PHP
Monthly
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Arbitrary file upload in the Drag & Drop Upload Pro plugin for WooCommerce allows unauthenticated attackers to upload malicious files, potentially achieving remote code execution. Standalone versions up to 1.7.1 and versions 5.0 through 5.0.5 bundled with the PrintSpace theme are affected. Although PHP execution is disabled via default .htaccess, many server configurations lack this protection, and the EPSS score of 0.86% (75th percentile) indicates a low but notable exploitation chance with no confirmed active exploitation.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
A security vulnerability in Soumettre.fr (CVSS 3.7). Remediation should follow standard vulnerability management procedures.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID parameter in /myprofile.php, potentially leading to data theft or manipulation. A proof-of-concept exploit is publicly available, but the EPSS score is very low (0.06%) and no active exploitation has been reported.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter in /myprofileup.php. A public proof-of-concept exploit is available, but the EPSS score of 0.06% indicates low probability of widespread exploitation and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 via the ID parameter in /mark.php allows remote attackers to execute arbitrary SQL commands. Exploit code is publicly available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability affects version 1.0.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the ID parameter of the empproject.php endpoint, potentially exposing or modifying employee data. A public proof-of-concept exploit is available, but the EPSS exploitation probability is very low (0.06%), and there is no evidence of active exploitation (not listed in CISA KEV).
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the 'ID' parameter in /eloginwel.php. A publicly disclosed exploit exists, but no evidence of active exploitation in the wild. The vulnerability has a low EPSS score (0.06%) and a CVSS 4.0 base score of 5.5, indicating limited impact to confidentiality, integrity, and availability.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /edit.php. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS estimates a 0.06% probability of exploitation. The vulnerability is rated critical but carries a medium CVSS 4.0 score of 5.5 due to limited impact.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the mailuid parameter in /process/eprocess.php. This critical vulnerability can lead to unauthorized data access or manipulation. Exploit code is publicly available, though EPSS estimates a low probability (0.06%) of widespread exploitation.
A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter of the /changepassemp.php password change page. This unauthenticated, remotely exploitable flaw can lead to unauthorized data access or modification. Public exploit code is available, but the EPSS score of 0.06% indicates low exploitation probability, and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the mailuid parameter in /process/aprocess.php. This can lead to database compromise, including unauthorized data access and modification. A public proof
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of the /applyleave.php endpoint, leading to unauthorized database access or modification. A publicly available proof-of-concept exploit exists, enabling data exfiltration without authentication. The vulnerability received a CVSS 4.0 base score of 5.5 (Medium) and has a low EPSS exploitation probability (0.06%).
The Dear Flipbook - PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Opal Estate Pro - Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the 'cid' parameter in /pages/payment_add.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, but no active exploitation has been reported. Exploitation can lead to unauthorized data access, modification, or deletion.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate database queries via the ID parameter in /admin/manage-foreigners-ticket.php. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV. The low CVSS score (2.1) reflects limited impact and the requirement for low-privilege credentials.
SQL injection in PHPGurukul Zoo Management System 2.1 allows low-privileged authenticated remote attackers to inject malicious SQL via the viewid parameter in /admin/view-normal-ticket.php. Exploit code is publicly available, though no active exploitation has been confirmed and EPSS remains low. The vulnerability carries a low CVSS 4.0 base score (2.1) due to limited impact, but the reporting source rates it as critical.
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated low-privilege users to manipulate database queries via the 'session' parameter in /register.php, potentially leading to data theft or modification. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates very low likelihood (0.04%).
SQL injection in PHPGurukul Student Record System 3.2 enables authenticated remote attackers to manipulate database queries via the fmarks2 parameter in /edit-student.php, potentially leading to data exposure or modification. Exploit code is publicly available, but the low EPSS score (0.04%) and required low-privilege authentication limit immediate real-world risk.
Remote SQL injection in PHPGurukul Student Record System 3.2 allows authenticated attackers to manipulate the aemailid parameter via /admin-profile.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation (CISA KEV) or vendor patch has been confirmed at this time.
