System 1.0 allows remote attackers to inject arbitrary SQL via the email parameter of /headlogin.php. A public exploit exists but active exploitation is not confirmed; the EPSS probability is very low (0.07%). This vulnerability can lead to limited data exposure or manipulation.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter of /policelogin.php, potentially leading to authentication bypass and sensitive data exposure. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). EPSS indicates very low risk of widespread exploitation (0.06%, 19th percentile).
SQL injection in the registration form of Code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries by injecting SQL into the Name parameter. The exploit is publicly available but not currently listed in CISA KEV, and EPSS probability of exploitation remains low (0.06%). Although the vulnerability is trivial to exploit, the intrinsic impact is limited, affecting only the local database with low confidentiality, integrity, and availability repercussions.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'location' parameter of /complainer_page.php. A public exploit is available, though EPSS indicates extremely low likelihood of widespread exploitation and no active attacks are confirmed.
SQL injection in Crime Reporting System 1.0 allows remote unauthenticated attackers to manipulate database queries via the email parameter on the /userlogin.php page. The vulnerability has been publicly disclosed and exploit code is available, although the EPSS score is low (0.06%) and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
Unrestricted file upload in code-projects Library System 1.0's /profile.php allows authenticated remote attackers with low privileges to upload arbitrary files, likely resulting in remote code execution. Exploit code is publicly available, but active exploitation is not confirmed (no CISA KEV listing) and EPSS predicts a low exploitation probability (0.11%).
SQL injection in code-projects Library System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the phone parameter in /profile.php. The vulnerability has a publicly available proof-of-concept, though no active exploitation is confirmed and EPSS estimates low short-term exploitation probability (0.06%). Impact is limited per CVSS scoring, primarily posing a risk of data theft or tampering.
SQL injection in Code-Projects Library System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'reg' parameter in /student-issue-book.php. Public exploit code is available, enabling potential data tampering or unauthorized access. Despite a network attack vector, CVSS 4.0 rates overall severity as medium (5.5) due to limited impact.
SQL injection in Inventory Management System 1.0 allows unauthorized database manipulation via the orderId parameter. An unauthenticated remote attacker can exploit the /php_action/editPayment.php endpoint to execute arbitrary SQL statements. Public exploit code is available, though no active exploitation has been confirmed, and the EPSS probability is low.
We need to generate a JSON object with the specified fields. Let's extract information from the provided data. - CVE ID: CVE-2025-6828 - Description: "A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /orders.php. The manipulation of the argument i leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used." - CVSS Score: 5.5 (but vector is CVSS 4.0, given) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... (base part: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.06% (18th percentile) - POC/Exploit: Publicly available - KEV: not mentioned (so not in KEV) - Tags: PHP, SQLi - CPE: cpe:2.3:a:code-projects:inventory_management_system:1.0:*:*:*:*:*:*:* - Affected versions: "Inventory Management System 1.0" - References: many, including vuldb entries and github exploit. We need to produce a comprehensive analysis. Fields to fill: product_name: "Inventory Management System" (code-projects Inventory Management System, but 1-3 words only: "Inventory Management System" might be too generic? Could be "Code-Projects Inventory Management System", but that's 4 words. The instruction: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the vendor alone, NOT a description. If multiple products, pick the primary one." Here vendor is "code-projects", product is "Inventory Management System". That's 3 words if you count "Code-Projects" as one? Usually hyphenated. I'll go with "Inventory Management System" (3 words) or "Code-Projects Inventory Management System" (4 words). Need 1-3 words, so "Inventory Management S
SQL injection in code-projects Inventory Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the editOrder.php file. Public exploit code exists, though EPSS indicates low exploitation probability (0.06%) and no active exploitation has been confirmed.
SQL injection in Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the editProductName parameter in /php_action/editProduct.php. A public proof-of-concept exploit exists, but no active exploitation has been confirmed. The vulnerability has a medium CVSS 4.0 score and low EPSS likelihood, indicating limited practical risk outside of exposed installations.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the productId parameter in /php_action/removeProduct.php. An unauthenticated attacker can potentially access or modify database contents, though impact is rated low. A public proof-of-concept exists, but EPSS indicates low exploitation probability.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the /php_action/createOrder.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed. The issue affects a niche open-source project with limited real-world deployment, resulting in low overall risk despite easy exploitability.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to interfere with database queries via the productName parameter in /php_action/createProduct.php. Exploit code is publicly available, though the EPSS score of 0.06% indicates a low probability of widespread exploitation at this time.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate the brandId parameter in removeBrand.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available but no active exploitation has been confirmed, and EPSS risk is low.
CVE-2025-6668 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/fetchSelectedBrand.php endpoint via the brandId parameter. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete database contents, with disclosed public exploits and active exploitation potential. The CVSS 7.3 score reflects moderate impact across confidentiality, integrity, and availability, though the attack requires no privileges or user interaction.
CVE-2025-6665 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editBrand.php file's editBrandStatus parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with a proof-of-concept available, increasing real-world exploitation risk.
