PHP
Monthly
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.7%.
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.9%.
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.8%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.3%.
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.5%.
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 77.9%.
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Authenticated Craft CMS control-panel users holding viewEntries and viewPeerEntries (but not savePeerEntries) can silently reorder Matrix blocks and Addresses belonging to other authors' entries in Craft CMS 5.0.0 through 5.10.12 by POSTing directly to the actions/nested-elements/reorder endpoint. The flaw is a missing-authorization condition: the read-only entry view hands the session a manageNestedElements::<ownerId>::field:<handle> flag, and the reorder action trusts that flag without re-verifying the caller's save permission on the owner element, unlike the corresponding delete endpoint. Impact is limited to integrity of sort order (no read, creation, or deletion of content) and requires valid CP credentials plus a multi-author deployment with shared peer content, so it rates 5.3 (CVSS 4.0) and the low end of the integrity-only range; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). A vendor-released patch exists in 5.10.13.
Missing authorization in AVideo through 29.0 lets any authenticated user post comments to password-protected or group-restricted videos by submitting crafted POST requests to the comment API with arbitrary video IDs. The flaw lives in the set_api_comment function (CVE-2026-92586, CWE-862), which validates that a video exists but not that the requesting user is permitted to interact with it; exploitation requires only a standard registered account (CVSS 4.0 PR:L, no user interaction) and knowledge or enumeration of the target video's ID. Impact is strictly integrity-limited - attackers can inject comment content onto restricted videos, but the password/group viewing gate itself is not bypassed and the protected media remains unreadable. No CISA KEV listing or public exploit code is associated with this issue in the supplied intelligence, and our independent assessment rates it a genuine-but-low-severity broken-authorization flaw rather than an emergency.
Vote-counter manipulation in AVideo through 29.0 allows any authenticated user to like or dislike password-protected and group-restricted videos they cannot view, because the set.json.php API endpoint does not enforce video access permissions. The flaw is an object-level missing authorization issue (CWE-862) affecting commit c3edcc274c389816d434acadac07ee78eaf330c1; impact is integrity-only, with no content disclosure, availability, or confidentiality effect. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low despite the medium CVSS score.
Stored cross-site scripting in AVideo through 29.0 (revision e01e41ecc) allows unauthenticated remote attackers to inject arbitrary HTML/JavaScript into the videos_statistics table via the view-counter endpoint, which is then executed in the session of a video owner or administrator who visits the statistics page. The vulnerability arises because unrecognized User-Agent strings are stored verbatim in the app column without invoking the sanitizing setter, and the DataTables 1.12.1 renderer on view/videoViewsInfo.php uses innerHTML. No vendor patch is available, no public exploit code was identified at time of analysis, and exploitation is limited by the need for a privileged user to view the stats page and a 45-character payload truncation.
Non-atomic rate-limit counter increments in AVideo through 29.0 let remote unauthenticated attackers bypass the platform's documented 30-attempts-per-5-minute login throttle simply by firing genuinely concurrent credential guesses, multiplying their effective attempt rate by their connection concurrency. The weakness only degrades a protective control, so abuse still requires a brute-forceable account (weak or guessable password, no MFA, and no independent account lockout), which keeps this a moderate, defense-in-depth issue rather than a critical priority. No public exploit code has been identified at time of analysis, and the assigned CVSS 4.0 base score is 6.9 for low confidentiality and integrity impact to the vulnerable system.
Authenticated AVideo users can drive video like counts arbitrarily negative by submitting the 'like' request parameter as an array rather than a scalar, exploiting counter arithmetic in Like::__construct() that executes before input validation; the resulting corruption is stored in a denormalized counter and persists until an administrator manually repairs it. Impact is confined to integrity of the engagement metric (no confidentiality, availability, code execution, or user interaction required), and no public exploit code or confirmed active exploitation is associated with this issue at time of analysis. CVSS 4.0 base score is 5.3 for AVideo through version 29.0; our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) rates this a low-to-moderate integrity issue rather than a security priority.
Forced logout of authenticated AVideo users (versions through 29.0) is possible when the third-party LoginWordPress plugin is installed and enabled, because the core autoCSRFGuard() function exempts plugin files whose basenames collide with exempt core filenames. An unauthenticated remote attacker (CVSS vector PR:N) can induce an already-authenticated victim to submit a cross-site POST to the plugin's login.json.php endpoint, which inherits the CSRF exemption and terminates the victim's session before credential validation occurs; the attack does not read data, alter server-side records beyond ending the session, or bypass login, and impact is confined to session termination. No public exploit is identified at time of analysis, and the independent assessment rates this as a genuine but low-to-moderate priority issue rather than a high-severity compromise.
Authenticated customers on PrestaShop storefronts running the blockwishlist module through 3.0.2 can retrieve share tokens for arbitrary wishlists due to a missing ownership check in the getUrlByIdWishListAction method, exposing other customers' private wishlist contents. The flaw is an IDOR (CWE-639) exploitable by supplying sequential numeric wishlist identifiers; it does not allow modification of data or account takeover, and our independent assessment rates it a genuine but low-severity authorization weakness. Publicly available exploit code exists, but active exploitation has not been confirmed.
Authenticated customers on PrestaShop stores that have the psgdpr GDPR-compliance module installed at version 1.4.3 or earlier can forge GDPR consent audit records belonging to other customers by supplying attacker-chosen customer identifiers to the module's front-office consent AJAX endpoint (FrontAjaxGdpr.php), corrupting the integrity of consent logs. Only a valid customer account is required - no administrator privileges, no user interaction, and no special store configuration beyond an active module - and publicly available exploit code exists. The flaw is not in CISA KEV (no confirmed active exploitation), and the impact is confined to integrity of the consent audit trail: no data disclosure, account takeover, or availability loss results from this issue.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the login handler of SourceCodester Inventory and Monitoring System 1.0 lets remote unauthenticated attackers inject arbitrary SQL through the Username argument of /index.php, potentially reading and altering database contents. The flaw requires no credentials, no user interaction, and no non-default configuration, and publicly available exploit code exists; there is no indication of confirmed active exploitation (no CISA KEV listing). Note the scoring split: the CNA's CVSS 4.0 vector rates 5.5 with limited (VC:L/VI:L/VA:L) impact, while our independent assessment treats confidentiality and integrity as High (CVSS 3.1 9.8); real-world risk is in practice bounded less by any technical prerequisite than by the product's small deployment footprint.
SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Cross-site request forgery in PbootCMS 3.2.0 through 3.2.24 lets an attacker make a currently logged-in administrator's browser issue forged requests to the admin User Management endpoints (UserController::del and UserController::mod), silently deleting or modifying administrator accounts without the attacker needing any credentials of their own. Exploitation is constrained: it requires a victim who is an authenticated admin with a live session and who is lured into loading attacker-controlled content, so the framework's own assessment is non-automatable with only partial integrity impact (vendor CVSS 4.0 score 2.1 Low; independent vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), and publicly available exploit code exists although there is no CISA KEV listing and no EPSS score was provided. A vendor-released patch fixes the issue in version 3.2.25.
Cross-site scripting in PbootCMS versions 3.2.0 through 3.2.22 lets an authenticated backend user supply a malicious value in the content Title argument, which the decode_string function in apps/admin/controller/content/ContentController.php fails to neutralize before the Template Rendering component outputs it; the injected script then executes in the browser of any user who loads the rendered page. Publicly available exploit code exists, but exploitation is constrained by two prerequisites - a valid backend account and victim interaction with the tainted page - and the assessed impact is limited to manipulation of page content in the viewer's browser, with no confidentiality or availability impact. This is a low-priority issue despite being remotely reachable.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
Authenticated attackers with admin-level access to Synaptik CMS (synaptik-cms) through version 1.3.4.4 can abuse the rename function in admin/file-manager.php to place executable files on the server, bypassing the intended file-type restrictions. Exploitation is remote and requires only administrative privileges (PR:H, UI:N), with limited confidentiality, integrity, and availability impact per the CVSS 4.0 vector scoring 5.1; publicly available exploit code has been published in a GitHub security-research repository, so weaponized use against unpatched instances is plausible. The vendor has released version 1.3.5, which remediates the issue, and no CISA KEV listing or EPSS score was supplied in the source data.
SQL injection in the gedelumbung HospitalManagement application (PHP/CodeIgniter-style MVC codebase) allows an attacker who can reach the patient-index search function to inject arbitrary SQL through the 'cari' argument passed to generate_index_pasien in application/models/app_global_admin_model.php. The flaw is CWE-89, reachable over the network (AV:N, AC:L), but the CVSS 4.0 vector assigns PR:H, indicating exploitation in the intended path requires high-level (administrative) privileges; impact is limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L). Publicly available exploit code exists, but there is no CISA KEV listing and no confirmed active exploitation; the project uses rolling releases, so no fixed version is identified and the maintainer has not responded to the issue report.
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks.
Reflected cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an attacker run arbitrary JavaScript in a victim's browser by abusing the conversation messages feature's handling of a user-supplied custom date format. Because the conversation view endpoint carries no CSRF token, the payload can be delivered through an auto-submitting cross-origin POST from an attacker-controlled page, and the independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) treats the attack as unauthenticated, requiring only that the victim load a malicious page. Impact is limited to the victim's browser session - reflected rather than stored XSS, with partial confidentiality and integrity loss and no availability impact - and the vendor's own CVSS v4.0 score of 2.1 (AT:P/PR:L/UI:P) reflects that exploitability depends on attacker-provided content and victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully remediated in 9.5.3.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Stored HTML injection in the 'Firma Circolare' (circular signing) feature of the Design Scuole Italia WordPress theme, affecting versions 1.0 through 2.17.3, allows an authenticated user who can edit the 'sign' parameter to persist arbitrary HTML that forces visiting users to an attacker-controlled URL. Exploitation requires a valid low-privileged account with access to the signing feature (PR:L) plus a victim subsequently viewing the affected page (UI:P/UI:R), and the impact is confined to integrity of the rendered page with no confidentiality or availability effect. No public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Technical Impact: partial, so this is a low-to-moderate priority issue rather than an urgent one.
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Unauthenticated SQL injection in WuzhiCMS 4.0 and 4.1.0 allows remote attackers to tamper with backend database queries through the article::getDataOfJson action, because the title and master_table parameters are passed into SQL statements without sanitization. Publicly available exploit code exists (referenced via the vendor's own GitHub issue tracker), and the upstream project has not responded or issued a fix at the time of analysis. The CVSS v4.0 score of 6.9 with an E:P threat metric reflects confirmed proof-of-concept availability rather than an abstract theoretical risk.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.
A SQL injection in SourceCodester Online Faculty Clearance System 1.0 lets remote attackers manipulate the 'haydi' argument handled by /update_requirement_status.php to inject arbitrary SQL into backend queries. The CVSS 4.0 vector reports AV:N/AC:L/PR:N/UI:N, so exploitation does not require prior authentication or user interaction, and the impact is scored as Low across confidentiality, integrity and availability. Publicly available exploit code exists (referenced via a public GitHub issue and the VULDB submission), and the vendor has published no patch - the product is a downloadable PHP demo application rather than a maintained commercial platform.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
Authorization bypass in subhajitkhan's online-clinic-management-system lets a remote, unauthenticated attacker take over an administrator session by manipulating the adminmail argument processed by session_start() in adminappview.php, with no password or token required. Publicly available exploit code exists and the maintainer has not responded to the issue report filed against the project, so no fixed release is available. With CVSS 4.0 base metrics of AV:N/AC:L/PR:N/UI:N and E:P, impact is scored low across confidentiality, integrity and availability, but the resulting admin session can expose patient and appointment records.
Improper privilege assignment in SourceCodester College Notes Gallery Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during account registration by manipulating the `role` parameter in signup.php. An attacker who registers with a crafted request can gain administrative access to the application without authorization. A public exploit has been disclosed, lowering the bar for exploitation significantly.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
Improper access control in PHPGurukul Hostel Management System 3.0 allows an attacker to bypass authorization checks in the admin login handler /admin/includes/checklogin.php by manipulating the ID parameter, granting unauthorized access to administrative functionality. Exploitation is remotely reachable and publicly available exploit code exists (tracked via a GitHub PoC issue and VulDB entry), though the per-component impact is limited to low confidentiality, integrity and availability loss. EPSS/KEV signals are absent from the provided data, and the published CVSS 4.0 base metrics (AV:N/AC:L/PR:L/UI:N, all impacts Low) indicate a modest real-world risk rather than mass-exploitation potential.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
PHPGurukul Blood Donor Management System 1.0 stores credentials in cleartext on disk when crafted values are supplied to the password, email, currentpassword, dbcurrentpwd, or newpassword arguments handled by application/models/admin/Login_Model.php. Vulnerable code paths are reachable remotely per the CVSS 4.0 vector (AV:N/PR:N/UI:N), although exploitation complexity is rated high (AC:H) and only a low confidentiality impact is scored. Publicly available exploit code exists and is flagged with an Exploit maturity of P in the CVSS vector, so the flaw should be treated as exploitable even though the base score is only 2.9 and no CISA KEV entry is present.