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated remote attackers to manipulate backend database queries by supplying a crafted value to the `del` parameter in `/manage-students.php`. A public proof-of-concept is available on GitHub (referenced in NVD), enabling potential database enumeration, data exfiltration, or record manipulation against any exposed deployment. Despite the public exploit, EPSS sits at 0.04% (13th percentile), reflecting the product's narrow real-world footprint rather than any technical barrier to exploitation.
SQL injection in the 'del' parameter of /manage-subjects.php in PHPGurukul Student Record System 3.2 allows authenticated, low-privilege remote attackers to manipulate the backend database. Public exploit code is available, though EPSS exploitation probability is low (0.04%) and active exploitation by CISA KEV is not confirmed.
SQL injection in PHPGurukul Student Record System 3.2 via /session.php allows authenticated remote attackers to manipulate the session parameter to execute arbitrary SQL commands, leading to potential data theft or tampering. A public proof-of-concept exploit is available, though no active exploitation has been confirmed. The affected system is a niche academic management platform, reducing widespread risk.
SQL injection in PHPGurukul Old Age Home Management System 1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the emeradd parameter in /admin/add-scdetails.php. An attacker can
SQL injection in PHPGurukul Old Age Home Management System 1.0 allows remote authenticated attackers with low privileges to manipulate the sertitle parameter in /admin/edit-services.php, potentially leading to unauthorized database access or modification. Public exploit code is available, but there is no evidence of active exploitation in the wild. The vulnerability has a low CVSS 4.0 base score of 2.1, reflecting limited impact and authenticated access requirements.
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
SQL injection in Car Rental System 1.0 (PHP) allows manipulation of the /admin/approve.php endpoint by supplying a malicious value to the ID parameter, potentially enabling full database read and write operations. A public proof-of-concept exploit is available on GitHub. Despite the unauthenticated vector assigned in the CVSS data, the endpoint's location under /admin/ raises an unresolved question about whether authentication is actually enforced - a critical detail for defenders assessing real exposure. EPSS sits at 0.05% (14th percentile), consistent with the obscure, niche footprint of this code-projects demo application.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows manipulation of the `tid` parameter in `/admin/edit-teacher-detail.php` to read, modify, or delete database contents. The attack is remotely exploitable and a public proof-of-concept is available on GitHub, though EPSS remains very low at 0.05% (14th percentile), indicating limited real-world targeting to date. No vendor-released patch has been identified at time of analysis.
SQL injection in Staff Audit System 1.0 allows remote attackers with low privileges to execute arbitrary SQL commands via the Search parameter in /search_index.php. A public exploit is available, though EPSS estimates very low exploitation probability (0.04%) and no active exploitation has been confirmed.
SQL injection in Staff Audit System 1.0 enables remote authenticated attackers to manipulate database queries via the updateid argument in /update_index.php. Exploit code is public, though no active exploitation is reported. The vulnerability poses low real-world risk due to limited impact and low EPSS score.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated attackers with low privileges to manipulate the editid parameter in /panel/edit-tax.php to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification.
SQL injection in Best Salon Management System 1.0 allows remote attackers to inject SQL via the 'Name' parameter in /panel/add-tax.php. The exploit is publicly available, though real-world risk is limited due to the product's low deployment footprint. EPSS of 0.06% indicates very low probability of active exploitation, and no CISA KEV entry suggests no current in-the-wild use.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated low-privilege users to execute arbitrary SQL via the searchdata parameter in /panel/search-appointment.php. Exploit code is publicly available, but no active exploitation has been confirmed. An attacker with a valid account can read, modify, or delete salon booking data.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers with low privileges to manipulate the editid parameter in /panel/edit-category.php, leading to potential data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation is confirmed (EPSS score 0.08%) and the vulnerability is not listed in CISA KEV.
SQL injection in Best Salon Management System 1.0 allows remote authenticated attackers to manipulate database queries via the 'Name' parameter of /panel/add-category.php. Publicly available exploit code exists, increasing the risk of opportunistic attacks. No active exploitation has been reported in CISA KEV, but the low-complexity flaw can lead to unauthorized data access or modification.
