PHP
Monthly
The Essential Addons for Elementor - Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.
SQL injection in CodeAstro Patient Record Management System 1.0 allows unauthenticated remote attackers to manipulate the login process via the 'uname' parameter in /login.php. Public exploit code is available, but no active exploitation has been reported, and EPSS score indicates low probability of exploitation (0.06%).
Cross-site scripting in Best Salon Management System 1.0 allows authenticated administrators to inject JavaScript via the Admin Name field on the admin profile page, with a publicly available proof-of-concept exploit. While the attack requires high privileges, a crafted payload could execute in another admin's browser when viewing the profile, leading to session token theft or interface manipulation.
Stored cross-site scripting in Best Salon Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the 'Tax Name' parameter on the Update Tax page. The injected script executes when another user views the affected page, potentially enabling session hijacking or phishing attacks. Exploit code is publicly available, but no active exploitation has been confirmed; EPSS indicates a very low likelihood of widespread exploitation.
Cross-site scripting (XSS) in Best Salon Management System 1.0 allows a high-privileged attacker to inject malicious scripts via the search-appointment.php endpoint. An unauthenticated victim user passively interacting with the injected content may suffer low integrity impact in their browser session. The vulnerability has a publicly available proof-of-concept but is not known to be actively exploited.
Cross-site scripting in Best Salon Management System 1.0's Update Staff Page allows authenticated admin-level attackers to inject malicious scripts via the /panel/edit_plan.php endpoint. A publicly available exploit exists, but the EPSS score is negligible (0.04%) and no active exploitation has been reported. The vulnerability requires high privileges and user interaction, limiting its real-world severity.
Cross-site scripting in Best Salon Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Staff Name field on the edit-staff page. A remote attacker with admin access can store a payload that executes in the browser of another admin who views the staff listing, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Stored cross-site scripting in Best Salon Management System 1.0 enables authenticated high-privilege attackers to inject arbitrary JavaScript via the 'Name' parameter on the edit-customer-detailed.php page. The flaw has public exploit code but no active exploitation per CISA KEV, and EPSS indicates a very low exploitation probability (0.04%).
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to inject malicious SQL via the adminname parameter in /panel/admin-profile.php, potentially leading to data leakage or tampering. Despite being publicly disclosed with proof-of-concept code, the actual impact is limited according to CVSS 4.0 (score 2.1), and EPSS predicts a low exploitation probability (0.06%).
Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the staff_id parameter in the /panel/s
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to inject malicious SQL via the ID parameter in /admin/view_vacancy.php, potentially leading to low‑impact data leakage or modification. Public exploit code exists, but
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate or extract database contents via the ID parameter in /admin/ajax.php?action=save_vacancy. Public exploit code is available, but the CVSS 4.0 score of 5.5 indicates only low impact to confidentiality, integrity, and availability. No active exploitation has been reported in CISA KEV, and EPSS probability is low (0.06%).
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database records via the ID parameter in /admin/ajax.php?action=delete_application. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV; EPSS indicates a low 0.06% probability of widespread attacks.
employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend database queries by supplying crafted input to the `ID` parameter of `/ajax.php?action=calculate_payroll`. The vulnerability stems from unsanitized user-controlled input being embedded directly into SQL statements, enabling data extraction or modification. A public proof-of-concept exploit has been disclosed via GitHub, though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).
SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated administrators to manipulate cid/uid parameters via /admin/complaint-details.php, enabling arbitrary SQL query execution that can read or modify database records. A public proof-of-concept exploit is available, but the vulnerability requires high privileges and has low exploitation probability (EPSS 0.06%), with no evidence of active attacks.
SQL injection in Complaint Management System 1.0 login form (/admin/index.php) allows remote unauthenticated attackers to execute arbitrary SQL commands. The flaw, located in the Username parameter, enables database manipulation, including data exfiltration or tampering. Public exploit code is available, though EPSS indicates low likelihood of widespread exploitation.
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated remote attackers to manipulate the cid parameter in /users/complaint-details.php, potentially reading or modifying database data. A public proof-of-concept exploit is available, but the vulnerability requires low-privilege user authentication and the impact is limited, as reflected by the low CVSS 4.0 score of 2.1 and EPSS exploitation probability of 0.06%. No active exploitation has been reported via CISA KEV.
SQL injection in Campcodes Complaint Management System 1.0's email parameter in /users/check_availability.php allows remote unauthenticated attackers to manipulate database queries. Public exploit code is available, but there is no evidence of active exploitation and EPSS estimates a low exploitation
SQL injection in Campcodes Complaint Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the Username parameter of /users/index.php, potentially exposing or altering database contents. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS indicates a low (0.06%) probability of widespread use.
Cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated attackers to inject arbitrary web script via the 'Função' parameter in the Function Management module. A public exploit is available, but EPSS indicates low exploitation probability (0.03%). The vendor has not responded to disclosures.
Cross-site scripting in Portabilis i-Educar 2.9.0’s Course Module allows authenticated low-privilege users to inject malicious scripts via the ‘Curso’ parameter, potentially compromising other users’ sessions or data. A publicly available proof-of-concept exists, but exploitation requires user interaction and is not known to be actively exploited (EPSS score 0.03%).
Cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated low-privilege attackers to inject arbitrary web scripts via the 'Escola' parameter in the school module. Publicly available exploit code exists, but the vendor has not responded and no patch is available. EPSS score is low (0.03%), indicating low exploitation likelihood.
Cross-site scripting vulnerability in Portabilis i-Educar 2.9.0 allows a remote, authenticated attacker with low privileges to inject arbitrary web script via the Benefício parameter of the Student Benefits Registration page. When a victim views the maliciously crafted request, the script executes in the victim's browser, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Server-side request forgery in BoyunCMS up to version 1.4.20 allows remote authenticated attackers to issue arbitrary server-side HTTP requests through the payment component's curl processing. Public exploit code is available, though no active exploitation has been confirmed and the EPSS score remains low at 0.04%.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-7102, using all provided data. The output must be a JSON object with specific fields, all plain text strings. We must cross-reference and analyze beyond paraphrasing. I'll go through each field and construct the content. First, review the input data: - CVE ID: CVE-2025-7102 - Description: BoyunCMS up to 1.4.20 has a vulnerability in file application/update/controller/Server.php, manipulation of argument phone leads to SQL injection. Remote attack possible. Exploit disclosed publicly. - CVSS Score: 2.1? But the vector is CVSS:4.0? The vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X That's a CVSS 4.0 vector with low impact (VC:L/VI:L/VA:L), scope unchanged, PR:L (low privileges required), UI:N (no user interaction), AV:N (network). The CVSS score 2.1 is likely a typo or from CVSS 3.1? Actually the vector is 4.0 base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, which would score higher than 2.1. But we'll use the vector as provided? The vector is given, but the "CVSS Score: 2.1" might be an error. However, for our assessed vectors we'll do our own independent assessment. We'll later produce an assessed CVSS 3.1 and 4.0 vector based on analysis. - CWE: CWE-74, which is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – too broad, SQL injection is more specific. But we'll reference the CWE. - EPSS: 0.05%, percentile 14%. Low probability of exploitation. - KEV status: Not mentioned; likely NO (not in KEV). No KEV data in input. So we assume not actively exploited. - POC: "The exploit has been disclosed to the public and may be used." So publicly available exploit exists. - Tags: PHP, SQLi. - no patch info provided explicitly; patch availability is unknown. - Reported by cna@vuldb.com (VulDB). - CPE: cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:* (asterisk indicates all versions). EUVD lists many BoyunCMS versions 1.4.0 to 1.4.20, so up to that. - References: note-hxlab.wetolink.com/share/sEjaSsXWRNz1 (likely POC/exploit), vuldb.com entries. No vendor advisory. Only NVD page via EUVD. So the product is BoyunCMS, a content management system. Not widely known, likely low prevalence. The vulnerability is SQL injection via the 'phone' parameter in application/update/controller/Server.php. The description says "manipulation of the argument phone leads to sql injection". So it's an injection in a parameter presumably used in an SQL query without proper sanitization. The attack can be initiated remotely, requires low privileges (PR:L from CVSS 4.0), no user interaction. So authenticated but low-privileged user could exploit it. Risk assessment: CVSS 4.0 vector indicates low impact (low on CIA) but CVSS score provided is 2.1 (which seems inconsistent). If we compute CVSS 4.0 base score manually: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L -> Base score around 4.3 maybe? But VC:L/VI:L/VA:L is low, so it's not critical despite being declared critical. The EPSS is very low (0.05%), POC exists but no active exploitation (KEV absent). So real-world risk is relatively low. However, SQL injection can sometimes lead to greater impact if chained, but as described it's low impact. We'll craft a summary, technical context, etc. Ensure not to copy description verbatim. Start summary with specific impact verb: "SQL injection in BoyunCMS". Then explain: what, who, what attacker can do, mention POC, no active exploitation, low EPSS. Technical context: BoyunCMS is a PHP-based CMS. The vulnerability is in the update controller, file Server.php, specifically the phone argument. Based on CWE-74 (injection), likely a parameter used in SQL query without parameterization. The input is handled unsafely, leading to SQL injection. The product CPE indicates all versions up to 1.4.20 affected. No known patch. Risk assessment: Compare signals. CVSS 4.0 vector shows network attack, low complexity, low privileges, low impact on CIA. EPSS extremely low. No KEV, so not actively exploited. POC exists, so threat actors could potentially use it. But impact is limited per CVSS (only low impacts). So real risk is moderate for systems where an authenticated low-privileged user could be malicious. But overall, it's a low severity vulnerability despite being declared critical by source. Affected products: BoyunCMS versions 1.4.0 through 1.4.20 (assuming all 1.4.x). EUVD lists many specific versions, but effectively all 1.4.x. Mention CPE. No vendor advisory links, just the NVD/EUVD page. So no official advisory. References include exploit notes. Remediation: No patch available. Workarounds: restrict access to the update endpoint, disable update controller if possible, or sanitize