Fabian
Monthly
Improper authentication in the CRUD endpoint of code-projects Contact Management System 1.0 allows unauthenticated remote attackers to manipulate ID parameters and bypass access controls. This vulnerability enables unauthorized users to read, modify, or delete sensitive contact data without valid credentials. No patch is currently available.
SQL injection in code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the username and password parameters in login.php, potentially enabling unauthorized access to sensitive data or system compromise. The vulnerability requires no user interaction and can be exploited over the network with low complexity. No patch is currently available for this issue.
SQL injection in Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter in the student results view functionality, enabling unauthorized database access and potential data modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in code-projects Community Project Scholars Tracking System 1.0 admin user management. Allows database compromise via admin panel. PoC available.
Scholars Tracking System versions up to 1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_functions.php. [CVSS 3.5 LOW]
SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the assessment module allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available.
A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/system/admins/manage/users/btn_functions.php. [CVSS 2.4 LOW]
SQL injection in the login component of code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, which affects PHP-based installations of the Online Reviewer System. An attacker can exploit this to extract sensitive data, modify database contents, or potentially gain unauthorized system access.
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/btn_functions.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. [CVSS 2.4 LOW]
Unrestricted file upload in Online Music Site 1.0's AdminAddAlbum.php allows authenticated administrators with high privileges to upload arbitrary files via the txtimage parameter. Public exploit code exists for this vulnerability, enabling remote attackers to potentially execute malicious code or compromise the application. The affected component impacts both the PHP runtime and the vulnerable web application, with no patch currently available.
SQL injection in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in AdminEditCategory.php, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in the user deletion function, potentially leading to unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations vulnerable to active exploitation.
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/loaddata.php allows remote attackers to execute arbitrary SQL queries without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could result in unauthorized data access, modification, or deletion within the application database.
SQL injection in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate the test_id parameter in the exam-delete.php file, enabling unauthorized database access and modification without authentication. The vulnerability has public exploit code available and currently lacks a patch, posing an immediate risk to unpatched installations. Affected organizations using this system should prioritize mitigation strategies while awaiting official remediation.
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter in the exam-update.php endpoint, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the questions-view.php file allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at active risk.
SQL injection in code-projects Contact Management System 1.0 allows authenticated remote attackers to manipulate the selecteditem[0] parameter in index.py and execute arbitrary SQL queries. The vulnerability requires valid user credentials but enables data exfiltration, modification, and potential system compromise. No patch is currently available.
Online Application System For Admission versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in the login function of code-projects Online Student Management System 1.0 allows unauthenticated attackers to manipulate username and password parameters in accounts.php, enabling unauthorized data access, modification, and potential service disruption. Public exploit code is available for this vulnerability, increasing exploitation risk. No patch is currently available.
SQL injection in the Online Reviewer System 1.0 login function allows unauthenticated remote attackers to manipulate username and password parameters, potentially enabling unauthorized database access and data modification. With public exploit code available and no patch released, this vulnerability poses an immediate risk to deployed instances.
Online Student Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 2.4).
Unrestricted file upload in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to upload arbitrary files by manipulating the txtimage parameter. Public exploit code exists for this vulnerability, enabling potential remote code execution and system compromise. A security patch is not currently available, leaving affected installations vulnerable to active exploitation.
SQL injection in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to manipulate the txtcat parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, with no patch currently available. The attack requires no user interaction and can compromise the confidentiality, integrity, and availability of the underlying database.
Simple Blood Donor Management System versions up to 1.0 contains a security vulnerability (CVSS 7.3).
SQL injection in Online Music Site 1.0's AdminReply.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL queries, potentially compromising database confidentiality and integrity. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in Online Music Site 1.0's AdminEditUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling potential data theft, modification, or service disruption. No patch is currently available, leaving affected installations vulnerable.
SQL injection in Online Music Site 1.0's AdminAddCategory.php allows remote attackers with high privileges to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Mobile Shop Management System has code injection in ExAddNewUser.php.
Mobile Shop Management System has SQL injection in ExLogin.php.
Mobile Shop Management System has SQL injection in insertmessage.php.
Mobile Shop Management System has file upload enabling web shell deployment.
SQL injection in Online Music Site 1.0's AdminDeleteUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker can leverage this to compromise data confidentiality, integrity, and availability.