Limited SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via the editid parameter in /panel/edit-subscription.php. The vulnerability has a publicly available proof-of-concept exploit and may result in low-impact data access or modification, though no active exploitation has been confirmed by CISA KEV.
SQL injection in Best Salon Management System 1.0 via the user_id/plan_id parameters of /panel/add_subscribe.php allows remote attackers with low-privilege credentials to manipulate database queries, potentially leading to unauthorized data access or modification. A publicly available exploit exists, but no active exploitation has been reported in the wild. The CVSS 4.0 base metrics indicate only limited impact on confidentiality, integrity, and availability.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 permits authenticated users with high privileges to upload arbitrary files via the 'img' parameter in /classes/Users.php, likely resulting in remote code execution if a malicious PHP script is placed in the webroot. A public exploit is available, but no active exploitation is reported.
Unrestricted file upload in Simple Company Website 1.0 allows authenticated administrators to upload arbitrary files via the settings update endpoint, leading to low-impact compromise. The vulnerability has
SQL injection in SourceCodester Simple Company Website 1.0 allows remote attackers to manipulate the login process via the Username parameter in /classes/Login.php. A publicly available proof-of-concept exploit exists, and EPSS indicates a 0.09% probability of exploitation, but no active exploitation campaigns are confirmed.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 allows remote attackers to upload arbitrary files via the img parameter in /classes/Content.php?f=service, potentially leading to code execution. A publicly available exploit exists, though no active exploitation is confirmed. The CVSS vector indicates high privilege requirements, but the presence of an Authentication Bypass tag suggests this may be circumventable.
An SQL injection in Simple Company Website 1.0's admin testimonials management page allows authenticated administrators to execute arbitrary SQL commands. Remotely exploitable, this can lead to limited compromise of database confidentiality, integrity, and availability. Proof-of-concept code is publicly available, though current exploitation probability is low (EPSS 0.08%, no active
SQL injection in SourceCodester Simple Company Website
Authenticated SQL injection in SourceCodester Simple Company Website 1.0 allows remote administrators to execute arbitrary SQL commands via the ID parameter in the admin/services/manage.php endpoint, potentially leading to data manipulation or information disclosure. Exploit code is publicly available, but EPSS indicates very low exploitation probability and no active exploitation is confirmed.
Path traversal in code-projects Simple Forum 1.0 allows authenticated attackers to read arbitrary files via the filename parameter of /forum_downloadfile.php. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). CVSS 4.0 base score is 2.1 (Low), reflecting limited impact on confidentiality only.
Cross-site request forgery vulnerability in DaiCuo CMS up to version 1.3.13 allows remote attackers to perform unintended actions on behalf of authenticated administrators by tricking them into clicking a malicious link while logged into the application. The exploit is publicly available, and affected installations may be manipulated via the /admin.php/addon/index endpoint. No active exploitation has been confirmed by CISA KEV, and EPSS score indicates low exploitation probability (0.08%).
Cross-site request forgery in SeaCMS admin panel (/admin_type.php) allows remote attackers to trick authenticated administrators into performing unintended actions. All versions up to 13.2 are affected. A public exploit is available, but the vulnerability is not known to be actively exploited; EPSS probability is very low (0.06%).
SQL injection in PHPGurukul Local Services Search Engine Management System 2.1 enables remote unauthenticated attackers to inject arbitrary SQL commands via the editid parameter in /admin/edit-category-detail.php, potentially allowing unauthorized database access or modification. A publicly available proof-of-concept exists, but real-world exploitation remains minimal with EPSS at 0.06% (18th percentile), indicating the vulnerable application has extremely limited deployment footprint despite the publicly disclosed vulnerability.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to manipulate the editid parameter in /panel/edit_plan.php, leading to unauthorized database access or modification. Publicly available exploit code exists, but EPSS estimates a low 0.06% likelihood of exploitation, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via plan_name, description, duration_days, and price parameters in /panel/add_plan.php. An attacker with low-privileged access can extract or modify data through publicly available exploit code, though no active exploitation has been confirmed.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate database queries via the fromdate/todate parameters in /panel/staff_commision.php. Public exploit code exists, but no active exploitation is confirmed. The CVSS 4.0 base score is 2.1 (Low), though the reporter assigns a critical severity, likely due to different scoring versions.