input via a WAF/mod_security rule. Recommend upgrading when fix available. But the source doesn't provide fix. So we say no vendor-released patch identified. Suggest monitoring VulDB for updates. Exploit scenario: An authenticated attacker with low privileges sends a crafted request to the update functionality, manipulating the phone parameter to inject SQL commands, potentially extracting or modifying data. Exploitation conditions: The attacker must have low-privileged access (as per PR:L). The vulnerable endpoint is the update controller's server.php, specifically the phone argument. The attack is remote over network. So likely requires that the update feature is enabled and accessible. Since it's BoyunCMS, likely admin area? Update functionality may be restricted. So it's not default anonymous access, needs authentication. So condition: authenticated user with low privileges can access the update functionality in BoyunCMS. Attack chain: Access update controller with low-privilege credentials → Craft SQL injection payload in 'phone' parameter → Send request to update endpoint → Malicious SQL queries executed → Low-impact data disclosure/manipulation. Confidence notes: Confirm that exploit is publically disclosed (via note-hxlab link). No vendor fix confirmed. Vulnerable version range from EUVD (up to 1.4.20). EPSS score low. CVSS vector from VulDB. No KEV listing. No vendor advisory found, so patch status unconfirmed. Prevalence: BoyunCMS is an obscure CMS, likely Chinese? Very niche. So prevalence = rare or low. I'll put "rare". Basis: "niche Chinese CMS, minimal enterprise footprint". Assessed CVSS vector: Our independent assessment. The provided CVSS 4.0 gives AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L. For CVSS 3.1 mapping, we need to assess AV:N (because remote), AC:L (no special conditions beyond authentication), PR:L (low privileges), UI:N, scope unchanged? The injection likely affects same component, no scope change. For impact: VC:L (low confidentiality), VI:L (low integrity), VA:L (low availability). So we'd produce CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we must consider if confidentiality, integrity, availability are all low? The description doesn't specify, but the 4.0 vector gave those. So we'll use same. Rationale: "Low-privileged user can inject SQL via phone parameter; no user interaction, network vector." But we could argue AC might be low because SQL injection might be trivial. So that's fine. CVSS 4.0 vector: The same as given, but we'll output based on our assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. No temporal/environmental modifiers. That's consistent. Now construct the JSON. Fields: product_name: "BoyunCMS" summary: "SQL injection in BoyunCMS up to version 1.4.20 allows authenticated low-privileged attackers to manipulate the 'phone' argument in the update controller, leading to potential unauthorized data access or modification. Exploit code is publicly available, but no evidence of active exploitation in the wild. EPSS probability is very low (0.05%), and impact is limited per CVSS scoring, though the vulnerability is labeled critical by the reporter." (ensure starts with impact verb: "SQL injection in BoyunCMS...") technical_context: "BoyunCMS is a PHP-based content management system. The vulnerability resides in the update module at application/update/controller/Server.php, where user-supplied input for the 'phone' parameter is directly incorporated into an SQL query without proper sanitization, as indicated by CWE-74 (Injection). The affected product (cpe:2.3:a:boyuncms_project:boyuncms) includes all versions up to 1.4.20, as confirmed by EUVD enumeration. This typical SQL injection flaw can be exploited by injecting malicious SQL statements through the input field, enabling database query manipulation." risk_assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-accessible flaw requiring low privileges and no user interaction, with only low impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low likelihood of exploitation. Despite being tagged critical by the reporter, the actual CVSS base score computed from the 4.0 vector is moderate, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV). Public exploit code exists, but there is no evidence of active exploitation. This combination of signals suggests that while the flaw is real and exploitable, it poses limited immediate risk, especially given its low impact and the need for authenticated access. Defenders should prioritize based on exposure of the CMS's update functionality to low-privileged users." affected_products: "BoyunCMS versions 1.4.0 to 1.4.20 are affected, as detailed by EUVD (e.g., 1.4.0, 1.4.13, 1.4.20, etc.). The CPE designation cpe:2.3:a:boyuncms_project:boyuncms:* confirms all versions prior to a fix are vulnerable. No official vendor advisory has been published; the primary reference is the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7102 and VulDB at https://vuldb.com/?id.315016." remediation: "No vendor-released patch is currently available. As a temporary mitigation, restrict access to the update endpoint (Server.php) to trusted users only, or disable the update module if not needed. Apply strict input validation for the 'phone' parameter using a web application firewall (WAF) rule to block SQL injection patterns. Monitor the VulDB entry (https://vuldb.com/?id.315016) for a fix and upgrade promptly once a patched version is released. Note that disabling the update feature may break update functionality, so weigh operational needs." exploit_scenario: "A low-privileged authenticated attacker crafts a request to the BoyunCMS update endpoint containing a SQL injection payload in the 'phone' parameter. Successful exploitation could allow extraction of database contents or modification of data within the CMS database, depending on the injected query." exploitation_conditions: "Exploitation requires network access to the BoyunCMS instance and authentication with low privileges (as indicated by CVSS PR:L). The vulnerable endpoint is application/update/controller/Server.php, which must be exposed and accessible. No special configuration beyond the default CMS deployment is needed, but the attacker must have valid credentials with sufficient permission to use the update feature. The attack does not require user interaction."