Unrestricted file upload in code-projects Online Examination System 1.0 via the /admin_pic.php endpoint allows authenticated remote attackers to upload arbitrary files with minimal complexity. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable code execution or system compromise depending on server configuration and file handling.
SQL injection in the login page of code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the User parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and affects confidentiality, integrity, and availability of the affected system.
A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. [CVSS 3.5 LOW]
SQL injection in Online Music Site 1.0's AdminUpdateUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable unauthorized data access, modification, or deletion with confidentiality, integrity, and availability impact.
SQL injection in code-projects Online Music Site 1.0 via the txtusername parameter in AdminAddUser.php enables unauthenticated remote attackers to manipulate database queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Online Music Site 1.0 via the ID parameter in /FrontEnd/Albums.php allows unauthenticated remote attackers to manipulate database queries and potentially extract or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
SQL injection in the Online Music Site 1.0 login functionality allows unauthenticated remote attackers to manipulate username and password parameters, potentially leading to unauthorized data access, modification, or service disruption. Public exploit code exists for this vulnerability, and no patch is currently available, leaving deployed instances at immediate risk.
SQL injection in the Online Product Reservation System 1.0 user registration handler allows remote attackers to manipulate multiple input fields (name, address, contact details, email, username) without authentication to execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing active exploitation risk. No patch is currently available for affected PHP-based installations.
SQL injection in the cart update handler of Online Product Reservation System 1.0 allows authenticated attackers to manipulate product ID and quantity parameters, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available, affecting systems running the vulnerable PHP application.
SQL injection in the Online Product Reservation System 1.0 checkout delete function allows authenticated attackers to manipulate POST parameters and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems at risk of data theft or manipulation.
Online Product Reservation System versions up to 1.0 is affected by improper authentication (CVSS 7.3).
Online Product Reservation System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
SQL injection in the Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate the transaction_id parameter in /order_view.php and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to read, modify, or delete sensitive data with network access only.
SQL injection in the Online Product Reservation System 1.0 via the ID parameter in app/products/left_cart.php allows authenticated attackers to read, modify, or delete database contents remotely. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected PHP installations running this software.
SQL injection in the User Login component of Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate the emailadd parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers to potentially extract sensitive data or modify database contents. No patch is currently available to address this issue.
SQL injection in the Online Product Reservation System 1.0 POST parameter handler allows unauthenticated remote attackers to manipulate product attributes like ID, name, and price to execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations face potential data theft, modification, and service disruption.
SQL injection in the Online Product Reservation System 1.0 administrator delete function allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code is available for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected PHP installations running this product.
Online Product Reservation System versions up to 1.0 is affected by improper access control (CVSS 6.3).
SQL injection in the Online Product Reservation System 1.0 parameter handler allows unauthenticated remote attackers to manipulate cat/price/name/model/serial arguments and execute arbitrary SQL queries with public exploit code available. The vulnerability affects the /handgunner-administrator/prod.php endpoint and enables attackers to read, modify, or delete database contents without authentication. No patch is currently available for this high-severity flaw.
SQL injection in the administrator login component of code-projects Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate emailadd and pass parameters in /handgunner-administrator/adminlogin.php, enabling data exfiltration and modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in code-projects Online Music Site 1.0 via the fname parameter in /Frontend/Feedback.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive information. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in code-projects Online Music Site 1.0 via the ID parameter in /Frontend/AlbumByCategory.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Online Music Site 1.0's ViewSongs.php parameter handling allows unauthenticated remote attackers to manipulate the ID argument and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and impacts the confidentiality, integrity, and availability of the affected application.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.
SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.
SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.
SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
Improper authentication in the CRUD endpoint of code-projects Contact Management System 1.0 allows unauthenticated remote attackers to manipulate ID parameters and bypass access controls. This vulnerability enables unauthorized users to read, modify, or delete sensitive contact data without valid credentials. No patch is currently available.
SQL injection in code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the username and password parameters in login.php, potentially enabling unauthorized access to sensitive data or system compromise. The vulnerability requires no user interaction and can be exploited over the network with low complexity. No patch is currently available for this issue.
SQL injection in Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter in the student results view functionality, enabling unauthorized database access and potential data modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in code-projects Community Project Scholars Tracking System 1.0 admin user management. Allows database compromise via admin panel. PoC available.