SQL injection in Best Salon Management System 1.0 via the /panel/pro_s
Remote SQL injection in code-projects Simple Forum 1.0 allows authenticated low-privilege attackers to read, modify, or delete database contents via the File parameter in /forum1.php. Exploit code is publicly available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inject a PHP Object through a PHAR file. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization occurs when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to include arbitrary file paths in a form submission. The file will be deleted when the form submission is deleted, whether by an Administrator or via auto-deletion determined by plugin settings. This can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.89. This is due to missing or incorrect nonce validation on the bsaCreateAdTemplate function. This makes it possible for unauthenticated attackers to inject and execute arbitrary PHP code via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘oid’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Arbitrary file upload in the Drag & Drop Upload Pro plugin for WooCommerce allows unauthenticated attackers to upload malicious files, potentially achieving remote code execution. Standalone versions up to 1.7.1 and versions 5.0 through 5.0.5 bundled with the PrintSpace theme are affected. Although PHP execution is disabled via default .htaccess, many server configurations lack this protection, and the EPSS score of 0.86% (75th percentile) indicates a low but notable exploitation chance with no confirmed active exploitation.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘bsa_pro_id’ parameter in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Home Villas | Real Estate WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'wp_rem_cs_widget_file_delete' function in all versions up to, and including, 2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion which leads to Remote Code Execution in all versions up to, and including, 4.89. This is due to the presence of a SQL Injection vulnerability and Local File Inclusion vulnerability that can be chained with an image upload. This makes it possible for unauthenticated attackers to execute code on the server upload image files on the server than can be fetched via a SQL injection vulnerability, and ultimately executed as PHP code through the local file inclusion vulnerability.
A security vulnerability in Soumettre.fr (CVSS 3.7). Remediation should follow standard vulnerability management procedures.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to SQL Injection via the ‘$id’ variable of the getSpace() function in all versions up to, and including, 4.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.89 via the 'bsa_template' parameter of the `bsa_preview_callback` function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases .php files can can be uploaded and included, or already exist on the site.
The Lead Form Data Collection to CRM plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ~/includes/LB_admin_ajax.php file in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform several actions like updating settings. Initially this CVE was assigned specifically to all AJAX actions and the doFieldAjaxAction() function, however it was determined that CVE-2025-47690 is assigned to the doFieldAjaxAction() function that leads to arbitrary options updates.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) is vulnerable to Cross-Site Scripting (XSS) in the getqsetting.php functionality that could allow reflected execution of scripts in the browser on interaction.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID parameter in /myprofile.php, potentially leading to data theft or manipulation. A proof-of-concept exploit is publicly available, but the EPSS score is very low (0.06%) and no active exploitation has been reported.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter in /myprofileup.php. A public proof-of-concept exploit is available, but the EPSS score of 0.06% indicates low probability of widespread exploitation and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 via the ID parameter in /mark.php allows remote attackers to execute arbitrary SQL commands. Exploit code is publicly available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability affects version 1.0.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the ID parameter of the empproject.php endpoint, potentially exposing or modifying employee data. A public proof-of-concept exploit is available, but the EPSS exploitation probability is very low (0.06%), and there is no evidence of active exploitation (not listed in CISA KEV).
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate the database via the 'ID' parameter in /eloginwel.php. A publicly disclosed exploit exists, but no evidence of active exploitation in the wild. The vulnerability has a low EPSS score (0.06%) and a CVSS 4.0 base score of 5.5, indicating limited impact to confidentiality, integrity, and availability.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /edit.php. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS estimates a 0.06% probability of exploitation. The vulnerability is rated critical but carries a medium CVSS 4.0 score of 5.5 due to limited impact.
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL via the mailuid parameter in /process/eprocess.php. This critical vulnerability can lead to unauthorized data access or manipulation. Exploit code is publicly available, though EPSS estimates a low probability (0.06%) of widespread exploitation.
