Facebook Riares
Monthly
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.