A security vulnerability in BoyunCMS (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.
BoyunCMS up to version 1.21 on PHP7 is vulnerable to deserialization via the db_host parameter in the installation
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
A security vulnerability in newer MediaWiki (CVSS 7.5). High severity vulnerability requiring prompt remediation.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unauthenticated local file inclusion in Kossy WordPress Theme up to version 1.45 allows attackers to include arbitrary local files, potentially leading to remote code execution and full site compromise. The vulnerability has a high CVSS score (8.1) but a low EPSS exploitation probability (0.13%); no active exploitation has been confirmed in the wild. A patch has not been publicly identified.
Local file inclusion in the Leyka WordPress plugin through version 3.31.9 allows unauthenticated attackers with no privileges to include and execute arbitrary PHP files on the server, potentially leading to full site compromise. Exploitation requires user interaction (tricking an administrator to click a malicious link) and achieves high impact on confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis.
A security vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in NasaTheme Elessi WordPress theme allows authenticated low-privilege users to include arbitrary PHP files, exposing sensitive configuration data and potentially enabling code execution. Elessi versions before 6.4.1 are affected; vendor patch available. No active exploitation reported, and EPSS score low at 0.13%.
Local file inclusion in the PrivateContent - Mail Actions WordPress plugin allows unauthenticated attackers to include arbitrary local files, leading to potential remote code execution or sensitive data disclosure. Affects versions up to 2.3.2, with exploitation requiring user interaction and high attack complexity. No active exploitation or public exploit code has been reported as of this analysis.
Improper input validation in Monitorr up to 1.7.6m via the installer component allows authenticated administrators to achieve limited information disclosure or file manipulation. The vulnerability has a publicly available exploit but no reports of active exploitation, and the EPSS probability is low (0.09%).
The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
A security vulnerability in Booking X (CVSS 7.5). High severity vulnerability requiring prompt remediation.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
The RD Contacto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the rdWappUpdateData() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
CVE-2025-49618 is a security vulnerability (CVSS 5.8). Remediation should follow standard vulnerability management procedures.
The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the footer_text and announcement parameters in config.php.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the replace parameter in /config.php/tags.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The Essential Addons for Elementor - Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Calendar` And `Business Reviews` Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unrestricted file upload in Advanced Online Voting System 1.0's /admin/candidates_add.php endpoint allows remote authenticated attackers (low privileges) to upload arbitrary files via the photo parameter. Public exploit code is available, but EPSS indicates low exploitation probability (0.10%) and no active exploitation is confirmed. The vulnerability could lead to code execution if a malicious PHP file is uploaded.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially enabling remote code execution. A public proof-of-concept exploit is available, and the vulnerability is rated critical although the CVSS 4.0 base score suggests low impact. No active exploitation has been confirmed.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.
SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.
SQL injection in CodeAstro Patient Record Management System 1.0 allows unauthenticated remote attackers to manipulate the login process via the 'uname' parameter in /login.php. Public exploit code is available, but no active exploitation has been reported, and EPSS score indicates low probability of exploitation (0.06%).
Cross-site scripting in Best Salon Management System 1.0 allows authenticated administrators to inject JavaScript via the Admin Name field on the admin profile page, with a publicly available proof-of-concept exploit. While the attack requires high privileges, a crafted payload could execute in another admin's browser when viewing the profile, leading to session token theft or interface manipulation.
Stored cross-site scripting in Best Salon Management System 1.0 allows an authenticated attacker with high privileges to inject malicious scripts via the 'Tax Name' parameter on the Update Tax page. The injected script executes when another user views the affected page, potentially enabling session hijacking or phishing attacks. Exploit code is publicly available, but no active exploitation has been confirmed; EPSS indicates a very low likelihood of widespread exploitation.
