Online Pet Shop Management System
Monthly
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
We need to produce a comprehensive JSON analysis for CVE-2025-14637. Let's go through each field carefully using the provided data. Product name: The affected product is "Online Pet Shop Management System" from itsourcecode. The CPE indicates the product is "online_pet_shop_management_system" version 1.0. The name should be short: "Online Pet Shop Management System" is a bit long; it's okay to use "Online Pet Shop Management System" but the instruction says "1-3 words ONLY". So we need a concise name: maybe "Pet Shop Management System"? Or "Online Pet Shop"? The CPE product field is "online_pet_shop_management_system". Let's use "Pet Shop Management System". That is 4 words? "Pet Shop Management System" is 4 words. The instruction says 1-3 words. Maybe "Online Pet Shop"? That's 3 words but lacks "Management". However, the vulnerability is in the admin panel and it's a management system. Since the description says "Online Pet Shop Management System", I'll use "Pet Shop Management System" but that's 4. Alternatively, "PetShop Management" is 2 words. But let's keep it as "Online Pet Shop" as 3 words. The CPE is "online_pet_shop_management_system" - perhaps "Online Pet Shop" is sufficient. But the instruction says "1-3 words ONLY" and "Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'." So it's fine to use a shorter name like "Pet Shop Management"? Actually "Management" is one word. "Pet Shop Management" is 3 words. That's acceptable. I'll use "Pet Shop Management System" (4) - that's too many. Let's see: "Online Pet Shop" is 3 words and captures the product. However, the vulnerability is specifically in the management system. The CPE has "online_pet_shop_management_system". I think "Pet Shop Management" is fine as 3 words. I'll go with "Pet Shop Management". Summary: Need 2-3 sentence plain-language summary. Must not start with "A vulnerability". Start with impact verb and product. Example: "SQL injection in Online Pet Shop Managem
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.