SQL injection in PHPGurukul Blood Donor Management System 1.0 lets remote attackers inject arbitrary SQL through the fromdate and todate parameters handled by /application/controllers/admin/Report.php, exposing or altering the underlying donor database. Publicly available exploit code exists and the vendor has published no fixed release, so any internet- or intranet-exposed deployment of this teaching/demo application remains vulnerable. CVSS 4.0 base is 5.5 with an exploit-maturity rating of Proof-of-Concept, indicating limited but real opportunistic risk rather than mass exploitation.
Improper authentication in the admin Dashboard controller of PHPGurukul Blood Donor Management System 1.0 lets a remote, unauthenticated attacker reach administrative functionality by calling the controller's constructor route directly, bypassing the login/session check. Successful abuse exposes donor and blood-stock data and allows modification of records, giving low but real confidentiality, integrity and availability impact. Publicly available exploit code exists and the vendor has not published a fixed release, so every internet-facing deployment of version 1.0 should be assumed reachable by automated scanners.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class.
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
PHP object injection in October CMS (composer package october/system) allows an attacker-controlled serialized payload stored in a widget session key to be passed to unserialize() without an allowed_classes restriction, enabling instantiation of arbitrary classes and reachable gadget chains — potentially yielding PHP code execution as the web server user. The flaw is reachable only when the niche opt-in cms.safe_mode setting is enabled and a backend user with CMS markup editing access is not fully trusted, so standard production installations with Safe Mode off are not exposed. Public proof-of-concept code exists and vendor patches ship in 3.7.17 and 4.2.x; exploitation is not confirmed in CISA KEV, and the vendor's own CVSS score (3.3) is far below what the stated code-execution impact would normally imply.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
OS command injection in MacCMS10 2026.1000.4055 allows an authenticated administrator to execute arbitrary system commands on the underlying server via the Template Handler component by submitting a crafted URL-encoded path parameter. A public proof-of-concept exploit exists, referenced through a GitHub issue report against the project repository. No vendor patch has been released; the project maintainer has not responded to the disclosure.
Cross-tenant sender alias disclosure in Froxlor before 2.3.7 allows any authenticated customer to enumerate and read other customers' allowed sender alias values via an IDOR flaw in the delete-confirmation flow of `customer_email.php`. The query fetching `allowed_sender` uses only the global auto-increment `senderid` parameter without scoping it to the requesting customer, making all sender alias records on the instance accessible to any authenticated tenant. Publicly available exploit code exists, verified against Froxlor 2.3.6 with `mail.enable_allow_sender` enabled; no active exploitation has been identified.
SQL injection in Yot CMS 3.3.x via the Login function in global.php allows remote unauthenticated attackers to supply crafted SQL payloads through the yot3_user and yot3_pass cookie values, bypassing authentication and forging administrator sessions. The researcher-published GitHub PoC (by dddwmr) explicitly demonstrates full admin session forgery as the end result, making the assigned CVSS 5.5 score a material understatement of actual impact. Publicly available exploit code exists; no CISA KEV listing was confirmed at time of analysis.
Remote code execution in Yot CMS 3.3.0 and 3.3.1 is achievable by an authenticated administrator through the Admin Console's unsanitized use of PHP's eval() function in modsys/console/admin.php, where the text POST parameter is passed directly to eval() without validation. A publicly available proof-of-concept on GitHub demonstrates the attack. Despite the technically accurate RCE classification, exploitation is gated behind high-privilege (administrator) authentication, substantially reducing practical risk compared to the tag alone suggests.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the unsanitized prodcode parameter in /pages/pro_edit1.php. A public proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any attacker holding a low-privilege account. The CVSS 4.0 score of 2.1 reflects constrained partial database read, write, and availability impact rather than full compromise, and no active exploitation has been reported.
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `subject` parameter of `/subject1.php`. A public proof-of-concept exploit has been disclosed via a GitHub issue. No active exploitation (CISA KEV) is recorded, and the CVSS 4.0 base score of 2.1 reflects the passive user interaction requirement and limited integrity-only impact on the vulnerable system.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.
Cross-site request forgery in Rizwan17's PHP inventory-management-system allows remote attackers to perform unauthorized state-changing actions by tricking an authenticated victim into visiting a malicious page. The vulnerability exists in includes/process.php and results in limited integrity impact - an attacker can manipulate inventory data on behalf of a logged-in user without the user's knowledge. A publicly available proof-of-concept exploit (poc_idor_updateuser.py) exists; however, no KEV listing indicates no confirmed active exploitation at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.
Unsafe PHP deserialization in PHPGurukul Small CRM 4.0 exposes the login endpoint to object injection attacks via the uncontrolled `geopluginURL` parameter passed directly to `unserialize()` in `/crm/login.php`. A remote, unauthenticated attacker who can supply a crafted serialized payload to the login success handler may trigger arbitrary object instantiation, with actual impact constrained by available PHP gadget chains in the application. A public proof-of-concept exploit exists, though the vendor-reported CVSS 4.0 score of 2.9 and AC:H rating indicate exploitation is difficult and real-world impact is assessed as limited integrity degradation rather than full compromise.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.7%.
The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an externally introduced modification (Trojan Horse) in server_sync.php, which. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.9%.
Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.8%.
The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via the callmenum parameter in a c action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.7%.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.3%.
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.5%.
TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 77.9%.
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Stored cross-site scripting in Craft CMS (5.7.0 through 5.10.12) allows an authenticated content editor to plant malicious JavaScript that executes in the Control Panel session of a higher-privileged user who views the affected element index. The flaw lives in the Generated Fields feature, which disables Twig autoescaping and caches field values without encoding, so injected markup is served raw; exploitation requires an editor-level account (PR:L), the optional Generated Fields feature to be in use, and the victim to open the index (UI:P), and the resulting impact is confined to the victim's browser session with no server-side confidentiality, integrity, or availability loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the practical risk is moderate rather than critical because of the account, feature, and interaction prerequisites.