Cross-site scripting (XSS) in Best Salon Management System 1.0 allows a high-privileged attacker to inject malicious scripts via the search-appointment.php endpoint. An unauthenticated victim user passively interacting with the injected content may suffer low integrity impact in their browser session. The vulnerability has a publicly available proof-of-concept but is not known to be actively exploited.
Cross-site scripting in Best Salon Management System 1.0's Update Staff Page allows authenticated admin-level attackers to inject malicious scripts via the /panel/edit_plan.php endpoint. A publicly available exploit exists, but the EPSS score is negligible (0.04%) and no active exploitation has been reported. The vulnerability requires high privileges and user interaction, limiting its real-world severity.
Cross-site scripting in Best Salon Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Staff Name field on the edit-staff page. A remote attacker with admin access can store a payload that executes in the browser of another admin who views the staff listing, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Stored cross-site scripting in Best Salon Management System 1.0 enables authenticated high-privilege attackers to inject arbitrary JavaScript via the 'Name' parameter on the edit-customer-detailed.php page. The flaw has public exploit code but no active exploitation per CISA KEV, and EPSS indicates a very low exploitation probability (0.04%).
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to inject malicious SQL via the adminname parameter in /panel/admin-profile.php, potentially leading to data leakage or tampering. Despite being publicly disclosed with proof-of-concept code, the actual impact is limited according to CVSS 4.0 (score 2.1), and EPSS predicts a low exploitation probability (0.06%).
Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to the agent could write to VS Code settings files and trigger code execution. There were multiple ways to achieve that. One example is with the php.validate.executablePath setting which lets you set the path for the php executable for syntax validation. The attacker could have written the path to an arbitrary command there and then created a php file to trigger it. This vulnerability is fixed in 3.22.6.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the staff_id parameter in the /panel/s
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to inject malicious SQL via the ID parameter in /admin/view_vacancy.php, potentially leading to low‑impact data leakage or modification. Public exploit code exists, but
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate or extract database contents via the ID parameter in /admin/ajax.php?action=save_vacancy. Public exploit code is available, but the CVSS 4.0 score of 5.5 indicates only low impact to confidentiality, integrity, and availability. No active exploitation has been reported in CISA KEV, and EPSS probability is low (0.06%).
SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database records via the ID parameter in /admin/ajax.php?action=delete_application. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV; EPSS indicates a low 0.06% probability of widespread attacks.
employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.
SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.
Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend database queries by supplying crafted input to the `ID` parameter of `/ajax.php?action=calculate_payroll`. The vulnerability stems from unsanitized user-controlled input being embedded directly into SQL statements, enabling data extraction or modification. A public proof-of-concept exploit has been disclosed via GitHub, though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.
SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).
SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.
Unrestricted file upload in Online Note Sharing 1.0 allows authenticated attackers to upload arbitrary files via the profile image handler, potentially leading to remote code execution. The vulnerability exists in the /
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated administrators to manipulate cid/uid parameters via /admin/complaint-details.php, enabling arbitrary SQL query execution that can read or modify database records. A public proof-of-concept exploit is available, but the vulnerability requires high privileges and has low exploitation probability (EPSS 0.06%), with no evidence of active attacks.
SQL injection in Complaint Management System 1.0 login form (/admin/index.php) allows remote unauthenticated attackers to execute arbitrary SQL commands. The flaw, located in the Username parameter, enables database manipulation, including data exfiltration or tampering. Public exploit code is available, though EPSS indicates low likelihood of widespread exploitation.
SQL injection in Campcodes Complaint Management System 1.0 allows authenticated remote attackers to manipulate the cid parameter in /users/complaint-details.php, potentially reading or modifying database data. A public proof-of-concept exploit is available, but the vulnerability requires low-privilege user authentication and the impact is limited, as reflected by the low CVSS 4.0 score of 2.1 and EPSS exploitation probability of 0.06%. No active exploitation has been reported via CISA KEV.
SQL injection in Campcodes Complaint Management System 1.0's email parameter in /users/check_availability.php allows remote unauthenticated attackers to manipulate database queries. Public exploit code is available, but there is no evidence of active exploitation and EPSS estimates a low exploitation
SQL injection in Campcodes Complaint Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the Username parameter of /users/index.php, potentially exposing or altering database contents. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS indicates a low (0.06%) probability of widespread use.
Cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated attackers to inject arbitrary web script via the 'Função' parameter in the Function Management module. A public exploit is available, but EPSS indicates low exploitation probability (0.03%). The vendor has not responded to disclosures.