A PHP objection injection vulnerability exists in the Monero Project’s Laravel-based forum software due to unsafe handling of untrusted input in the /get/image/ endpoint. The application passes a user-supplied link parameter directly to file_get_contents() without validation. MIME type checks using PHP’s finfo can be bypassed via crafted stream filter chains that prepend spoofed headers, allowing access to internal Laravel configuration files. An attacker can extract the APP_KEY from config/app.php, forge encrypted cookies, and trigger unsafe unserialize() calls, leading to reliable remote code execution.
An SQL injection vulnerability exists in the Dahua Smart Cloud Gateway Registration Management Platform via the username parameter in the /index.php/User/doLogin endpoint. The application fails to properly sanitize user input, allowing unauthenticated attackers to inject arbitrary SQL statements and potentially disclose sensitive information. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.
SQL injection in Campcodes Employee Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter of the /changepassemp.php password change page. This unauthenticated, remotely exploitable flaw can lead to unauthorized data access or modification. Public exploit code is available, but the EPSS score of 0.06% indicates low exploitation probability, and no active exploitation has been confirmed.
SQL injection in Campcodes Employee Management System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the mailuid parameter in /process/aprocess.php. This can lead to database compromise, including unauthorized data access and modification. A public proof
SQL injection in Campcodes Employee Management System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter of the /applyleave.php endpoint, leading to unauthorized database access or modification. A publicly available proof-of-concept exploit exists, enabling data exfiltration without authentication. The vulnerability received a CVSS 4.0 base score of 5.5 (Medium) and has a low EPSS exploitation probability (0.06%).
The Dear Flipbook - PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter in all versions up to, and including, 2.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's UACF7_CUSTOM_FIELDS shortcode in all versions up to, and including, 3.5.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Opal Estate Pro - Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to privilege escalation via in all versions up to, and including, 1.7.5. This is due to a lack of role restriction during registration in the 'on_regiser_user' function. This makes it possible for unauthenticated attackers to arbitrarily choose the role, including the Administrator role, assigned when registering.
SQL injection in Simple Pizza Ordering System 1.0 enables remote attackers to manipulate the ID parameter of /editcus.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported, and EPSS predicts a low likelihood of widespread use.
SQL injection in Simple Pizza Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the ID parameter in the /large.php file to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. Public exploit code is available, though the EPSS score of 0.06% suggests low likelihood of widespread exploitation.
SQL injection in Simple Pizza Ordering System 1.0 allows remote attackers to manipulate database queries via the 'ID' parameter of /addpro.php. With no authentication or user interaction required, an attacker can read, modify, or delete data. Exploit code is publicly available but EPSS indicates a low probability of widespread exploitation.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the 'cid' parameter in /pages/payment_add.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, but no active exploitation has been reported. Exploitation can lead to unauthorized data access, modification, or deletion.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate database queries via the ID parameter in /admin/manage-foreigners-ticket.php. Public exploit code is available, though no active exploitation has been confirmed by CISA KEV. The low CVSS score (2.1) reflects limited impact and the requirement for low-privilege credentials.
SQL injection in PHPGurukul Zoo Management System 2.1 allows low-privileged authenticated remote attackers to inject malicious SQL via the viewid parameter in /admin/view-normal-ticket.php. Exploit code is publicly available, though no active exploitation has been confirmed and EPSS remains low. The vulnerability carries a low CVSS 4.0 base score (2.1) due to limited impact, but the reporting source rates it as critical.
SQL injection in code-projects Online Hotel Booking 1.0 allows remote attackers to manipulate the 'uname' parameter in /admin/registration.php to extract or modify database contents. The vulnerability is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and has publicly available exploit code, though EPSS indicates very low exploitation probability (0.05%).
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated low-privilege users to manipulate database queries via the 'session' parameter in /register.php, potentially leading to data theft or modification. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates very low likelihood (0.04%).
SQL injection in PHPGurukul Student Record System 3.2 enables authenticated remote attackers to manipulate database queries via the fmarks2 parameter in /edit-student.php, potentially leading to data exposure or modification. Exploit code is publicly available, but the low EPSS score (0.04%) and required low-privilege authentication limit immediate real-world risk.
