PHP
Monthly
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).
Improper privilege assignment in PHPGurukul Bank Locker Management System 1.0 allows remote authenticated attackers to bypass access controls by manipulating the `UserType` parameter in `sidebar.php`. The server fails to validate the supplied privilege level against the authenticated session, permitting lateral or vertical privilege escalation within the application. A public proof-of-concept exploit has been released per the VulDB disclosure, though the CVSS 4.0 base score of 2.1 reflects limited actual impact across confidentiality, integrity, and availability dimensions.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Status parameter in /bilal/normal/save_stud.php. The vulnerability enables unauthorized data access, modification, and potential full database compromise through crafted HTTP requests. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising immediate exploitation risk for any exposed instances.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.
Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
SQL injection in LuxSoft LuxCal through version 5.3.4L allows unauthenticated remote attackers to extract data from the underlying database by sending crafted requests to two public-facing PHP endpoints: rssfeed.php and common/retrieve.php. The vulnerability is reachable without authentication, as RSS and data-retrieval endpoints are typically exposed to anonymous visitors. A researcher has published proof-of-concept details, making exploitation straightforward for any attacker with network access to a LuxCal instance. No public exploit identified at time of analysis beyond the researcher disclosure.
Private playlist schedule metadata in WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is exposed via missing ownership validation in the Playlists_schedules/list.json.php and Live/calendar.json.php PHP endpoints. Both unauthenticated requesters and low-privilege users holding canStream rights can supply arbitrary playlist identifiers to retrieve private schedule names, descriptions, timestamps, and playlist identifiers with no ownership verification performed server-side. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the read-only, metadata-only nature of the disclosure.
Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.
Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The `getBookmarks.json.php` PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
Missing authorization in WWBN AVideo's commentAddNew.json.php endpoint permits authenticated users to post comments on password-protected and group-restricted videos regardless of whether they can access the content. The flaw affects all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1 of the self-hosted PHP video platform. An attacker holding any valid session can submit crafted POST requests to pollute comment threads on restricted videos, defeating both password and group-membership access controls without gaining actual view access to the content.
Missing authorization in WWBN AVideo's videoAddViewCount.json.php endpoint allows authenticated users to manipulate view counts and watch-time statistics on videos they are not permitted to access. Affected versions span all commits through c3edcc274c389816d434acadac07ee78eaf330c1 of the WWBN AVideo open-source PHP video platform. An attacker with any valid account can submit crafted requests with arbitrary video IDs to inflate engagement metrics on restricted or private content, undermining the integrity of access-controlled video libraries. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication in WWBN AVideo's Live plugin allows unauthenticated remote attackers to inject arbitrary socket notification messages to any administrator whose live stream key is known. The endpoint `/plugin/Live/socketMessageLiveOwner.json.php` validates that the stream *owner* holds admin privileges but performs no caller authentication (`User::isLogged()` is never invoked) and enforces no CSRF token, meaning the caller-identity check is entirely absent. No patch was available at time of publication; VulnCheck reported the issue against commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
Missing authorization in WWBN AVideo's remindMe.json.php endpoint allows authenticated users to create scheduler reminders for private live schedules they are not permitted to view. The generated email job leaks the private schedule's title back to the attacker, constituting an information disclosure via IDOR (CWE-639). Affected through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no specific patched version confirmed at time of analysis; no public exploit code or CISA KEV entry exists.
Unauthenticated information disclosure in WWBN AVideo exposes internal menu configuration data via the plugin/TopMenu/menus.json.php endpoint, which lacks any authentication check. Remote unauthenticated attackers can send a plain GET request to retrieve all menu data, including names of admin-only and inactive menus that are intentionally hidden from the public navbar. No public exploit or active exploitation has been identified, but the endpoint requires zero preconditions against any network-accessible AVideo instance through the affected commit.
