Fabian
Monthly
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.
SQL injection vulnerability in the Class and Exam Timetable Management System v1.0 login page allows remote, unauthenticated attackers to inject arbitrary SQL via the username and password fields in /index.php. Exploit code is publicly available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates a low exploitation probability.
SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.
SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.
SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.
Unauthenticated SQL injection in Simple Shopping Cart 1.0 via the admin_username parameter on /adminlogin.php allows remote attackers to extract sensitive data or bypass authentication. A proof-of-concept exploit is publicly available, though no active exploitation has been reported in CISA KEV. The vulnerability affects code-projects/fabian's PHP-based shopping cart software.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate the item_name parameter in /Admin/additems.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed, and a low EPSS score (0.04%) indicates minimal immediate risk.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate database queries via the user_id parameter in /Customers/settings.php. While the CVSS 4.0 base score is only 2.1 (Low), public exploit code is available, enabling authenticated attackers to read or modify database contents. The EPSS score of 0.04% and absence from CISA KEV suggest low real-world exploitation probability, but organizations using this product should assess internal risk based on stored data sensitivity.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
We need to create a comprehensive JSON analysis for CVE-2025-14205, synthesizing all provided data. The input includes: description, CVSS score 1.9 with vector, CWE-79 (XSS), EPSS 0.03% (low), CPE for fabian chamber_of_commerce_membership_management_system:1.0, tags XSS, PHP, etc. No KEV mentioned, no explicit patch data. POC is made public per description ("exploit has been made public"). Vulnerability: stored/reflected XSS? Description says "manipulation of the argument Full Name/Address/City/State results in cross site scripting". The component is "Your Info Handler" in /membership_profile.php. So likely stored XSS in profile fields. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. So PR:H (high privileges required), UI:P (passive user interaction?), VC:N (no confidentiality impact from vulnerable system), VI:L (low integrity impact to vulnerable system), VA:N. No scope change. Exploit maturity: P (Proof-of-concept). That indicates an exploit exists, consistent with "exploit has been made public." So we'll note that publicly available exploit code exists. No KEV, so not actively exploited. We need to produce fields. Product name: "Chamber of Commerce Membership Management System" is long, but rule: "1-3 words ONLY. The specific product or service name affected." So we could pick "Chamber of Commerce Membership Management System" but that's 6 words. Alternative: "Membership Management System"? Not precise. Possibly "code-projects Chamber CMS" or "Chamber CMS". But rule says: "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So the product is the software name, not the vendor. The vendor is "fabian" per CPE, product name in CPE: "chamber_of_commerce_membership_management_system". So I'd use "Chamber of Commerce Membership Management System". That is 6 words, but the rule says "1-3 words ONLY" – it might be acceptable as a proper name? The rule is strict: 1-3 words. That's challenging. Maybe "Comme
A vulnerability was detected in code-projects Blog Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in code-projects Blog Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A weakness has been identified in code-projects Online Bidding System 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Nero Social Networking Site 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Information System 2.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Student Information System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Student Information System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Email Logging Interface 2.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Online Job Search Engine 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files through the photo parameter of /addproduct.php, potentially enabling web shell deployment and full server compromise. The affected product is tracked under CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0, and exploit code is publicly available via GitHub. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.06% (17th percentile), though the presence of a public proof-of-concept combined with an authentication bypass tag elevates realistic risk above what the low EPSS would suggest.
Stored cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name or supp_address parameters in /pages/supplier_update.php. Exploitation requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists; real-world exploitation risk is low (EPSS 0.04%, CVSS 2.1) due to limited scope and required user interaction, but the vulnerability is disclosed and weaponizable.
Reflected cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the prod_name, prod_desc, or prod_cost parameters in /pages/product_add.php. The vulnerability requires user interaction (UI:P per CVSS 4.0) but can be exploited remotely without authentication. Publicly available exploit code exists, though EPSS scoring (0.04%, percentile 11%) indicates low real-world exploitation probability despite public POC availability.