CVE-2025-6612 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/removeCategories.php endpoint. An unauthenticated remote attacker can manipulate the 'categoriesId' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available and demonstrates active exploitation potential with a CVSS 7.3 score indicating moderate-to-high severity.
CVE-2025-6611 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createBrand.php endpoint via the brandStatus parameter. The vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially resulting in unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation risk are confirmed.
CVE-2025-6503 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/fetchSelectedCategories.php file where the 'categoriesId' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The exploit has been publicly disclosed and proof-of-concept code is available, significantly elevating exploitation risk in production environments.
CVE-2025-6502 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/changePassword.php file where the user_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit details available, increasing immediate risk of active exploitation.
CVE-2025-6501 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0 affecting the /php_action/createCategories.php file, where the 'categoriesStatus' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and proof-of-concept availability indicate active threat potential with low barrier to exploitation.
CVE-2025-6500 is a critical SQL injection vulnerability in code-projects Inventory Management System 1.0, specifically in the /php_action/editCategories.php file where the 'editCategoriesName' parameter is inadequately sanitized. An unauthenticated attacker can exploit this remotely to read, modify, or delete database contents, affecting confidentiality, integrity, and availability. Public exploit disclosure and confirmed proof-of-concept availability increase real-world risk significantly.
CVE-2025-6474 is a critical SQL injection vulnerability in code-projects Inventory Management System version 1.0 affecting the /changeUsername.php file, specifically the user_id parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with proof-of-concept availability, making active exploitation likely.
CVE-2025-6354 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the customer signup functionality (/function/customer_signup.php). An unauthenticated remote attacker can manipulate the email parameter to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability and demonstrates active exploitation potential.
CVE-2025-6344 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /contactus.php file's email parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public disclosure and exploit code availability increase the real-world threat level significantly.
CVE-2025-6343 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_product.php file where the 'pid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the shoe store's database. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-6342 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0, specifically in the /admin/admin_football.php file where the 'pid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.
CVE-2025-6317 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /admin/confirm.php file's ID parameter. An unauthenticated remote attacker can execute arbitrary SQL commands with low complexity, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active attack feasibility significantly elevate real-world risk despite the moderate CVSS score of 7.3.
CVE-2025-6316 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_running.php file where the 'qty' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score is 7.3 (high), the attack vector is network-based with low complexity, indicating active exploitation is feasible.
CVE-2025-6315 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /cart2.php endpoint via an unsanitized ID parameter. An unauthenticated remote attacker can exploit this over the network with low complexity to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. A public proof-of-concept has been disclosed and the vulnerability may be actively exploited.
CVE-2025-6307 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /function/edit_customer.php file, where the 'firstname' parameter is insufficiently sanitized, allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept details available, and while rated 7.3 (High) in CVSS v3.1, the network-accessible attack vector combined with no authentication requirement and demonstrated public exploitation significantly elevates real-world risk. Other parameters in the same function are suspected to be vulnerable to the same injection pattern.
CVE-2025-6306 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the admin authentication mechanism in /admin/admin_index.php. An unauthenticated remote attacker can manipulate the Username parameter to execute arbitrary SQL queries, potentially leading to unauthorized access, data theft, or data manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.
CVE-2025-6305 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /admin/admin_feature.php endpoint via the product_code parameter. An unauthenticated remote attacker can execute arbitrary SQL commands to read, modify, or delete database contents. The vulnerability has public exploit disclosure and carries a CVSS 7.3 score with confirmed exploitation potential.
CVE-2025-6304 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the /cart.php file's qty[] parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete sensitive data. The vulnerability has been publicly disclosed with proof-of-concept exploits available, presenting immediate exploitation risk to unpatched instances of this e-commerce application.
CVE-2025-6303 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /contactus1.php file's Message parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making active exploitation likely.
Critical authentication bypass vulnerability in code-projects Laundry System 1.0 affecting the /data/ endpoint, allowing unauthenticated remote attackers to read, modify, and potentially disrupt system availability. The vulnerability has been publicly disclosed with exploit code available, and while CVSS 7.3 indicates moderate-to-high severity, the network-based attack vector (AV:N), lack of privilege requirement (PR:N), and absence of user interaction (UI:N) make this immediately exploitable in production environments. Active exploitation is likely given public POC availability and the ease of attack execution.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated attackers to inject arbitrary web scripts via the 'Type' parameter in /data/insert_type.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows remote authenticated users to inject arbitrary web scripts via the 'Type' parameter in /data/edit_type.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or manipulate database contents via the itr_no parameter in /view_dental.php. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.04%), indicating limited exploitation likelihood.
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no or comp_id parameters in /birthing.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.04%).
Cross-site request forgery in code-projects Laundry System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request and requires user interaction. A public exploit is available, but no active exploitation has been reported.
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/edit_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting (XSS) in code-projects Laundry System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Customer parameter in /data/insert_laundry.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
SQL injection in code-projects Patient Record Management System 1.0 allows remote authenticated attackers to extract or modify database contents via the itr_no parameter in view_hematology.php. A public exploit exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.04%), suggesting limited real-world risk.
A vulnerability was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/users.php. The manipulation of the argument delete leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.