Cross-site scripting in Portabilis i-Educar 2.9.0’s Course Module allows authenticated low-privilege users to inject malicious scripts via the ‘Curso’ parameter, potentially compromising other users’ sessions or data. A publicly available proof-of-concept exists, but exploitation requires user interaction and is not known to be actively exploited (EPSS score 0.03%).
Cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated low-privilege attackers to inject arbitrary web scripts via the 'Escola' parameter in the school module. Publicly available exploit code exists, but the vendor has not responded and no patch is available. EPSS score is low (0.03%), indicating low exploitation likelihood.
Cross-site scripting vulnerability in Portabilis i-Educar 2.9.0 allows a remote, authenticated attacker with low privileges to inject arbitrary web script via the Benefício parameter of the Student Benefits Registration page. When a victim views the maliciously crafted request, the script executes in the victim's browser, potentially leading to session hijacking or defacement. Publicly available exploit code exists, but no active exploitation has been confirmed.
Server-side request forgery in BoyunCMS up to version 1.4.20 allows remote authenticated attackers to issue arbitrary server-side HTTP requests through the payment component's curl processing. Public exploit code is available, though no active exploitation has been confirmed and the EPSS score remains low at 0.04%.
We are tasked with synthesizing a comprehensive analysis for CVE-2025-7102, using all provided data. The output must be a JSON object with specific fields, all plain text strings. We must cross-reference and analyze beyond paraphrasing. I'll go through each field and construct the content. First, review the input data: - CVE ID: CVE-2025-7102 - Description: BoyunCMS up to 1.4.20 has a vulnerability in file application/update/controller/Server.php, manipulation of argument phone leads to SQL injection. Remote attack possible. Exploit disclosed publicly. - CVSS Score: 2.1? But the vector is CVSS:4.0? The vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X That's a CVSS 4.0 vector with low impact (VC:L/VI:L/VA:L), scope unchanged, PR:L (low privileges required), UI:N (no user interaction), AV:N (network). The CVSS score 2.1 is likely a typo or from CVSS 3.1? Actually the vector is 4.0 base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, which would score higher than 2.1. But we'll use the vector as provided? The vector is given, but the "CVSS Score: 2.1" might be an error. However, for our assessed vectors we'll do our own independent assessment. We'll later produce an assessed CVSS 3.1 and 4.0 vector based on analysis. - CWE: CWE-74, which is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – too broad, SQL injection is more specific. But we'll reference the CWE. - EPSS: 0.05%, percentile 14%. Low probability of exploitation. - KEV status: Not mentioned; likely NO (not in KEV). No KEV data in input. So we assume not actively exploited. - POC: "The exploit has been disclosed to the public and may be used." So publicly available exploit exists. - Tags: PHP, SQLi. - no patch info provided explicitly; patch availability is unknown. - Reported by cna@vuldb.com (VulDB). - CPE: cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:* (asterisk indicates all versions). EUVD lists many BoyunCMS versions 1.4.0 to 1.4.20, so up to that. - References: note-hxlab.wetolink.com/share/sEjaSsXWRNz1 (likely POC/exploit), vuldb.com entries. No vendor advisory. Only NVD page via EUVD. So the product is BoyunCMS, a content management system. Not widely known, likely low prevalence. The vulnerability is SQL injection via the 'phone' parameter in application/update/controller/Server.php. The description says "manipulation of the argument phone leads to sql injection". So it's an injection in a parameter presumably used in an SQL query without proper sanitization. The attack can be initiated remotely, requires low privileges (PR:L from CVSS 4.0), no user interaction. So authenticated but low-privileged user could exploit it. Risk assessment: CVSS 4.0 vector indicates low impact (low on CIA) but CVSS score provided is 2.1 (which seems inconsistent). If we compute CVSS 4.0 base score manually: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L -> Base score around 4.3 maybe? But VC:L/VI:L/VA:L is low, so it's not critical despite being declared critical. The EPSS is very low (0.05%), POC exists but no active exploitation (KEV absent). So real-world risk is relatively low. However, SQL injection can sometimes lead to greater impact if chained, but as described it's low impact. We'll craft a summary, technical context, etc. Ensure not to copy description verbatim. Start summary with specific impact verb: "SQL injection in BoyunCMS". Then explain: what, who, what attacker can do, mention POC, no active exploitation, low EPSS. Technical context: BoyunCMS is a PHP-based CMS. The vulnerability is in the update controller, file Server.php, specifically the phone argument. Based on CWE-74 (injection), likely a parameter used in SQL query without parameterization. The input is handled unsafely, leading to SQL injection. The product CPE indicates all versions up to 1.4.20 affected. No known patch. Risk assessment: Compare signals. CVSS 4.0 vector shows network attack, low complexity, low privileges, low impact on CIA. EPSS extremely low. No KEV, so not actively exploited. POC exists, so threat actors could potentially use it. But impact is limited per CVSS (only low impacts). So real risk is moderate for systems where an authenticated low-privileged user could be malicious. But overall, it's a low severity vulnerability despite being declared critical by source. Affected products: BoyunCMS versions 1.4.0 through 1.4.20 (assuming all 1.4.x). EUVD lists many specific versions, but effectively all 1.4.x. Mention CPE. No vendor advisory links, just the NVD/EUVD page. So no official advisory. References include exploit notes. Remediation: No patch available. Workarounds: restrict access to the update endpoint, disable update controller if possible, or sanitize input via a WAF/mod_security rule. Recommend upgrading when fix available. But the source