Remote SQL injection in PHPGurukul Student Record System 3.2 allows authenticated attackers to manipulate the aemailid parameter via /admin-profile.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation (CISA KEV) or vendor patch has been confirmed at this time.
SQL injection in PHPGurukul Student Record System 3.2 allows authenticated remote attackers to manipulate backend database queries by supplying a crafted value to the `del` parameter in `/manage-students.php`. A public proof-of-concept is available on GitHub (referenced in NVD), enabling potential database enumeration, data exfiltration, or record manipulation against any exposed deployment. Despite the public exploit, EPSS sits at 0.04% (13th percentile), reflecting the product's narrow real-world footprint rather than any technical barrier to exploitation.
SQL injection in the 'del' parameter of /manage-subjects.php in PHPGurukul Student Record System 3.2 allows authenticated, low-privilege remote attackers to manipulate the backend database. Public exploit code is available, though EPSS exploitation probability is low (0.04%) and active exploitation by CISA KEV is not confirmed.
SQL injection in PHPGurukul Student Record System 3.2 via /session.php allows authenticated remote attackers to manipulate the session parameter to execute arbitrary SQL commands, leading to potential data theft or tampering. A public proof-of-concept exploit is available, though no active exploitation has been confirmed. The affected system is a niche academic management platform, reducing widespread risk.
SQL injection in PHPGurukul Old Age Home Management System 1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the emeradd parameter in /admin/add-scdetails.php. An attacker can
SQL injection in PHPGurukul Old Age Home Management System 1.0 allows remote authenticated attackers with low privileges to manipulate the sertitle parameter in /admin/edit-services.php, potentially leading to unauthorized database access or modification. Public exploit code is available, but there is no evidence of active exploitation in the wild. The vulnerability has a low CVSS 4.0 base score of 2.1, reflecting limited impact and authenticated access requirements.
SQL injection in Car Rental System 1.0 allows remote attackers to manipulate the 'fname' parameter in /book_car.php, leading to unauthorized database access. Publicly available exploit code exists, but no active exploitation or KEV listing has been reported. The vulnerability affects the open-source project from code-projects and carries a low EPSS score, indicating limited real-world targeting.
SQL injection in the login page of Code-projects Car Rental System 1.0 allows unauthenticated remote attackers to inject malicious SQL via the 'uname' parameter, potentially bypassing authentication and compromising the underlying database. Public exploit code is available, but EPSS (0.05%) and product footprint indicate low likelihood of widespread exploitation; no known active exploitation is flagged by CISA KEV.
Unauthenticated SQL injection in the signup endpoint of code-projects Car Rental System 1.0 allows remote attackers to extract or modify database contents via the fname parameter. Exploit code is publicly available, though the EPSS score of 0.05% suggests low current exploitation likelihood.
SQL injection in code-projects Car Rental System 1.0 via the car_name parameter in /admin/add_cars.php allows remote, unauthenticated attackers to manipulate database queries. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation and no active attacks are confirmed (not in CISA KEV). The vulnerability can lead to unauthorized data access or modification within the database.
SQL injection in Car Rental System 1.0 (PHP) allows manipulation of the /admin/approve.php endpoint by supplying a malicious value to the ID parameter, potentially enabling full database read and write operations. A public proof-of-concept exploit is available on GitHub. Despite the unauthenticated vector assigned in the CVSS data, the endpoint's location under /admin/ raises an unresolved question about whether authentication is actually enforced - a critical detail for defenders assessing real exposure. EPSS sits at 0.05% (14th percentile), consistent with the obscure, niche footprint of this code-projects demo application.
SQL injection in code-projects Inventory Management System 1.0 allows remote attackers to manipulate database queries via the edituserName parameter in /php_action/editUser.php. The exploit is publicly available, but the EPSS score is only 0.05%, indicating low probability of widespread exploitation. No evidence of active exploitation has been reported.
SQL injection in code-projects Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate the userid parameter in /php_action/removeUser.php, potentially executing arbitrary SQL commands. Publicly available exploit code exists, but the EPSS exploitation probability is low (0.05%). No evidence of active exploitation has been reported.