Reflected cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name and supp_address parameters in /pages/supplier_add.php. The vulnerability requires user interaction (clicking a crafted link) but enables session hijacking, credential theft, and malware distribution. Publicly available exploit code exists; however, the EPSS score of 0.04% (11th percentile) indicates exploitation remains uncommon despite disclosure, likely due to limited deployment of this niche e-commerce platform.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
Cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via unsanitized input parameters (pname, category, price) in the /editproduct.php endpoint. The vulnerability requires user interaction (UI:P) but carries low integrity impact and has publicly available exploit code; EPSS probability remains minimal (0.03%) despite public POC availability, suggesting limited real-world adoption or exploitation barriers.
Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary files through the photo parameter of /editproduct.php, exploiting improper access control (CWE-284) that effectively bypasses authentication on the upload endpoint. The Authentication Bypass tag alongside CWE-284 signals that the product-editing endpoint - which should be access-controlled - can be reached without valid credentials, enabling file placement on the server. A public proof-of-concept is disclosed on GitHub; EPSS sits at 0.06% (17th percentile), indicating minimal observed exploitation at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via the cname parameter in /addcategory.php, which are executed in the browsers of users viewing affected content. The vulnerability requires user interaction (UI:P) to exploit but has a public proof-of-concept available. Despite the low CVSS score (2.1) and minimal EPSS percentile (10%), the combination of remote network access and public exploit code necessitates prompt patching to prevent account compromise and session hijacking.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts through the pname, category, or price parameters in /addproduct.php, requiring user interaction to trigger payload execution. Public exploit code is available, and the vulnerability carries low severity (CVSS 2.1) due to the requirement for user interaction and limited scope of impact.
Reflected cross-site scripting (XSS) in Simple Food Ordering System 1.0 via the pname parameter in /editcategory.php allows remote attackers to inject malicious JavaScript that executes in users' browsers with minimal user interaction. The vulnerability requires user interaction (clicking a malicious link) but has low technical complexity and publicly available exploit code, though active exploitation remains unconfirmed and real-world impact is limited by the low EPSS score of 0.03% despite public POC availability.
Authentication bypass in code-projects Client Details System 1.0 allows authenticated remote attackers to gain unauthorized access to protected functionality via an unknown vector. The vulnerability has publicly available exploit code but is rated low-risk due to CVSS 2.1 score and 0.01% EPSS, indicating limited real-world exploitation potential despite remote attack capability.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated users with high privileges to inject malicious scripts via the /admin/manage-users.php endpoint, which are then executed in the browsers of other users who interact with the managed user data. The vulnerability requires administrative privileges and user interaction (UI:P) to exploit, resulting in limited integrity impact (VI:L). Public exploit code is available, though the extremely low CVSS score (1.9) and EPSS probability (0.04%) reflect the high privilege barrier and user interaction requirement that significantly constrain real-world risk.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated high-privilege users to inject malicious scripts into the /admin/clientview.php endpoint that execute in the context of other users' browsers. The vulnerability requires user interaction (victim must view affected content) and high administrative privileges to exploit, limiting real-world risk despite public exploit disclosure. EPSS score of 0.03% reflects the stringent authentication and interaction requirements that prevent widespread automated exploitation.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /update-clients.php endpoint, requiring user interaction to execute. The vulnerability carries a low CVSS score of 1.9 due to high privilege requirements (PR:H) and mandatory user interaction (UI:P), but publicly available exploit code exists, making it actionable for insider threats or social engineering scenarios targeting administrators.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows remote attackers with high privileges and user interaction to inject malicious scripts via the /welcome.php file, resulting in limited integrity impact. The vulnerability has been publicly disclosed with exploit code available, though real-world exploitation is constrained by the requirement for high administrative privileges and user interaction, reflected in the exceptionally low CVSS score of 1.9 and EPSS probability of 0.03%.
Reflected cross-site scripting (XSS) in Simple E-Banking System 1.0 allows remote attackers to inject malicious scripts via the Username parameter in /eBank/register.php. The vulnerability requires user interaction (clicking a malicious link) but has low impact on confidentiality and integrity. Publicly available exploit code exists, though EPSS scoring (0.03%, 10th percentile) suggests limited real-world exploitation despite XSS being a common attack vector.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the ID parameter in clientdetails/welcome.php, enabling database queries with limited scope impact. CVSS 2.1 reflects low severity due to authentication requirement (PR:L) and limited confidentiality/integrity exposure (VC:L/VI:L), though publicly available exploit code exists and EPSS scoring (0.03%, 8th percentile) indicates minimal real-world exploitation likelihood despite public POC availability.