doesn't provide fix. So we say no vendor-released patch identified. Suggest monitoring VulDB for updates. Exploit scenario: An authenticated attacker with low privileges sends a crafted request to the update functionality, manipulating the phone parameter to inject SQL commands, potentially extracting or modifying data. Exploitation conditions: The attacker must have low-privileged access (as per PR:L). The vulnerable endpoint is the update controller's server.php, specifically the phone argument. The attack is remote over network. So likely requires that the update feature is enabled and accessible. Since it's BoyunCMS, likely admin area? Update functionality may be restricted. So it's not default anonymous access, needs authentication. So condition: authenticated user with low privileges can access the update functionality in BoyunCMS. Attack chain: Access update controller with low-privilege credentials → Craft SQL injection payload in 'phone' parameter → Send request to update endpoint → Malicious SQL queries executed → Low-impact data disclosure/manipulation. Confidence notes: Confirm that exploit is publically disclosed (via note-hxlab link). No vendor fix confirmed. Vulnerable version range from EUVD (up to 1.4.20). EPSS score low. CVSS vector from VulDB. No KEV listing. No vendor advisory found, so patch status unconfirmed. Prevalence: BoyunCMS is an obscure CMS, likely Chinese? Very niche. So prevalence = rare or low. I'll put "rare". Basis: "niche Chinese CMS, minimal enterprise footprint". Assessed CVSS vector: Our independent assessment. The provided CVSS 4.0 gives AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L. For CVSS 3.1 mapping, we need to assess AV:N (because remote), AC:L (no special conditions beyond authentication), PR:L (low privileges), UI:N, scope unchanged? The injection likely affects same component, no scope change. For impact: VC:L (low confidentiality), VI:L (low integrity), VA:L (low availability). So we'd produce CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we must consider if confidentiality, integrity, availability are all low? The description doesn't specify, but the 4.0 vector gave those. So we'll use same. Rationale: "Low-privileged user can inject SQL via phone parameter; no user interaction, network vector." But we could argue AC might be low because SQL injection might be trivial. So that's fine. CVSS 4.0 vector: The same as given, but we'll output based on our assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. No temporal/environmental modifiers. That's consistent. Now construct the JSON. Fields: product_name: "BoyunCMS" summary: "SQL injection in BoyunCMS up to version 1.4.20 allows authenticated low-privileged attackers to manipulate the 'phone' argument in the update controller, leading to potential unauthorized data access or modification. Exploit code is publicly available, but no evidence of active exploitation in the wild. EPSS probability is very low (0.05%), and impact is limited per CVSS scoring, though the vulnerability is labeled critical by the reporter." (ensure starts with impact verb: "SQL injection in BoyunCMS...") technical_context: "BoyunCMS is a PHP-based content management system. The vulnerability resides in the update module at application/update/controller/Server.php, where user-supplied input for the 'phone' parameter is directly incorporated into an SQL query without proper sanitization, as indicated by CWE-74 (Injection). The affected product (cpe:2.3:a:boyuncms_project:boyuncms) includes all versions up to 1.4.20, as confirmed by EUVD enumeration. This typical SQL injection flaw can be exploited by injecting malicious SQL statements through the input field, enabling database query manipulation." risk_assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-accessible flaw requiring low privileges and no user interaction, with only low impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low likelihood of exploitation. Despite being tagged critical by the reporter, the actual CVSS base score computed from the 4.0 vector is moderate, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV). Public exploit code exists, but there is no evidence of active exploitation. This combination of signals suggests that while the flaw is real and exploitable, it poses limited immediate risk, especially given its low impact and the need for authenticated access. Defenders should prioritize based on exposure of the CMS's update functionality to low-privileged users." affected_products: "BoyunCMS versions 1.4.0 to 1.4.20 are affected, as detailed by EUVD (e.g., 1.4.0, 1.4.13, 1.4.20, etc.). The CPE designation cpe:2.3:a:boyuncms_project:boyuncms:* confirms all versions prior to a fix are vulnerable. No official vendor advisory has been published; the primary reference is the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7102 and VulDB at https://vuldb.com/?id.315016." remediation: "No vendor-released patch is currently available. As a temporary mitigation, restrict access to the update endpoint (Server.php) to trusted users only, or disable the update module if not needed. Apply strict input validation for the 'phone' parameter using a web application firewall (WAF) rule to block SQL injection patterns. Monitor the VulDB entry (https://vuldb.com/?id.315016) for a fix and upgrade promptly once a patched version is released. Note that disabling the update feature may break update functionality, so weigh operational needs." exploit_scenario: "A low-privileged authenticated attacker crafts a request to the BoyunCMS update endpoint containing a SQL injection payload in the 'phone' parameter. Successful exploitation could allow extraction of database contents or modification of data within the CMS database, depending on the injected query." exploitation_conditions: "Exploitation requires network access to the BoyunCMS instance and authentication with low privileges (as indicated by CVSS PR:L). The vulnerable endpoint is application/update/controller/Server.php, which must be exposed and accessible. No special configuration beyond the default CMS deployment is needed, but the attacker must have valid credentials with sufficient permission to use the update feature. The attack does not require user interaction."