Unrestricted file upload in code-projects Library System 1.0 allows authenticated remote attackers with low privileges to upload arbitrary files via the image parameter in /add-book.php. A publicly available proof-of-concept exploit exists, potentially enabling remote code execution through webshell upload. EPSS score is low (0.09%), indicating low threat activity despite the ease of exploitation.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
A security vulnerability in Daily Expense Manager (CVSS 7.5). High severity vulnerability requiring prompt remediation.
SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in /php_action/createUser.php, leading to unauthorized data access or modification. Public exploit code is available (GitHub issue), but the EPSS exploitation probability is low (0.05%). The vulnerability is classified as critical despite a moderate CVSS base score, and no vendor-released patch has been identified.
SQL injection in Movie Ticketing System 1.0 allows remote attackers with low privileges to manipulate the backend database through the Date parameter of the /ticketConfirmation.php endpoint. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. The impact is rated low by CVSS, limiting the risk to data exposure or minor data tampering.
SQL injection in code-projects Movie Ticketing System 1.0 via the postName parameter in /logIn.php allows remote attackers to manipulate database queries. The vulnerability has a CVSS 4.0 score of 5.5 with low confidentiality, integrity, and availability impact. A public exploit is available, but there is no evidence of active exploitation.
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows unauthenticated remote attackers to execute arbitrary SQL commands via the tid parameter in /admin/changeimage.php. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is low (0.05%), indicating limited exploitation likelihood at this time.
SQL injection in PHPGurukul Teachers Record Management System 2.1 allows manipulation of the `tid` parameter in `/admin/edit-teacher-detail.php` to read, modify, or delete database contents. The attack is remotely exploitable and a public proof-of-concept is available on GitHub, though EPSS remains very low at 0.05% (14th percentile), indicating limited real-world targeting to date. No vendor-released patch has been identified at time of analysis.
SQL injection in Staff Audit System 1.0 allows remote attackers with low privileges to execute arbitrary SQL commands via the Search parameter in /search_index.php. A public exploit is available, though EPSS estimates very low exploitation probability (0.04%) and no active exploitation has been confirmed.
SQL injection in Staff Audit System 1.0 enables remote authenticated attackers to manipulate database queries via the updateid argument in /update_index.php. Exploit code is public, though no active exploitation is reported. The vulnerability poses low real-world risk due to limited impact and low EPSS score.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated attackers with low privileges to manipulate the editid parameter in /panel/edit-tax.php to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification.
SQL injection in Best Salon Management System 1.0 allows remote attackers to inject SQL via the 'Name' parameter in /panel/add-tax.php. The exploit is publicly available, though real-world risk is limited due to the product's low deployment footprint. EPSS of 0.06% indicates very low probability of active exploitation, and no CISA KEV entry suggests no current in-the-wild use.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated low-privilege users to execute arbitrary SQL via the searchdata parameter in /panel/search-appointment.php. Exploit code is publicly available, but no active exploitation has been confirmed. An attacker with a valid account can read, modify, or delete salon booking data.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers with low privileges to manipulate the editid parameter in /panel/edit-category.php, leading to potential data leakage or modification. A public proof-of-concept exploit is available, but no active exploitation is confirmed (EPSS score 0.08%) and the vulnerability is not listed in CISA KEV.
SQL injection in Best Salon Management System 1.0 allows remote authenticated attackers to manipulate database queries via the 'Name' parameter of /panel/add-category.php. Publicly available exploit code exists, increasing the risk of opportunistic attacks. No active exploitation has been reported in CISA KEV, but the low-complexity flaw can lead to unauthorized data access or modification.
Limited SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via the editid parameter in /panel/edit-subscription.php. The vulnerability has a publicly available proof-of-concept exploit and may result in low-impact data access or modification, though no active exploitation has been confirmed by CISA KEV.
