Nero Social Networking Site
Monthly
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Nero Social Networking Site 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in code-projects Nero Social Networking Site 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in Nero Social Networking Site 1.0 exposes the /friendprofile.php endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter. The CVSS 4.0 score of 5.5 reflects low-level confidentiality, integrity, and availability impact with no scope change to downstream systems. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.03% (8th percentile) indicates negligible observed exploitation activity, consistent with the product's extremely narrow deployment footprint as a PHP demo application.
SQL injection in Nero Social Networking Site 1.0 exposes the `/deletemessage.php` endpoint to unauthenticated remote attackers who can manipulate the `message_id` parameter to execute arbitrary SQL commands against the backend database. The affected product is a PHP-based hobbyist/academic application (CPE: cpe:2.3:a:fabian:nero_social_networking_site:1.0). A public proof-of-concept exploit has been released on GitHub, though EPSS remains at 0.03% (8th percentile), indicating negligible observed exploitation activity consistent with the product's near-zero production deployment footprint.
SQL injection in the /addfriend.php endpoint of Nero Social Networking Site 1.0 allows unauthenticated remote attackers to manipulate the ID parameter and execute arbitrary SQL against the underlying database. A public proof-of-concept exploit is available on GitHub, though EPSS at 0.03% (8th percentile) indicates negligible observed in-the-wild activity. The product is a PHP-based academic demo application from code-projects.org, substantially limiting real-world exposure despite the straightforward attack vector.
SQL injection in Nero Social Networking Site 1.0 exposes the `/acceptoffres.php` endpoint to unauthenticated remote database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 score of 5.5 reflects partial confidentiality, integrity, and availability impact against the vulnerable system only, with no scope change to subsequent systems. A public proof-of-concept exploit is available on GitHub; however, EPSS at 0.03% (8th percentile) and absence from CISA KEV indicate exploitation has not been observed at meaningful scale, likely due to the product's extremely limited deployment footprint.
A vulnerability was found in code-projects Nero Social Networking Site 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.