A security vulnerability in BoyunCMS (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
Unrestricted file upload in BoyunCMS up to version 1.4.20 allows remote attackers to upload arbitrary files via the image parameter in /application/user/controller/Index.php. Exploit code is publicly available, but EPSS indicates low exploitation probability (0.08%) and no active exploitation in CISA KEV.
BoyunCMS up to version 1.21 on PHP7 is vulnerable to deserialization via the db_host parameter in the installation
In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request to login.php.is sufficient. An unauthenticated attacker can then bypass authentication via administrator account takeover.
NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
A security vulnerability in newer MediaWiki (CVSS 7.5). High severity vulnerability requiring prompt remediation.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensitive actions if an admin visits a malicious site. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Unauthenticated local file inclusion in Kossy WordPress Theme up to version 1.45 allows attackers to include arbitrary local files, potentially leading to remote code execution and full site compromise. The vulnerability has a high CVSS score (8.1) but a low EPSS exploitation probability (0.13%); no active exploitation has been confirmed in the wild. A patch has not been publicly identified.
Local file inclusion in the Leyka WordPress plugin through version 3.31.9 allows unauthenticated attackers with no privileges to include and execute arbitrary PHP files on the server, potentially leading to full site compromise. Exploitation requires user interaction (tricking an administrator to click a malicious link) and achieves high impact on confidentiality, integrity, and availability. No public exploit or active exploitation has been identified at time of analysis.
A security vulnerability in cmsmasters CMSMasters Content Composer allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
Local file inclusion in NasaTheme Elessi WordPress theme allows authenticated low-privilege users to include arbitrary PHP files, exposing sensitive configuration data and potentially enabling code execution. Elessi versions before 6.4.1 are affected; vendor patch available. No active exploitation reported, and EPSS score low at 0.13%.
Local file inclusion in the PrivateContent - Mail Actions WordPress plugin allows unauthenticated attackers to include arbitrary local files, leading to potential remote code execution or sensitive data disclosure. Affects versions up to 2.3.2, with exploitation requiring user interaction and high attack complexity. No active exploitation or public exploit code has been reported as of this analysis.
Improper input validation in Monitorr up to 1.7.6m via the installer component allows authenticated administrators to achieve limited information disclosure or file manipulation. The vulnerability has a publicly available exploit but no reports of active exploitation, and the EPSS probability is low (0.09%).
The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up to, and including 2.0.1, due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially fixed in version 3.2.0 and fully fixed in version 3.2.1
A security vulnerability in Booking X (CVSS 7.5). High severity vulnerability requiring prompt remediation.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenticated attackers to intercept the authorization code and obtain an access token by redirecting the user to an attacker-controlled URI. Note: OAuth is disabled, the 'Meow_MWAI_Labs_OAuth' class is not loaded in the plugin in the patched version 2.8.5.
The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators.
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator.
The RD Contacto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the rdWappUpdateData() function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in all versions up to, and including, 7.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updatecar and createcar functions in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible.
The Migration, Backup, Staging - WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers.
CVE-2025-49618 is a security vulnerability (CVSS 5.8). Remediation should follow standard vulnerability management procedures.
The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above.
Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the footer_text and announcement parameters in config.php.
Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validation of user input, through the replace parameter in /config.php/tags.
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Vikinger theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the vikinger_delete_activity_media_ajax() function in all versions up to, and including, 1.9.32. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Note: Requires Vikinger Media plugin to be installed and active.
The All-in-One Addons for Elementor - WidgetKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'button+modal' widget in all versions up to, and including, 2.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.