Scholars Tracking System versions up to 1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /system/system/admins/manage/users/btn_functions.php. [CVSS 3.5 LOW]
SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the assessment module allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available.
A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/system/admins/manage/users/btn_functions.php. [CVSS 2.4 LOW]
SQL injection in the login component of code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the Username parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, which affects PHP-based installations of the Online Reviewer System. An attacker can exploit this to extract sensitive data, modify database contents, or potentially gain unauthorized system access.
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/btn_functions.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
A weakness has been identified in code-projects for Plugin 1.0. This affects an unknown part of the file /Administrator/PHP/AdminAddAlbum.php. [CVSS 2.4 LOW]
Unrestricted file upload in Online Music Site 1.0's AdminAddAlbum.php allows authenticated administrators with high privileges to upload arbitrary files via the txtimage parameter. Public exploit code exists for this vulnerability, enabling remote attackers to potentially execute malicious code or compromise the application. The affected component impacts both the PHP runtime and the vulnerable web application, with no patch currently available.
SQL injection in code-projects Online Music Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in AdminEditCategory.php, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in the user deletion function, potentially leading to unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations vulnerable to active exploitation.
SQL injection in code-projects Online Reviewer System 1.0 via the difficulty_id parameter in /system/system/admins/assessments/pretest/loaddata.php allows remote attackers to execute arbitrary SQL queries without authentication. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could result in unauthorized data access, modification, or deletion within the application database.
SQL injection in code-projects Online Reviewer System 1.0 allows remote attackers to manipulate the test_id parameter in the exam-delete.php file, enabling unauthorized database access and modification without authentication. The vulnerability has public exploit code available and currently lacks a patch, posing an immediate risk to unpatched installations. Affected organizations using this system should prioritize mitigation strategies while awaiting official remediation.
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate the test_id parameter in the exam-update.php endpoint, enabling unauthorized database access and modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in code-projects Online Reviewer System 1.0 via the ID parameter in the questions-view.php file allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at active risk.
SQL injection in code-projects Contact Management System 1.0 allows authenticated remote attackers to manipulate the selecteditem[0] parameter in index.py and execute arbitrary SQL queries. The vulnerability requires valid user credentials but enables data exfiltration, modification, and potential system compromise. No patch is currently available.
Online Application System For Admission versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in the login function of code-projects Online Student Management System 1.0 allows unauthenticated attackers to manipulate username and password parameters in accounts.php, enabling unauthorized data access, modification, and potential service disruption. Public exploit code is available for this vulnerability, increasing exploitation risk. No patch is currently available.
SQL injection in the Online Reviewer System 1.0 login function allows unauthenticated remote attackers to manipulate username and password parameters, potentially enabling unauthorized database access and data modification. With public exploit code available and no patch released, this vulnerability poses an immediate risk to deployed instances.
Online Student Management System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 2.4).
Unrestricted file upload in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to upload arbitrary files by manipulating the txtimage parameter. Public exploit code exists for this vulnerability, enabling potential remote code execution and system compromise. A security patch is not currently available, leaving affected installations vulnerable to active exploitation.
SQL injection in Online Music Site 1.0's AdminUpdateCategory.php allows unauthenticated remote attackers to manipulate the txtcat parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, with no patch currently available. The attack requires no user interaction and can compromise the confidentiality, integrity, and availability of the underlying database.
Simple Blood Donor Management System versions up to 1.0 contains a security vulnerability (CVSS 7.3).
SQL injection in Online Music Site 1.0's AdminReply.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL queries, potentially compromising database confidentiality and integrity. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in Online Music Site 1.0's AdminEditUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, enabling potential data theft, modification, or service disruption. No patch is currently available, leaving affected installations vulnerable.
SQL injection in Online Music Site 1.0's AdminAddCategory.php allows remote attackers with high privileges to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Mobile Shop Management System has code injection in ExAddNewUser.php.
Mobile Shop Management System has SQL injection in ExLogin.php.
Mobile Shop Management System has SQL injection in insertmessage.php.
Mobile Shop Management System has file upload enabling web shell deployment.
SQL injection in Online Music Site 1.0's AdminDeleteUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. An attacker can leverage this to compromise data confidentiality, integrity, and availability.