Missing authorization in WWBN AVideo's playListAddVideo.json.php endpoint allows authenticated users to add password-protected videos to their own playlists without possessing the watch permissions those videos require. The flaw, identified through commit c3edcc274c389816d434acadac07ee78eaf330c1, stems from the server trusting submitted video and playlist IDs without verifying whether the requesting user is authorized to access the referenced video content. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c exposes inactive admin menu items and embedded secret query parameters via the unprotected `plugin/TopMenu/menuItems.json.php` PHP endpoint. Any network-reachable attacker can POST a `menuId` parameter to retrieve admin-tool URLs that are hidden from the public navbar, including secret tokens or keys embedded directly in those URLs. While the direct impact is limited confidentiality exposure (CVSS 4.0 VC:L), the leaked secret query parameters represent a stepping stone that could enable follow-on attacks against otherwise-obscured admin functionality. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo exposes private playlist data for any user when an attacker supplies a target's user identifier to the playlistsFromUser.json.php endpoint. The root flaw is improper cache keying that fails to scope responses to the requesting user's session, allowing Favorite and Watch Later playlists to leak across user contexts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Shopper Framework's Livewire Media component (`Media.store()`) allows any authenticated staff user holding only `browse_products` to overwrite product thumbnail and gallery images without the required `edit_products` permission. This is an incomplete fix: the prior patch for GHSA-h4mp-g9c6-xwph (commit fcd0c59) added `#[Locked]` to the `$product` property but omitted the `authorize()` call present in the five sibling components it did repair (Edit, Inventory, Seo, Shipping, Files). A fully functional proof-of-concept is included in the advisory; vendor-released patch is version 2.9.2. No public exploit identifier at time of analysis beyond the advisory PoC.
Missing server-side authorization (CWE-862) in four Livewire Settings components of Shopper Framework allows any authenticated staff user holding only the coarse `access_setting` permission to invoke destructive delete/edit actions - permanently removing shipping zones, carrier options, tax zones, and tax rates - without holding any `delete_*` or `edit_*` permission. The parent Filament page authorizes `access_setting` but child Livewire components handle their own `/livewire/update` HTTP requests independently and carry zero `->authorize()` calls, creating a privilege boundary gap. A working proof-of-concept validated against the real Livewire/Filament code path is included in the GHSA advisory, confirming low-sophistication exploitation; the fix is available in shopper/framework 2.9.2.
Shopper Framework versions prior to 2.9.0 permit authenticated administrators to create fixed-amount discount records with negative values through the /cpanel/discounts control panel, bypassing all server-side validation. The malformed values persist to the sh_discounts database table and flow unchecked through DiscountCalculator.php, where PHP's min() built-in lacks a lower-bound guard; a negative discount (e.g., -$99,999,999) causes the subtraction in Calculate.php to inflate rather than reduce order totals (subtotal 10,000 − discount −5,000 = 15,000). No public exploit code or CISA KEV listing exists; the issue is fixed in version 2.9.0.
CSRF in Concrete CMS 9.5.2 and below allows a remote unauthenticated attacker to permanently delete all entries of an Express entity by tricking an authenticated administrator into visiting an attacker-controlled page. The root flaw is that the delete_entries controller records a CSRF token mismatch but proceeds with the destructive operation anyway, making the protection entirely non-functional. The default Contact Express object ships with a fixed, predictable entity UUID, so attackers can target that data store without any prior dashboard access.
Missing CSRF token validation in Concrete CMS before 9.5.3 allows a remote attacker to trick an authenticated calendar editor into silently creating unwanted duplicate events. The vulnerable endpoint - the Calendar event duplicate dialog's submit() action in concrete/controllers/dialog/event/duplicate.php - enforced only object-level permissions (canAccess() and canAddCalendarEvent()) without verifying an anti-CSRF synchronizer token, meaning any forged cross-site request submitted on behalf of a legitimate session could produce spurious CalendarEvent and CalendarEventVersions database records. No public exploit or active exploitation has been identified; the vendor-assigned CVSS 4.0 score of 5.3 reflects the bounded, integrity-only impact.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Missing authorization in the block alias route of Concrete CMS 9.x through 9.5.2 allows an authenticated editor holding only a limited area-scoped add_block_to_area delegation to read and permanently destroy arbitrary block content across the entire site. The vulnerable method Process::alias() in concrete/controllers/backend/block/process.php accepts caller-supplied block IDs without verifying ownership over the source block or confirming it is genuinely orphaned on the caller's page, enabling cross-page content theft via duplication and forced silent deletion of the original. No active exploitation has been confirmed in CISA KEV and no public exploit code exists, but the attack is mechanically straightforward for any qualifying editor account.