Authenticated Craft CMS control-panel users holding viewEntries and viewPeerEntries (but not savePeerEntries) can silently reorder Matrix blocks and Addresses belonging to other authors' entries in Craft CMS 5.0.0 through 5.10.12 by POSTing directly to the actions/nested-elements/reorder endpoint. The flaw is a missing-authorization condition: the read-only entry view hands the session a manageNestedElements::<ownerId>::field:<handle> flag, and the reorder action trusts that flag without re-verifying the caller's save permission on the owner element, unlike the corresponding delete endpoint. Impact is limited to integrity of sort order (no read, creation, or deletion of content) and requires valid CP credentials plus a multi-author deployment with shared peer content, so it rates 5.3 (CVSS 4.0) and the low end of the integrity-only range; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing). A vendor-released patch exists in 5.10.13.
Missing authorization in AVideo through 29.0 lets any authenticated user post comments to password-protected or group-restricted videos by submitting crafted POST requests to the comment API with arbitrary video IDs. The flaw lives in the set_api_comment function (CVE-2026-92586, CWE-862), which validates that a video exists but not that the requesting user is permitted to interact with it; exploitation requires only a standard registered account (CVSS 4.0 PR:L, no user interaction) and knowledge or enumeration of the target video's ID. Impact is strictly integrity-limited - attackers can inject comment content onto restricted videos, but the password/group viewing gate itself is not bypassed and the protected media remains unreadable. No CISA KEV listing or public exploit code is associated with this issue in the supplied intelligence, and our independent assessment rates it a genuine-but-low-severity broken-authorization flaw rather than an emergency.
Vote-counter manipulation in AVideo through 29.0 allows any authenticated user to like or dislike password-protected and group-restricted videos they cannot view, because the set.json.php API endpoint does not enforce video access permissions. The flaw is an object-level missing authorization issue (CWE-862) affecting commit c3edcc274c389816d434acadac07ee78eaf330c1; impact is integrity-only, with no content disclosure, availability, or confidentiality effect. No public exploit identified at time of analysis, and the independent assessment rates real-world risk as low despite the medium CVSS score.
Stored cross-site scripting in AVideo through 29.0 (revision e01e41ecc) allows unauthenticated remote attackers to inject arbitrary HTML/JavaScript into the videos_statistics table via the view-counter endpoint, which is then executed in the session of a video owner or administrator who visits the statistics page. The vulnerability arises because unrecognized User-Agent strings are stored verbatim in the app column without invoking the sanitizing setter, and the DataTables 1.12.1 renderer on view/videoViewsInfo.php uses innerHTML. No vendor patch is available, no public exploit code was identified at time of analysis, and exploitation is limited by the need for a privileged user to view the stats page and a 45-character payload truncation.
Non-atomic rate-limit counter increments in AVideo through 29.0 let remote unauthenticated attackers bypass the platform's documented 30-attempts-per-5-minute login throttle simply by firing genuinely concurrent credential guesses, multiplying their effective attempt rate by their connection concurrency. The weakness only degrades a protective control, so abuse still requires a brute-forceable account (weak or guessable password, no MFA, and no independent account lockout), which keeps this a moderate, defense-in-depth issue rather than a critical priority. No public exploit code has been identified at time of analysis, and the assigned CVSS 4.0 base score is 6.9 for low confidentiality and integrity impact to the vulnerable system.
Authenticated AVideo users can drive video like counts arbitrarily negative by submitting the 'like' request parameter as an array rather than a scalar, exploiting counter arithmetic in Like::__construct() that executes before input validation; the resulting corruption is stored in a denormalized counter and persists until an administrator manually repairs it. Impact is confined to integrity of the engagement metric (no confidentiality, availability, code execution, or user interaction required), and no public exploit code or confirmed active exploitation is associated with this issue at time of analysis. CVSS 4.0 base score is 5.3 for AVideo through version 29.0; our independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) rates this a low-to-moderate integrity issue rather than a security priority.
Forced logout of authenticated AVideo users (versions through 29.0) is possible when the third-party LoginWordPress plugin is installed and enabled, because the core autoCSRFGuard() function exempts plugin files whose basenames collide with exempt core filenames. An unauthenticated remote attacker (CVSS vector PR:N) can induce an already-authenticated victim to submit a cross-site POST to the plugin's login.json.php endpoint, which inherits the CSRF exemption and terminates the victim's session before credential validation occurs; the attack does not read data, alter server-side records beyond ending the session, or bypass login, and impact is confined to session termination. No public exploit is identified at time of analysis, and the independent assessment rates this as a genuine but low-to-moderate priority issue rather than a high-severity compromise.
Authenticated customers on PrestaShop storefronts running the blockwishlist module through 3.0.2 can retrieve share tokens for arbitrary wishlists due to a missing ownership check in the getUrlByIdWishListAction method, exposing other customers' private wishlist contents. The flaw is an IDOR (CWE-639) exploitable by supplying sequential numeric wishlist identifiers; it does not allow modification of data or account takeover, and our independent assessment rates it a genuine but low-severity authorization weakness. Publicly available exploit code exists, but active exploitation has not been confirmed.
Authenticated customers on PrestaShop stores that have the psgdpr GDPR-compliance module installed at version 1.4.3 or earlier can forge GDPR consent audit records belonging to other customers by supplying attacker-chosen customer identifiers to the module's front-office consent AJAX endpoint (FrontAjaxGdpr.php), corrupting the integrity of consent logs. Only a valid customer account is required - no administrator privileges, no user interaction, and no special store configuration beyond an active module - and publicly available exploit code exists. The flaw is not in CISA KEV (no confirmed active exploitation), and the impact is confined to integrity of the consent audit trail: no data disclosure, account takeover, or availability loss results from this issue.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated remote user to manipulate the ID argument in /module/leave/index.php and potentially read or modify database contents. Publicly available exploit code exists, but the attack requires a valid session and the product is a niche PHP application unlikely to be internet-exposed in production, so our assessment treats this as a low-real-priority issue despite the genuine CWE-89 flaw. No CISA KEV confirmation is provided.