SQL injection in code-projects Automated Voting System 1.0 allows authenticated remote attackers to manipulate the Username parameter in /admin/user.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid login credentials (PR:L) and has publicly available exploit code, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.03% EPSS percentile.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
Hard-coded cryptographic key in express-session component of code-projects Hospital Management System 1.0 allows remote attackers to bypass session security and disclose sensitive information. The vulnerability stems from use of a fixed secret parameter in the session middleware, enabling attackers to forge or predict session tokens. While a public exploit exists, the attack requires high complexity and difficult exploitation, reflected in the low CVSS 2.9 score and minimal EPSS probability (0.19%), suggesting limited real-world risk despite information disclosure impact.
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in Project Monitoring System 1.0 allows remote attackers to manipulate the uid parameter on the /useredit.php endpoint, potentially exposing or modifying database contents. The exploit code is publicly available, but real-world risk is very low (EPSS 0.03%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Job Search Engine 1.0 via the txtspecialization parameter in searchjob.php allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized data access or modification. A publicly disclosed exploit exists, but the affected product is a niche educational project with low real-world deployment, and no active exploitation has been reported.
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate the txtjob
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate database queries via the txtusername parameter in /registration.php. The vulnerability enables extraction, modification, or deletion of database contents and could bypass authentication. Exploit code is publicly available, though active exploitation has not been confirmed.
Stored Cross-Site Scripting in code-projects Simple Online Hotel Reservation System 1.0 allows a low-privileged attacker to inject persistent malicious JavaScript into the Add Room Description field, which executes in the administrator's browser session when room information is viewed, resulting in session cookie theft. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires authenticated access to add rooms and administrator interaction to trigger, but scope change to C:L reflects the realistic impact of session hijacking. A publicly available proof-of-concept exploit exists on GitHub, though no public exploitation has been confirmed and EPSS sits at a low 0.24th-percentile probability.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.
Stored Cross-Site Scripting in code-projects Simple Scheduling System 1.0 allows an attacker to inject arbitrary JavaScript via the Subject Description field, which executes in victims' browsers when they view the affected page. The scope change in the CVSS vector (S:C) confirms the script runs in a different security context than where the payload is injected, enabling session hijacking, credential theft, or malicious redirects against users of the application. A publicly available proof-of-concept exploit exists, though exploitation probability remains low (EPSS 0.22%) and no confirmed active exploitation is recorded.
Stored cross-site scripting in code-projects Client Details System 1.0 allows an attacker who can submit customer records to persist malicious JavaScript in the username field, which then executes in the browser of any user who subsequently views that record. The CVSS scope change (S:C) indicates the payload crosses from the application's trust boundary into a victim's browser session, enabling session hijacking or credential theft against administrative users. A publicly available proof-of-concept exists, though no CISA KEV listing has been issued and the EPSS score of 0.22% (12th percentile) reflects low observed exploitation activity.
SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.
SQL injection vulnerability in the Class and Exam Timetable Management System v1.0 login page allows remote, unauthenticated attackers to inject arbitrary SQL via the username and password fields in /index.php. Exploit code is publicly available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates a low exploitation probability.
SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.
SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.
SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.
Unauthenticated SQL injection in Simple Shopping Cart 1.0 via the admin_username parameter on /adminlogin.php allows remote attackers to extract sensitive data or bypass authentication. A proof-of-concept exploit is publicly available, though no active exploitation has been reported in CISA KEV. The vulnerability affects code-projects/fabian's PHP-based shopping cart software.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate the item_name parameter in /Admin/additems.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed, and a low EPSS score (0.04%) indicates minimal immediate risk.
SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate database queries via the user_id parameter in /Customers/settings.php. While the CVSS 4.0 base score is only 2.1 (Low), public exploit code is available, enabling authenticated attackers to read or modify database contents. The EPSS score of 0.04% and absence from CISA KEV suggest low real-world exploitation probability, but organizations using this product should assess internal risk based on stored data sensitivity.
Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.
SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
We need to analyze the CVE and synthesize all data into a comprehensive JSON response. The instructions are very detailed. First, extract key facts: - CVE ID: CVE-2025-14216 - Description: Vulnerability in code-projects Currency Exchange System 1.0. Unknown processing of file /viewserial.php, argument ID causes SQL injection. Remote attack possible. Exploit publicly disclosed. - CVSS Score: 5.5 (low? medium? CVSS 4.0 base 5.5, but no 3.1 provided; only 4.0 vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (vendor: VulDB also has CVSS 3.0 5.3? Not provided, only 4.0). For our own assessed CVSS 3.1 and 4.0 vectors, we'll derive from description. Vulnerability is SQL injection, remote, unauthenticated? The CVSS vector says PR:N, UI:N, so unauthenticated, no user interaction. Attack complexity low. Impact: Low on Confidentiality, Integrity, Availability. So it's an SQLi with limited impact. But description says "ID causes sql injection". We'll produce our own vector consistent with that. For 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L? That would be 7.3. But wait, CVSS 4.0 base score 5.5 given, but they set VC:L/VI:L/VA:L (low impact for all). In CVSS 3.1, Low for all is 5.3? Let's check: CVSS 3.1 base score with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3 (High) actually. Wait, no: CVSS 3.1, network vector, low complexity, no privileges, no interaction, unchanged scope, low confidentiality, low integrity, low availability -> 7.3 (High). But they gave CVSS 4.0 5.5 which is lower than 7.0. That's because CVSS 4.0 reweights impacts. So we need to decide our own assessment. Given the product is a simple currency exchange system, impact might be low: maybe reading some data, altering some data, causing some downtime. We'll adopt that impact, so CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Rationale: SQL injection, remote unauthenticated, low complexity, low impact across all. CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That matches the given vector but we set E:P (exploit maturity public) in our vector? In base vector we don't include temporal metrics; base only. So our assessed CVSS 4.0 base vector would be CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's exactly the same as provided base (they had E:P in temporal, but base is fine). We'll output that. Rationale: "Unvalidated user input in SQL query, low impact due to limited data exposure." CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')), which includes SQL injection. Product name: "Currency Exchange System" (from code-projects). So product_name: "Currency Exchange System". But the description says "code-projects Currency Exchange System 1.0". So primary: "Currency Exchange System". Could also be "code-projects Currency Exchange System" but the instructions say 1-3 words, so "Currency Exchange System" is enough. We'll use "Currency Exchange System". Summary: Original synthesis, not copying description. Mention it's a SQL injection in /viewserial.php parameter ID, remote unauthenticated, exploit disclosed. Not in KEV, EPSS low. So: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to extract or modify database contents via the ID parameter in /viewserial.php." Something like that. Technical context: Mention the web application, PHP, MySQL? CPE indicates 'fabian' vendor, product currency_exchange_system:1.0. The vulnerability is SQL injection (CWE-74) due to improper input sanitization in the PHP script. Use CPE data. Risk assessment: CVSS 4.0 score 5.5 (medium). EPSS 0.04% (lowest percentile). No KEV. POC public. So threat is low despite medium CVSS. The product appears to be a small code-projects project, likely not widely deployed. So risk is low. Mention that CVSS vector indicates network attack, low complexity, no privileges, low impact, making it easy to exploit but limited damage. EPSS low indicates low likelihood of widespread exploitation. Not in KEV, so not actively targeted in the wild. So it's not a high priority for most organizations. SSVC: Exploitation (POC public) but not automatable? SQL injection can be automated. Technical impact partially controlled (low). But given real-world usage, low risk. So overall: "While CVSS score suggests a medium-severity vulnerability with easy remote exploitation, EPSS probability is very low (0.04%) indicating negligible likelihood of widespread exploitation. The software is a simple academic-style project with limited deployment, further reducing real-world risk. Not in CISA KEV, so no targeted exploitation observed." Affected products: "Currency Exchange System 1.0 by code-projects (vendor: fabian). CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*" Reference advisory: EUVD, VulDB, but no official vendor advisory from code-projects. We'll list references provided. "Affected product: code-projects Currency Exchange System version 1.0 (CPE: cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*). See VulDB advisory (https://vuldb.com/?id.334658) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." Remediation: No patch available from the original source (code-projects). The references don't indicate a fix. We'll state: "No vendor patch has been released as the software appears to be unmaintained; consider disabling the application or restricting network access. As a workaround, sanitize the ID parameter in /viewserial.php by using