Unauthorized group enumeration in Concrete CMS 9.2.0 through 9.5.2 exposes the full organizational group structure to any authenticated API user holding a groups:read token. The root cause is a permission-checker callback in the REST API Groups controller that unconditionally returns true, eliminating per-object (tree-node) authorization on the group collection endpoint. With authentication required and no public exploit identified, the practical blast radius is limited to insiders or compromised API accounts, but the disclosed group hierarchy can materially assist privilege-escalation reconnaissance on affected sites.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Missing ownership-check IDOR in AVideo through 29.0 allows an authenticated low-privilege user to recursively delete any category's on-disk asset directory (icons and images) regardless of ownership. The vulnerable endpoint `objects/categoryDeleteAssets.json.php` validates the CSRF nonce and the `canCreateCategory` capability but skips the `userCanEditCategory` ownership check enforced by the sibling delete handler, passing attacker-controlled category IDs directly to `Category::deleteAssets()`. No patched version was available at the time of advisory publication; exploitation requires the non-default `usersCanCreateNewCategories` site setting to be enabled.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
XML injection in WWBN AVideo's AD_Server plugin (`plugin/AD_Server/VMAP.php`) allows a remote unauthenticated attacker to inject arbitrary VMAP ad-break nodes into video ad playlist responses when the AD_Server plugin is enabled. When a victim opens a crafted VMAP URL or a video page referencing it, the player's IMA ad client follows the injected ad tag URIs, enabling attacker-controlled ad injection and cross-origin requests from the victim's playback session. The vulnerability was unfixed at time of reporting, and no public exploit has been identified.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.
Cross-site request forgery in Concrete CMS 9.x through 9.5.2 allows an unauthenticated attacker to forge board-content modifications on behalf of any authenticated user who holds board-edit permission. The saveTemplate() action in the Boards custom slot dialog controller omits anti-CSRF token validation, permitting a crafted HTTP request to write attacker-controlled slot and template data to a board under the victim's authority. No public exploit has been identified at time of analysis, and the vendor has released version 9.5.3 as the fix.
Calendar event authorization in Concrete CMS 8.3.0-9.5.2 is bypassed because the event edit dialog validates the actor's permissions against a calendar identifier supplied in the HTTP request rather than the calendar that actually owns the targeted event occurrence. An authenticated user holding 'Add Event' rights on any single calendar can read and overwrite events across all other calendars in the installation, and delete individual event occurrences; publishing the injected version as the live-approved revision additionally requires approve_calendar_event workflow rights or an auto-approving workflow. Vendor-released patch is available in version 9.5.3; no public exploit has been identified at time of analysis.
NoSQL injection (CWE-943) in the MongoDB PHP Library's GridFS component allows a low-privileged authenticated user who can influence the file identifier parameter to achieve three distinct impacts: reading file content beyond the intended target, deleting all GridFS file chunks within a bucket (rendering stored files unrecoverable), or renaming an unintended file. The CVSS 4.0 vector (AT:P) confirms exploitation depends on the target application routing attacker-influenced input directly into GridFS operations without sanitization. No public exploit or CISA KEV listing has been identified at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
Cross-site request forgery in AVideo's default-enabled CustomizeUser plugin allows an unauthenticated remote attacker to forge the ExtraSubscribers count on any user channel by inducing a logged-in administrator to load a crafted page containing an img tag. The root cause is that the setSubscribers.json.php endpoint accepts state-mutating GET requests via the $_REQUEST superglobal without any CSRF token validation, because autoCSRFGuard() is scoped exclusively to POST requests and the mutation path bypasses ObjectYPT::save()/isUntrustedRequest() checks. No vendor-released patch was available at the time of reporting; the issue affects all AVideo commits through c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). No public exploit identified at time of analysis.