SQL injection in the login handler of SourceCodester Inventory and Monitoring System 1.0 lets remote unauthenticated attackers inject arbitrary SQL through the Username argument of /index.php, potentially reading and altering database contents. The flaw requires no credentials, no user interaction, and no non-default configuration, and publicly available exploit code exists; there is no indication of confirmed active exploitation (no CISA KEV listing). Note the scoring split: the CNA's CVSS 4.0 vector rates 5.5 with limited (VC:L/VI:L/VA:L) impact, while our independent assessment treats confidentiality and integrity as High (CVSS 3.1 9.8); real-world risk is in practice bounded less by any technical prerequisite than by the product's small deployment footprint.
SQL injection in SourceCodester Inventory and Monitoring System 1.0 allows remote attackers to manipulate database queries through the difficulty_id parameter of the /admins/assessments/databank/btn_functions.php?action=add endpoint. Publicly available exploit code exists, and the vendor-supplied CVSS 4.0 score of 6.9 treats the flaw as remotely reachable without authentication (PR:N); however, our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N because the /admins/ path implies an administrative function that typically sits behind a login, so a valid staff or admin session may be required, which materially lowers realistic risk. Impact is limited to low-confidentiality and low-integrity effects on the backend database; there is no evidence of active exploitation, and the affected product is a niche PHP application with a very small deployment footprint, making broad opportunistic targeting unlikely.
Concrete CMS 9.2.0 through 9.5.3 fails to enforce an authorization check on its REST API user-creation endpoint (POST /ccm/api/1.0/users), so any request bearing a valid OAuth token that carries the users:add scope - including a client_credentials token with no associated user context - can create active, validated accounts while bypassing email verification and administrator approval. The endpoint's add() method in concrete/src/Api/Controller/Users.php performs no permission verification, making this a classic missing-authorization weakness (CWE-862) that an authenticated API consumer can abuse to gain a foothold. Under default registration settings the newly minted accounts are allowed to edit page content, which provides an escalation path to stored cross-site scripting and further compromise of the CMS. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the reporter-independent assessment rates the impact as limited to low integrity loss on the CMS itself.
Cross-site scripting (XSS) in the Category Update function (/admin/update_category.php) of SourceCodester Online Food Ordering System 1.0 allows an authenticated administrator to inject script payloads that execute in the browser when the manipulated category page is rendered, requiring user interaction. Publicly available exploit code exists, but the high-privilege prerequisite (admin access) and limited integrity-only impact make this a low-severity admin self-XSS scenario; no active exploitation (CISA KEV) is indicated.
Cross-site request forgery in PbootCMS 3.2.0 through 3.2.24 lets an attacker make a currently logged-in administrator's browser issue forged requests to the admin User Management endpoints (UserController::del and UserController::mod), silently deleting or modifying administrator accounts without the attacker needing any credentials of their own. Exploitation is constrained: it requires a victim who is an authenticated admin with a live session and who is lured into loading attacker-controlled content, so the framework's own assessment is non-automatable with only partial integrity impact (vendor CVSS 4.0 score 2.1 Low; independent vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), and publicly available exploit code exists although there is no CISA KEV listing and no EPSS score was provided. A vendor-released patch fixes the issue in version 3.2.25.
Cross-site scripting in PbootCMS versions 3.2.0 through 3.2.22 lets an authenticated backend user supply a malicious value in the content Title argument, which the decode_string function in apps/admin/controller/content/ContentController.php fails to neutralize before the Template Rendering component outputs it; the injected script then executes in the browser of any user who loads the rendered page. Publicly available exploit code exists, but exploitation is constrained by two prerequisites - a valid backend account and victim interaction with the tainted page - and the assessed impact is limited to manipulation of page content in the viewer's browser, with no confidentiality or availability impact. This is a low-priority issue despite being remotely reachable.
Server-side request forgery in WuzhiCMS up to and including version 4.1.0 lets an attacker direct the server to fetch an arbitrary URL through the ckditor::saveRemote handler in coreframe/app/attachment/index.php, by manipulating the source[] argument of the Remote Image Fetch component. Publicly available exploit code exists (a public GitHub issue, wuzhicms/wuzhicms#221, documents the flaw) and the vendor was notified early but has not responded, so no fixed release is available at time of analysis. The vulnerability is not confirmed as actively exploited (no CISA KEV listing); the supplied CVSS 4.0 vector scores 6.9 and rates it unauthenticated (PR:N) and remotely reachable with no user interaction, but our independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and cautions that the CKEditor attachment/upload handler is typically reachable only within an authenticated content-editing session - defenders should verify in their own deployment whether saveRemote is exposed pre-authentication.
SQL injection in code-projects Matrimonial System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL through the /search.php endpoint of the Regular Search component by manipulating any of the sex, mothertongue, maritialstatus, country, state, religion, agemin, or agemax parameters. The vendor-scored CVSS 4.0 base of 6.9 reflects limited per-dimension impact, but our independent assessment rates it more severely on confidentiality (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), since a successful injection can expose the full contents of the backend database with no credentials, user interaction, or non-default configuration required. Publicly available exploit code exists (a GitHub proof-of-concept repository targeting the sex and mothertongue parameters), but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS data was provided. The practical risk is tempered by the application's likely negligible production footprint as a tutorial-grade PHP project.
Broken access control in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability (Contributor role or higher) reschedule, suppress, or otherwise alter the scheduled social-media post records belonging to other users. The issue is remotely reachable over HTTP with no user interaction, but exploitation is gated by low-privilege authentication and by the presence of other users' scheduled posts, so cross-user impact is negligible on single-author sites. It is rated CVSS 4.0 5.3 (Medium); there is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available.
User email disclosure in Adenion's Blog2Social WordPress plugin before 9.1.0 allows any authenticated user holding the edit_posts capability to enumerate and retrieve the email addresses of every registered account on the site, including administrators. The b2s_search_user AJAX handler fails to restrict callers to those with the list_users capability, turning a routine user-search function into a bulk contact-harvesting primitive for low-privileged insider or subscriber-level accounts. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; the practical risk is data-harvesting and follow-on phishing rather than code execution, so this is a genuine but modest-severity information-disclosure issue rather than a high-impact priority.
User account enumeration in the Adenion Blog2Social plugin for WordPress before 9.1.0 lets any authenticated user holding the edit_posts capability - such as a Contributor, Author, Editor, or Administrator - resolve arbitrary numeric user IDs to their display names and confirm whether those accounts exist. The bug is an authorization bypass through a user-controlled key (CWE-639) in the b2s_get_select_mandant_user AJAX handler, which returns user data for the attacker-supplied owner parameter without checking that the caller is allowed to read account information; the CVSS 4.0 base score is 5.3 (Medium) and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, meaning confidentiality-only impact with no modification or availability effect. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; practical risk is concentrated on sites that allow open or self-registration or that host many low-trust contributor accounts, since a valid low-privileged login is a strict prerequisite.