parameterized queries or input validation. Alternatively, block access to /viewserial.php via web server rules. Trade-off: blocking may disrupt legitimate functionality if required." Then mention advisory URLs. Exploit scenario: Attacker sends a crafted request to /viewserial.php with a malicious ID parameter containing SQL injection payload, extracting data or modifying the database. POC exists. Attack vector is network, low complexity. Exploitation conditions: "No special conditions — remote unauthenticated exploitation against default installation of Currency Exchange System 1.0. The vulnerable parameter ID is exposed in /viewserial.php with no input validation. The attack does not require authentication or user interaction." Limiting factors: none, just the product's low deployment. Attack chain: "Send HTTP GET request to /viewserial.php with crafted ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Extract or modify sensitive data." Confidence notes: "Vulnerability confirmed by VulDB and included in NVD with public exploit. No vendor advisory or patch version exists. Affected version is confirmed as 1.0 by CPE; no other versions known." Prevalence: "rare" - because it's a simple academic project, not widely deployed. Prevalence_basis: "small code-projects demo, unlikely deployed in enterprise." Now, build JSON. All fields must be strings. I'll construct each paragraph as plain text without bullet points. product_name: "Currency Exchange System" summary: "SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate the database via the ID parameter in /viewserial.php. Exploit code is publicly available but active exploitation has not been observed, and EPSS probability is very low. This low-impact flaw can lead to data exposure or modification." technical_context: "The application is a PHP-based web system using a MySQL database, where the script /viewserial.php fails to properly sanitize the ID parameter before constructing SQL queries, leading to CWE-74 (Injection). The CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:* identifies the product as a lightweight web application from code-projects, likely intended for educational or demonstration purposes." risk_assessment: "The CVSS 4.0 base score of 5.5 (Medium) reflects a network-exploitable, unauthenticated SQL injection with low impact on confidentiality, integrity, and availability. However, EPSS score of 0.04% (11th percentile) indicates a very low probability of widespread exploitation. The product is not listed in CISA KEV, confirming no observed active targeting. Given the software’s limited real-world deployment, the actual risk is low for most organizations. There is no scope change or privilege escalation indicated, but the vulnerability is trivially exploitable via a single HTTP request." affected_products: "The only affected product is code-projects Currency Exchange System version 1.0, represented by CPE cpe:2.3:a:fabian:currency_exchange_system:1.0:*:*:*:*:*:*:*. No later versions or patches are documented. Advisory information is available at VulDB (https://vuldb.com/?id.334658) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-14216)." remediation: "No official patch exists, as the code-projects software appears unmaintained. In the absence of a vendor fix, restrict network access to the application or disable it entirely. If the application must stay active, implement input validation on the ID parameter in /viewserial.php to block SQL metacharacters, or better, rewrite the database access using parameterized queries. An additional compensating control is to block access to /viewserial.php via web server rules. However, these workarounds may disrupt legitimate functionality if the endpoint is required." exploit_scenario: "An attacker remotely accesses /viewserial.php and supplies a crafted ID parameter containing an SQL injection payload. The unsanitized input is embedded directly into a database query, allowing the attacker to execute arbitrary SQL commands—extracting user credentials, modifying exchange rates, or deleting records. A working proof-of-concept exploit is publicly available." exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default installations of Currency Exchange System 1.0. The vulnerable endpoint /viewserial.php is publicly accessible, and the ID parameter is processed without authentication or input sanitization, requiring no user interaction." attack_chain: "Craft HTTP GET request with malicious ID parameter → Inject SQL code via unsanitized input → Execute arbitrary SQL queries on backend database → Exfiltrate or manipulate sensitive data." confidence_notes: "Confirmed by VulDB and NVD; public exploit available via GitHub and VulDB. No vendor patch or official advisory from the original developer (code-projects) exists. The affected version is exactly 1.0 as per CPE. EPSS score is low, and no active exploitation has been reported." prevalence: "rare" prevalence_basis: "small demo project from code-projects, minimal enterprise footprint." assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" assessed_cvss_rationale: "SQL injection via web parameter, no auth required; impact limited to database read/write." assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now I'll double-check each field complies with rules. Confidence notes: we stated "public exploit available" but not "confirmed actively exploited", as no KEV. Good. Exploit scenario
SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.