SQL injection in Best Salon Management System 1.0 via the user_id/plan_id parameters of /panel/add_subscribe.php allows remote attackers with low-privilege credentials to manipulate database queries, potentially leading to unauthorized data access or modification. A publicly available exploit exists, but no active exploitation has been reported in the wild. The CVSS 4.0 base metrics indicate only limited impact on confidentiality, integrity, and availability.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 permits authenticated users with high privileges to upload arbitrary files via the 'img' parameter in /classes/Users.php, likely resulting in remote code execution if a malicious PHP script is placed in the webroot. A public exploit is available, but no active exploitation is reported.
Unrestricted file upload in Simple Company Website 1.0 allows authenticated administrators to upload arbitrary files via the settings update endpoint, leading to low-impact compromise. The vulnerability has
SQL injection in SourceCodester Simple Company Website 1.0 allows remote attackers to manipulate the login process via the Username parameter in /classes/Login.php. A publicly available proof-of-concept exploit exists, and EPSS indicates a 0.09% probability of exploitation, but no active exploitation campaigns are confirmed.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 allows remote attackers to upload arbitrary files via the img parameter in /classes/Content.php?f=service, potentially leading to code execution. A publicly available exploit exists, though no active exploitation is confirmed. The CVSS vector indicates high privilege requirements, but the presence of an Authentication Bypass tag suggests this may be circumventable.
An SQL injection in Simple Company Website 1.0's admin testimonials management page allows authenticated administrators to execute arbitrary SQL commands. Remotely exploitable, this can lead to limited compromise of database confidentiality, integrity, and availability. Proof-of-concept code is publicly available, though current exploitation probability is low (EPSS 0.08%, no active
SQL injection in SourceCodester Simple Company Website
Authenticated SQL injection in SourceCodester Simple Company Website 1.0 allows remote administrators to execute arbitrary SQL commands via the ID parameter in the admin/services/manage.php endpoint, potentially leading to data manipulation or information disclosure. Exploit code is publicly available, but EPSS indicates very low exploitation probability and no active exploitation is confirmed.
Path traversal in code-projects Simple Forum 1.0 allows authenticated attackers to read arbitrary files via the filename parameter of /forum_downloadfile.php. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). CVSS 4.0 base score is 2.1 (Low), reflecting limited impact on confidentiality only.
Cross-site request forgery vulnerability in DaiCuo CMS up to version 1.3.13 allows remote attackers to perform unintended actions on behalf of authenticated administrators by tricking them into clicking a malicious link while logged into the application. The exploit is publicly available, and affected installations may be manipulated via the /admin.php/addon/index endpoint. No active exploitation has been confirmed by CISA KEV, and EPSS score indicates low exploitation probability (0.08%).
Cross-site request forgery in SeaCMS admin panel (/admin_type.php) allows remote attackers to trick authenticated administrators into performing unintended actions. All versions up to 13.2 are affected. A public exploit is available, but the vulnerability is not known to be actively exploited; EPSS probability is very low (0.06%).
SQL injection in PHPGurukul Local Services Search Engine Management System 2.1 enables remote unauthenticated attackers to inject arbitrary SQL commands via the editid parameter in /admin/edit-category-detail.php, potentially allowing unauthorized database access or modification. A publicly available proof-of-concept exists, but real-world exploitation remains minimal with EPSS at 0.06% (18th percentile), indicating the vulnerable application has extremely limited deployment footprint despite the publicly disclosed vulnerability.
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to manipulate the editid parameter in /panel/edit_plan.php, leading to unauthorized database access or modification. Publicly available exploit code exists, but EPSS estimates a low 0.06% likelihood of exploitation, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via plan_name, description, duration_days, and price parameters in /panel/add_plan.php. An attacker with low-privileged access can extract or modify data through publicly available exploit code, though no active exploitation has been confirmed.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate database queries via the fromdate/todate parameters in /panel/staff_commision.php. Public exploit code exists, but no active exploitation is confirmed. The CVSS 4.0 base score is 2.1 (Low), though the reporter assigns a critical severity, likely due to different scoring versions.
SQL injection in Best Salon Management System 1.0 via the /panel/pro_s
Remote SQL injection in code-projects Simple Forum 1.0 allows authenticated low-privilege attackers to read, modify, or delete database contents via the File parameter in /forum1.php. Exploit code is publicly available but no active exploitation has been reported; EPSS indicates very low exploitation probability.