SQL injection in the ID parameter of /module/employee/index.php in itsourcecode Leave Management System 1.0 allows an attacker holding a low-privilege authenticated session to read sensitive records and partially modify database contents, with no user interaction and no special configuration required. Publicly available exploit code exists, disclosed through a public GitHub issue and catalogued by VulDB, but there is no CISA KEV listing and therefore no confirmation of active exploitation. Our independent re-assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) treats the confidentiality impact as High and rates the issue more seriously than the CVSS 4.0 base score of 2.1 attached to the VulDB entry, although the practical risk is constrained by the product's extremely small real-world deployment footprint.
Password hash disclosure in Pepperl+Fuchs ICE2/ICE3 IO-Link Master devices and Phoenix Contact IOL MA8 PN DI8 (plus OEM variants) exposes all user credential hashes to any authenticated low-privileged user. The PHP-based diagnostics endpoint `/index.php/diagnostics_tab/ajax_diag_table_rows` accepts a manipulable `schema` path parameter that, when tampered with using a valid session cookie, causes the server to return the device's full user credential hash store. No public exploit or active exploitation has been identified at time of analysis; three separate CERTVDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same underlying vulnerability spans multiple vendor product lines sharing common firmware.
The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution.
Authenticated attackers with admin-level access to Synaptik CMS (synaptik-cms) through version 1.3.4.4 can abuse the rename function in admin/file-manager.php to place executable files on the server, bypassing the intended file-type restrictions. Exploitation is remote and requires only administrative privileges (PR:H, UI:N), with limited confidentiality, integrity, and availability impact per the CVSS 4.0 vector scoring 5.1; publicly available exploit code has been published in a GitHub security-research repository, so weaponized use against unpatched instances is plausible. The vendor has released version 1.3.5, which remediates the issue, and no CISA KEV listing or EPSS score was supplied in the source data.
SQL injection in the gedelumbung HospitalManagement application (PHP/CodeIgniter-style MVC codebase) allows an attacker who can reach the patient-index search function to inject arbitrary SQL through the 'cari' argument passed to generate_index_pasien in application/models/app_global_admin_model.php. The flaw is CWE-89, reachable over the network (AV:N, AC:L), but the CVSS 4.0 vector assigns PR:H, indicating exploitation in the intended path requires high-level (administrative) privileges; impact is limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L). Publicly available exploit code exists, but there is no CISA KEV listing and no confirmed active exploitation; the project uses rolling releases, so no fixed version is identified and the maintainer has not responded to the issue report.
A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks.
Reflected cross-site scripting in Concrete CMS versions 5.0.0 through 9.5.2 lets an attacker run arbitrary JavaScript in a victim's browser by abusing the conversation messages feature's handling of a user-supplied custom date format. Because the conversation view endpoint carries no CSRF token, the payload can be delivered through an auto-submitting cross-origin POST from an attacker-controlled page, and the independently assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) treats the attack as unauthenticated, requiring only that the victim load a malicious page. Impact is limited to the victim's browser session - reflected rather than stored XSS, with partial confidentiality and integrity loss and no availability impact - and the vendor's own CVSS v4.0 score of 2.1 (AT:P/PR:L/UI:P) reflects that exploitability depends on attacker-provided content and victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fully remediated in 9.5.3.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Stored HTML injection in the 'Firma Circolare' (circular signing) feature of the Design Scuole Italia WordPress theme, affecting versions 1.0 through 2.17.3, allows an authenticated user who can edit the 'sign' parameter to persist arbitrary HTML that forces visiting users to an attacker-controlled URL. Exploitation requires a valid low-privileged account with access to the signing feature (PR:L) plus a victim subsequently viewing the affected page (UI:P/UI:R), and the impact is confined to integrity of the rendered page with no confidentiality or availability effect. No public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none with Technical Impact: partial, so this is a low-to-moderate priority issue rather than an urgent one.
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.
Unauthenticated server-side request forgery in AVideo through version 29.0 lets remote attackers drive the server's own HTTP client to arbitrary destinations by supplying crafted Host headers to submitIndex.php or ajax.php. Because the check_site_availability function follows redirects without validating the host, an attacker can map internal hosts and open ports from the outside. No public exploit code or CISA KEV entry was provided in the intelligence feed, so exploitation status is unconfirmed, but the flaw requires no credentials and is trivially automatable.
Unauthenticated SQL injection in WuzhiCMS 4.0 and 4.1.0 allows remote attackers to tamper with backend database queries through the article::getDataOfJson action, because the title and master_table parameters are passed into SQL statements without sanitization. Publicly available exploit code exists (referenced via the vendor's own GitHub issue tracker), and the upstream project has not responded or issued a fix at the time of analysis. The CVSS v4.0 score of 6.9 with an E:P threat metric reflects confirmed proof-of-concept availability rather than an abstract theoretical risk.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unauthenticated remote SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows an attacker to inject arbitrary SQL through the ID argument of /delete_faculty1.php, exposing or destroying records in the underlying database. The CVSS 4.0 vector rates network-reachable, low-complexity, no-privilege, no-interaction exploitation with low confidentiality, integrity and availability impact (base 5.5), and publicly available exploit code exists, so unpatched internet-facing instances are immediately at risk. No CISA KEV entry or EPSS score was supplied, so there is no confirmed evidence of active exploitation in the wild at time of analysis.
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.
A SQL injection in SourceCodester Online Faculty Clearance System 1.0 lets remote attackers manipulate the 'haydi' argument handled by /update_requirement_status.php to inject arbitrary SQL into backend queries. The CVSS 4.0 vector reports AV:N/AC:L/PR:N/UI:N, so exploitation does not require prior authentication or user interaction, and the impact is scored as Low across confidentiality, integrity and availability. Publicly available exploit code exists (referenced via a public GitHub issue and the VULDB submission), and the vendor has published no patch - the product is a downloadable PHP demo application rather than a maintained commercial platform.