We need to create a comprehensive JSON analysis for CVE-2025-14205, synthesizing all provided data. The input includes: description, CVSS score 1.9 with vector, CWE-79 (XSS), EPSS 0.03% (low), CPE for fabian chamber_of_commerce_membership_management_system:1.0, tags XSS, PHP, etc. No KEV mentioned, no explicit patch data. POC is made public per description ("exploit has been made public"). Vulnerability: stored/reflected XSS? Description says "manipulation of the argument Full Name/Address/City/State results in cross site scripting". The component is "Your Info Handler" in /membership_profile.php. So likely stored XSS in profile fields. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. So PR:H (high privileges required), UI:P (passive user interaction?), VC:N (no confidentiality impact from vulnerable system), VI:L (low integrity impact to vulnerable system), VA:N. No scope change. Exploit maturity: P (Proof-of-concept). That indicates an exploit exists, consistent with "exploit has been made public." So we'll note that publicly available exploit code exists. No KEV, so not actively exploited. We need to produce fields. Product name: "Chamber of Commerce Membership Management System" is long, but rule: "1-3 words ONLY. The specific product or service name affected." So we could pick "Chamber of Commerce Membership Management System" but that's 6 words. Alternative: "Membership Management System"? Not precise. Possibly "code-projects Chamber CMS" or "Chamber CMS". But rule says: "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So the product is the software name, not the vendor. The vendor is "fabian" per CPE, product name in CPE: "chamber_of_commerce_membership_management_system". So I'd use "Chamber of Commerce Membership Management System". That is 6 words, but the rule says "1-3 words ONLY" – it might be acceptable as a proper name? The rule is strict: 1-3 words. That's challenging. Maybe "Comme
A vulnerability was detected in code-projects Blog Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A security vulnerability has been detected in code-projects Blog Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A weakness has been identified in code-projects Online Bidding System 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Simple Food Ordering System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Nero Social Networking Site 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Student Information System 2.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Student Information System 2.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Student Information System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Student Information System 2.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Simple Cafe Ordering System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Email Logging Interface 2.0. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in code-projects Online Job Search Engine 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in code-projects Responsive Hotel Site 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Responsive Hotel Site 1.0.php. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in code-projects Simple Online Hotel Reservation System 2.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unrestricted file upload in Simple Food Ordering System 1.0 (PHP) allows remote attackers to upload arbitrary files through the photo parameter of /addproduct.php, potentially enabling web shell deployment and full server compromise. The affected product is tracked under CPE cpe:2.3:a:fabian:simple_food_ordering_system:1.0, and exploit code is publicly available via GitHub. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.06% (17th percentile), though the presence of a public proof-of-concept combined with an authentication bypass tag elevates realistic risk above what the low EPSS would suggest.
Stored cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name or supp_address parameters in /pages/supplier_update.php. Exploitation requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists; real-world exploitation risk is low (EPSS 0.04%, CVSS 2.1) due to limited scope and required user interaction, but the vulnerability is disclosed and weaponizable.
Reflected cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the prod_name, prod_desc, or prod_cost parameters in /pages/product_add.php. The vulnerability requires user interaction (UI:P per CVSS 4.0) but can be exploited remotely without authentication. Publicly available exploit code exists, though EPSS scoring (0.04%, percentile 11%) indicates low real-world exploitation probability despite public POC availability.
Reflected cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name and supp_address parameters in /pages/supplier_add.php. The vulnerability requires user interaction (clicking a crafted link) but enables session hijacking, credential theft, and malware distribution. Publicly available exploit code exists; however, the EPSS score of 0.04% (11th percentile) indicates exploitation remains uncommon despite disclosure, likely due to limited deployment of this niche e-commerce platform.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
Cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via unsanitized input parameters (pname, category, price) in the /editproduct.php endpoint. The vulnerability requires user interaction (UI:P) but carries low integrity impact and has publicly available exploit code; EPSS probability remains minimal (0.03%) despite public POC availability, suggesting limited real-world adoption or exploitation barriers.