Unrestricted file upload in code-projects Online Examination System 1.0 via the /admin_pic.php endpoint allows authenticated remote attackers to upload arbitrary files with minimal complexity. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable code execution or system compromise depending on server configuration and file handling.
SQL injection in the login page of code-projects Online Examination System 1.0 allows unauthenticated remote attackers to manipulate the User parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and affects confidentiality, integrity, and availability of the affected system.
A vulnerability has been found in code-projects Online Examination System 1.0. Affected is an unknown function of the component Add Pages. [CVSS 3.5 LOW]
SQL injection in Online Music Site 1.0's AdminUpdateUser.php allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Successful exploitation could enable unauthorized data access, modification, or deletion with confidentiality, integrity, and availability impact.
SQL injection in code-projects Online Music Site 1.0 via the txtusername parameter in AdminAddUser.php enables unauthenticated remote attackers to manipulate database queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available.
Online Music Site versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
SQL injection in code-projects Online Music Site 1.0 via the ID parameter in /FrontEnd/Albums.php allows unauthenticated remote attackers to manipulate database queries and potentially extract or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
SQL injection in the Online Music Site 1.0 login functionality allows unauthenticated remote attackers to manipulate username and password parameters, potentially leading to unauthorized data access, modification, or service disruption. Public exploit code exists for this vulnerability, and no patch is currently available, leaving deployed instances at immediate risk.
SQL injection in the Online Product Reservation System 1.0 user registration handler allows remote attackers to manipulate multiple input fields (name, address, contact details, email, username) without authentication to execute arbitrary database queries. Public exploit code exists for this vulnerability, increasing active exploitation risk. No patch is currently available for affected PHP-based installations.
SQL injection in the cart update handler of Online Product Reservation System 1.0 allows authenticated attackers to manipulate product ID and quantity parameters, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available, affecting systems running the vulnerable PHP application.
SQL injection in the Online Product Reservation System 1.0 checkout delete function allows authenticated attackers to manipulate POST parameters and execute arbitrary database queries remotely. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected systems at risk of data theft or manipulation.
Online Product Reservation System versions up to 1.0 is affected by improper authentication (CVSS 7.3).
Online Product Reservation System versions up to 1.0 is affected by cross-site scripting (xss) (CVSS 4.3).
SQL injection in the Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate the transaction_id parameter in /order_view.php and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch is currently available. The flaw enables attackers to read, modify, or delete sensitive data with network access only.
SQL injection in the Online Product Reservation System 1.0 via the ID parameter in app/products/left_cart.php allows authenticated attackers to read, modify, or delete database contents remotely. Public exploit code exists for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected PHP installations running this software.
SQL injection in the User Login component of Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate the emailadd parameter and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, enabling attackers to potentially extract sensitive data or modify database contents. No patch is currently available to address this issue.
SQL injection in the Online Product Reservation System 1.0 POST parameter handler allows unauthenticated remote attackers to manipulate product attributes like ID, name, and price to execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations face potential data theft, modification, and service disruption.
SQL injection in the Online Product Reservation System 1.0 administrator delete function allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary database queries. Public exploit code is available for this vulnerability, increasing the risk of active exploitation. No patch is currently available for affected PHP installations running this product.
Online Product Reservation System versions up to 1.0 is affected by improper access control (CVSS 6.3).
SQL injection in the Online Product Reservation System 1.0 parameter handler allows unauthenticated remote attackers to manipulate cat/price/name/model/serial arguments and execute arbitrary SQL queries with public exploit code available. The vulnerability affects the /handgunner-administrator/prod.php endpoint and enables attackers to read, modify, or delete database contents without authentication. No patch is currently available for this high-severity flaw.
SQL injection in the administrator login component of code-projects Online Product Reservation System 1.0 allows unauthenticated remote attackers to manipulate emailadd and pass parameters in /handgunner-administrator/adminlogin.php, enabling data exfiltration and modification. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in code-projects Online Music Site 1.0 via the fname parameter in /Frontend/Feedback.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive information. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in code-projects Online Music Site 1.0 via the ID parameter in /Frontend/AlbumByCategory.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Online Music Site 1.0's ViewSongs.php parameter handling allows unauthenticated remote attackers to manipulate the ID argument and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and impacts the confidentiality, integrity, and availability of the affected application.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.
SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.
SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.
SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.