Unauthenticated SQL injection in SourceCodester Online Faculty Clearance System 1.0 allows remote attackers to inject arbitrary SQL through the ID argument of /delete_requirement.php, giving them read and write access to the application's clearance records. Publicly available exploit code exists (GitHub OnlyCMJB/cve issue 2), and the flaw is tracked by VulDB and ENISA EUVD, but CISA KEV does not list it as actively exploited. Because this is a demo-grade PHP application distributed as downloadable source with no vendor patch channel identified, exposure is concentrated among institutions that deployed it as-is on an internet-facing web server.
Authorization bypass in subhajitkhan's online-clinic-management-system lets a remote, unauthenticated attacker take over an administrator session by manipulating the adminmail argument processed by session_start() in adminappview.php, with no password or token required. Publicly available exploit code exists and the maintainer has not responded to the issue report filed against the project, so no fixed release is available. With CVSS 4.0 base metrics of AV:N/AC:L/PR:N/UI:N and E:P, impact is scored low across confidentiality, integrity and availability, but the resulting admin session can expose patient and appointment records.
Improper privilege assignment in SourceCodester College Notes Gallery Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during account registration by manipulating the `role` parameter in signup.php. An attacker who registers with a crafted request can gain administrative access to the application without authorization. A public exploit has been disclosed, lowering the bar for exploitation significantly.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.
Improper access control in PHPGurukul Hostel Management System 3.0 allows an attacker to bypass authorization checks in the admin login handler /admin/includes/checklogin.php by manipulating the ID parameter, granting unauthorized access to administrative functionality. Exploitation is remotely reachable and publicly available exploit code exists (tracked via a GitHub PoC issue and VulDB entry), though the per-component impact is limited to low confidentiality, integrity and availability loss. EPSS/KEV signals are absent from the provided data, and the published CVSS 4.0 base metrics (AV:N/AC:L/PR:L/UI:N, all impacts Low) indicate a modest real-world risk rather than mass-exploitation potential.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
Unauthenticated SQL injection in the login handler (/College/login.php) of SourceCodester College Notes Gallery Management System 1.0 allows remote attackers to inject arbitrary SQL through the 'User' parameter. Publicly available exploit code exists (disclosed via a GitHub issue referenced by VulDB), and successful abuse can bypass authentication and expose or corrupt the backend database. The CVSS 4.0 base score is 5.5 with the E:P threat metric, reflecting limited but real confidentiality, integrity, and availability impact.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
PHPGurukul Blood Donor Management System 1.0 stores credentials in cleartext on disk when crafted values are supplied to the password, email, currentpassword, dbcurrentpwd, or newpassword arguments handled by application/models/admin/Login_Model.php. Vulnerable code paths are reachable remotely per the CVSS 4.0 vector (AV:N/PR:N/UI:N), although exploitation complexity is rated high (AC:H) and only a low confidentiality impact is scored. Publicly available exploit code exists and is flagged with an Exploit maturity of P in the CVSS vector, so the flaw should be treated as exploitable even though the base score is only 2.9 and no CISA KEV entry is present.
SQL injection in PHPGurukul Blood Donor Management System 1.0 lets remote attackers inject arbitrary SQL through the fromdate and todate parameters handled by /application/controllers/admin/Report.php, exposing or altering the underlying donor database. Publicly available exploit code exists and the vendor has published no fixed release, so any internet- or intranet-exposed deployment of this teaching/demo application remains vulnerable. CVSS 4.0 base is 5.5 with an exploit-maturity rating of Proof-of-Concept, indicating limited but real opportunistic risk rather than mass exploitation.
Improper authentication in the admin Dashboard controller of PHPGurukul Blood Donor Management System 1.0 lets a remote, unauthenticated attacker reach administrative functionality by calling the controller's constructor route directly, bypassing the login/session check. Successful abuse exposes donor and blood-stock data and allows modification of records, giving low but real confidentiality, integrity and availability impact. Publicly available exploit code exists and the vendor has not published a fixed release, so every internet-facing deployment of version 1.0 should be assumed reachable by automated scanners.
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class.
OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controlled filename to unlink() when rejecting the upload, potentially causing file deletion and denial of service.
SQL injection in the doctor login page (doctorlogin.php) of the subhajitkhan online-clinic-management-system allows remote unauthenticated attackers to manipulate the doc_mail and doc_pswd parameters and execute arbitrary SQL against the backend database, potentially bypassing authentication or exfiltrating patient and staff records. Publicly available exploit code exists, and the project maintainer has not responded to the issue report; no patched version is available as the product uses a rolling release model.
PHP object injection in October CMS (composer package october/system) allows an attacker-controlled serialized payload stored in a widget session key to be passed to unserialize() without an allowed_classes restriction, enabling instantiation of arbitrary classes and reachable gadget chains — potentially yielding PHP code execution as the web server user. The flaw is reachable only when the niche opt-in cms.safe_mode setting is enabled and a backend user with CMS markup editing access is not fully trusted, so standard production installations with Safe Mode off are not exposed. Public proof-of-concept code exists and vendor patches ship in 3.7.17 and 4.2.x; exploitation is not confirmed in CISA KEV, and the vendor's own CVSS score (3.3) is far below what the stated code-execution impact would normally imply.
Privilege escalation in October CMS 3.x and 4.x lets an authenticated backend user who holds CMS markup editing rights break out of the Twig Safe Mode sandbox and impersonate an existing superuser. The bypass chains two weaknesses: the Laravel session store is handed to Twig templates with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) leak through Eloquent's __call forwarding so a template can run arbitrary queries and then overwrite the admin_auth session key. Publicly available exploit code exists, but exploitation requires cms.safe_mode to be explicitly enabled, a deliberately untrusted markup editor account, and a pre-existing superuser whose session can be forged — a combination that October CMS states does not occur in standard production deployments.
SQL injection in itsourcecode Leave Management System 1.0 lets a low-privileged, authenticated user manipulate the 'ID' argument of /module/company/index.php to run attacker-controlled SQL against the application's database. The flaw is a classic CWE-89 injection reachable over the network with no user interaction, but it requires an existing account on the application (CVSS 4.0 PR:L; assessed CVSS 3.1 PR:L), which is the main barrier to abuse. Publicly available exploit code exists (a proof-of-concept is linked from the VulDB submission and a GitHub issue), so the practical barrier is low for anyone who already holds credentials; however, EPSS is only 0.25% (16th percentile) and there is no CISA KEV listing, so signals converge on LOW real-world priority despite the injection class.