Unrestricted file upload in code-projects Simple Food Ordering System 1.0 allows remote attackers to upload arbitrary files through the photo parameter of /editproduct.php, exploiting improper access control (CWE-284) that effectively bypasses authentication on the upload endpoint. The Authentication Bypass tag alongside CWE-284 signals that the product-editing endpoint - which should be access-controlled - can be reached without valid credentials, enabling file placement on the server. A public proof-of-concept is disclosed on GitHub; EPSS sits at 0.06% (17th percentile), indicating minimal observed exploitation at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts via the cname parameter in /addcategory.php, which are executed in the browsers of users viewing affected content. The vulnerability requires user interaction (UI:P) to exploit but has a public proof-of-concept available. Despite the low CVSS score (2.1) and minimal EPSS percentile (10%), the combination of remote network access and public exploit code necessitates prompt patching to prevent account compromise and session hijacking.
Stored cross-site scripting (XSS) in Simple Food Ordering System 1.0 allows remote attackers to inject malicious scripts through the pname, category, or price parameters in /addproduct.php, requiring user interaction to trigger payload execution. Public exploit code is available, and the vulnerability carries low severity (CVSS 2.1) due to the requirement for user interaction and limited scope of impact.
Reflected cross-site scripting (XSS) in Simple Food Ordering System 1.0 via the pname parameter in /editcategory.php allows remote attackers to inject malicious JavaScript that executes in users' browsers with minimal user interaction. The vulnerability requires user interaction (clicking a malicious link) but has low technical complexity and publicly available exploit code, though active exploitation remains unconfirmed and real-world impact is limited by the low EPSS score of 0.03% despite public POC availability.
Authentication bypass in code-projects Client Details System 1.0 allows authenticated remote attackers to gain unauthorized access to protected functionality via an unknown vector. The vulnerability has publicly available exploit code but is rated low-risk due to CVSS 2.1 score and 0.01% EPSS, indicating limited real-world exploitation potential despite remote attack capability.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated users with high privileges to inject malicious scripts via the /admin/manage-users.php endpoint, which are then executed in the browsers of other users who interact with the managed user data. The vulnerability requires administrative privileges and user interaction (UI:P) to exploit, resulting in limited integrity impact (VI:L). Public exploit code is available, though the extremely low CVSS score (1.9) and EPSS probability (0.04%) reflect the high privilege barrier and user interaction requirement that significantly constrain real-world risk.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated high-privilege users to inject malicious scripts into the /admin/clientview.php endpoint that execute in the context of other users' browsers. The vulnerability requires user interaction (victim must view affected content) and high administrative privileges to exploit, limiting real-world risk despite public exploit disclosure. EPSS score of 0.03% reflects the stringent authentication and interaction requirements that prevent widespread automated exploitation.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /update-clients.php endpoint, requiring user interaction to execute. The vulnerability carries a low CVSS score of 1.9 due to high privilege requirements (PR:H) and mandatory user interaction (UI:P), but publicly available exploit code exists, making it actionable for insider threats or social engineering scenarios targeting administrators.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows remote attackers with high privileges and user interaction to inject malicious scripts via the /welcome.php file, resulting in limited integrity impact. The vulnerability has been publicly disclosed with exploit code available, though real-world exploitation is constrained by the requirement for high administrative privileges and user interaction, reflected in the exceptionally low CVSS score of 1.9 and EPSS probability of 0.03%.
Reflected cross-site scripting (XSS) in Simple E-Banking System 1.0 allows remote attackers to inject malicious scripts via the Username parameter in /eBank/register.php. The vulnerability requires user interaction (clicking a malicious link) but has low impact on confidentiality and integrity. Publicly available exploit code exists, though EPSS scoring (0.03%, 10th percentile) suggests limited real-world exploitation despite XSS being a common attack vector.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the ID parameter in clientdetails/welcome.php, enabling database queries with limited scope impact. CVSS 2.1 reflects low severity due to authentication requirement (PR:L) and limited confidentiality/integrity exposure (VC:L/VI:L), though publicly available exploit code exists and EPSS scoring (0.03%, 8th percentile) indicates minimal real-world exploitation likelihood despite public POC availability.