Reflected cross-site scripting in itsourcecode Loan Management System 1.0 allows a remote, unauthenticated attacker to inject arbitrary script through the 'page' argument processed by navbar.php, because the value is echoed back into the HTML response without output encoding. Publicly available exploit code exists (a GitHub issue referenced from the CVE record), and the CVSS 4.0 base score is only 2.1 because exploitation requires the victim to interact and the demonstrated impact is limited to integrity (VI:L) with no confidentiality or availability loss and no scope change. It is not reported as actively exploited and no CISA KEV entry is present.
Unauthenticated SQL injection in itsourcecode Leave Management System 1.0 lets a remote attacker manipulate the user_email argument of /login.php to alter the authentication query and read or subvert backend data. Exploit code has been made publicly available (reflected as exploit maturity E:P in the CVSS 4.0 vector and referenced from a GitHub issue), so any internet-reachable deployment should be treated as immediately attackable. The flaw is not listed in CISA KEV and no EPSS score was supplied, so active in-the-wild exploitation is not confirmed — but the low attack complexity and zero authentication requirement make opportunistic scanning likely.
OS command injection in MacCMS10 2026.1000.4055 allows an authenticated administrator to execute arbitrary system commands on the underlying server via the Template Handler component by submitting a crafted URL-encoded path parameter. A public proof-of-concept exploit exists, referenced through a GitHub issue report against the project repository. No vendor patch has been released; the project maintainer has not responded to the disclosure.
Cross-tenant sender alias disclosure in Froxlor before 2.3.7 allows any authenticated customer to enumerate and read other customers' allowed sender alias values via an IDOR flaw in the delete-confirmation flow of `customer_email.php`. The query fetching `allowed_sender` uses only the global auto-increment `senderid` parameter without scoping it to the requesting customer, making all sender alias records on the instance accessible to any authenticated tenant. Publicly available exploit code exists, verified against Froxlor 2.3.6 with `mail.enable_allow_sender` enabled; no active exploitation has been identified.
SQL injection in Yot CMS 3.3.x via the Login function in global.php allows remote unauthenticated attackers to supply crafted SQL payloads through the yot3_user and yot3_pass cookie values, bypassing authentication and forging administrator sessions. The researcher-published GitHub PoC (by dddwmr) explicitly demonstrates full admin session forgery as the end result, making the assigned CVSS 5.5 score a material understatement of actual impact. Publicly available exploit code exists; no CISA KEV listing was confirmed at time of analysis.
Remote code execution in Yot CMS 3.3.0 and 3.3.1 is achievable by an authenticated administrator through the Admin Console's unsanitized use of PHP's eval() function in modsys/console/admin.php, where the text POST parameter is passed directly to eval() without validation. A publicly available proof-of-concept on GitHub demonstrates the attack. Despite the technically accurate RCE classification, exploitation is gated behind high-privilege (administrator) authentication, substantially reducing practical risk compared to the tag alone suggests.
SQL injection in the `searchtext` parameter of `listdoctor.php` in subhajitkhan's online-clinic-management-system exposes the backend database to unauthenticated remote attackers. The flaw allows direct manipulation of SQL queries, potentially enabling full database enumeration and data modification. A public proof-of-concept exists via GitHub issue, the maintainer has not responded to disclosure, and no patch has been released for this rolling-release project.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the unsanitized prodcode parameter in /pages/pro_edit1.php. A public proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any attacker holding a low-privilege account. The CVSS 4.0 score of 2.1 reflects constrained partial database read, write, and availability impact rather than full compromise, and no active exploitation has been reported.
Authorization bypass via Insecure Direct Object Reference (IDOR) in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to access arbitrary invoice records by manipulating the ID parameter in invoice.php. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application trusts a user-supplied identifier to gate access without server-side ownership verification. A publicly available proof-of-concept exploit exists on GitHub; no public KEV or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious scripts via the Product_Name parameter handled by /api/products_handler.php in the Product Management Module. When other authenticated users subsequently view affected product listings, the injected payload executes in their browsers, enabling session hijacking, credential theft, or UI redressing. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation by non-expert attackers.
Cross-site scripting in SourceCodester Inventory Management System 1.0 allows authenticated remote attackers to inject and execute arbitrary client-side scripts via the `/api/vendors_handler.php` Vendor Management endpoint. A public proof-of-concept exploit has been published on GitHub (gist by fhewm98), confirming the issue is reproducible. Exploitation requires low-privilege authentication and victim interaction, limiting blast radius, but successful attacks can hijack sessions, redirect users, or perform unauthorized actions on behalf of the victim.
Reflected or stored cross-site scripting in SourceCodester Inventory Management System 1.0 allows an authenticated remote attacker to inject malicious JavaScript via the Customer_Name parameter in the Customer Management Module's /api/customers_handler.php endpoint. When a second user (such as an administrator) loads the affected customer record, the payload executes in their browser, enabling session hijacking or unauthorized actions on their behalf. A public proof-of-concept exploit is available on GitHub; no active exploitation (KEV) has been confirmed.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `subject` parameter of `/subject1.php`. A public proof-of-concept exploit has been disclosed via a GitHub issue. No active exploitation (CISA KEV) is recorded, and the CVSS 4.0 base score of 2.1 reflects the passive user interaction requirement and limited integrity-only impact on the vulnerable system.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.
Cross-site request forgery in Rizwan17's PHP inventory-management-system allows remote attackers to perform unauthorized state-changing actions by tricking an authenticated victim into visiting a malicious page. The vulnerability exists in includes/process.php and results in limited integrity impact - an attacker can manipulate inventory data on behalf of a logged-in user without the user's knowledge. A publicly available proof-of-concept exploit (poc_idor_updateuser.py) exists; however, no KEV listing indicates no confirmed active exploitation at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.
Unsafe PHP deserialization in PHPGurukul Small CRM 4.0 exposes the login endpoint to object injection attacks via the uncontrolled `geopluginURL` parameter passed directly to `unserialize()` in `/crm/login.php`. A remote, unauthenticated attacker who can supply a crafted serialized payload to the login success handler may trigger arbitrary object instantiation, with actual impact constrained by available PHP gadget chains in the application. A public proof-of-concept exploit exists, though the vendor-reported CVSS 4.0 score of 2.9 and AC:H rating indicate exploitation is difficult and real-world impact is assessed as limited integrity degradation rather than full compromise.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.