SQL injection in code-projects Automated Voting System 1.0 allows authenticated remote attackers to manipulate the Username parameter in /admin/user.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid login credentials (PR:L) and has publicly available exploit code, though real-world exploitation risk is minimal given the CVSS 2.1 score and 0.03% EPSS percentile.
SQL injection in Automated Voting System 1.0 allows high-privileged remote attackers to manipulate the Password parameter in /admin/update_user.php, potentially causing limited confidentiality and integrity impacts. The vulnerability requires admin-level privileges (PR:H) to exploit and has publicly available exploit code, but carries very low real-world risk due to EPSS of 0.01% and the high privilege requirement that limits practical attack surface.
SQL injection in Automated Voting System 1.0 allows authenticated remote attackers to manipulate the firstname parameter in /admin/add_candidate_modal.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a very low CVSS score (2.1) due to requirement for authenticated access and limited scope, but publicly available exploit code exists. Active exploitation is not confirmed in CISA KEV, and the EPSS score of 0.01% indicates minimal real-world exploitation probability despite public POC availability.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
Hard-coded cryptographic key in express-session component of code-projects Hospital Management System 1.0 allows remote attackers to bypass session security and disclose sensitive information. The vulnerability stems from use of a fixed secret parameter in the session middleware, enabling attackers to forge or predict session tokens. While a public exploit exists, the attack requires high complexity and difficult exploitation, reflected in the low CVSS 2.9 score and minimal EPSS probability (0.19%), suggesting limited real-world risk despite information disclosure impact.
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in Project Monitoring System 1.0 allows remote attackers to manipulate the uid parameter on the /useredit.php endpoint, potentially exposing or modifying database contents. The exploit code is publicly available, but real-world risk is very low (EPSS 0.03%) and no active exploitation has been confirmed.
SQL injection in code-projects Online Job Search Engine 1.0 via the txtspecialization parameter in searchjob.php allows unauthenticated remote attackers to execute arbitrary SQL commands, leading to unauthorized data access or modification. A publicly disclosed exploit exists, but the affected product is a niche educational project with low real-world deployment, and no active exploitation has been reported.
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate the txtjob
SQL injection in Online Job Search Engine 1.0 allows remote attackers to manipulate database queries via the txtusername parameter in /registration.php. The vulnerability enables extraction, modification, or deletion of database contents and could bypass authentication. Exploit code is publicly available, though active exploitation has not been confirmed.
Stored Cross-Site Scripting in code-projects Simple Online Hotel Reservation System 1.0 allows a low-privileged attacker to inject persistent malicious JavaScript into the Add Room Description field, which executes in the administrator's browser session when room information is viewed, resulting in session cookie theft. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires authenticated access to add rooms and administrator interaction to trigger, but scope change to C:L reflects the realistic impact of session hijacking. A publicly available proof-of-concept exploit exists on GitHub, though no public exploitation has been confirmed and EPSS sits at a low 0.24th-percentile probability.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.
Stored Cross-Site Scripting in code-projects Simple Scheduling System 1.0 allows an attacker to inject arbitrary JavaScript via the Subject Description field, which executes in victims' browsers when they view the affected page. The scope change in the CVSS vector (S:C) confirms the script runs in a different security context than where the payload is injected, enabling session hijacking, credential theft, or malicious redirects against users of the application. A publicly available proof-of-concept exploit exists, though exploitation probability remains low (EPSS 0.22%) and no confirmed active exploitation is recorded.
Stored cross-site scripting in code-projects Client Details System 1.0 allows an attacker who can submit customer records to persist malicious JavaScript in the username field, which then executes in the browser of any user who subsequently views that record. The CVSS scope change (S:C) indicates the payload crosses from the application's trust boundary into a victim's browser session, enabling session hijacking or credential theft against administrative users. A publicly available proof-of-concept exists, though no CISA KEV listing has been issued and the EPSS score of 0.22% (12th percentile) reflects low observed exploitation activity.
SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).