Reflected cross-site scripting in Rizwan17's PHP inventory-management-system allows remote unauthenticated attackers to inject arbitrary JavaScript into any user's browser via the unsanitized `msg` parameter on the login page (index.php). The project lacks versioning and the maintainer has not responded to the disclosure filed in GitHub issue #11; no fix exists. Exploit code has been published (CVSS 4.0 E:P), but real-world impact is capped by the requirement for victim interaction and the product's extremely narrow deployment footprint.
SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
SQL injection in Rizwan17's inventory-management-system PHP application exposes the update_record() function in includes/manage.php to unauthenticated remote exploitation via unsanitized parameters (update_category, cid, update_brand, update_product). Exploit code is publicly available per the CVSS 4.0 E:P modifier and a VulDB submission, though the project is a small hobby-tier GitHub application with negligible production footprint. The maintainer was notified via a GitHub issue but has not responded, and no patch exists.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated schema mutation in Open-Web-Analytics 1.9.x allows remote attackers to invoke the base.updatesApply action - which applies database schema migrations - without any authentication or CSRF protection. The root cause is an opt-in authorization model in checkCapabilityAndAuthenticateUser(): controllers that omit setRequiredCapability() bypass authentication entirely, leaving the schema-mutation endpoint reachable by anyone. No public exploit or KEV listing exists; a patched release is available at version 1.10.0 via confirmed upstream commit.
PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_edit.php, enabling arbitrary SQL query execution against the underlying database. The affected product is a PHP-based open-source educational web application distributed via itsourcecode.com. Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been recorded, consistent with the product's limited real-world deployment footprint.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
Reflected XSS in AppNitro MachForm v30 allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the filter[filters][0][field] parameter of the grid_datasource.php component and socially engineering the victim into following the crafted URL. The vulnerability requires user interaction but no authentication (CVSS PR:N, UI:R), enabling session hijacking, credential theft, or forced browser actions against authenticated MachForm users. Publicly available exploit code exists via a GitHub PoC repository and a PacketStorm Security entry; however, the EPSS score of 0.24% (15th percentile) indicates low observed exploitation activity at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `id` parameter in `/delete_subject.php` to execute arbitrary SQL queries against the backend database. The vulnerability requires no authentication or user interaction, and a public exploit has been released via a GitHub vulnerability report. Internet-exposed deployments face immediate risk of database enumeration, credential theft, and academic record manipulation.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).
Improper privilege assignment in PHPGurukul Bank Locker Management System 1.0 allows remote authenticated attackers to bypass access controls by manipulating the `UserType` parameter in `sidebar.php`. The server fails to validate the supplied privilege level against the authenticated session, permitting lateral or vertical privilege escalation within the application. A public proof-of-concept exploit has been released per the VulDB disclosure, though the CVSS 4.0 base score of 2.1 reflects limited actual impact across confidentiality, integrity, and availability dimensions.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Status parameter in /bilal/normal/save_stud.php. The vulnerability enables unauthorized data access, modification, and potential full database compromise through crafted HTTP requests. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising immediate exploitation risk for any exposed instances.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.
Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
SQL injection in LuxSoft LuxCal through version 5.3.4L allows unauthenticated remote attackers to extract data from the underlying database by sending crafted requests to two public-facing PHP endpoints: rssfeed.php and common/retrieve.php. The vulnerability is reachable without authentication, as RSS and data-retrieval endpoints are typically exposed to anonymous visitors. A researcher has published proof-of-concept details, making exploitation straightforward for any attacker with network access to a LuxCal instance. No public exploit identified at time of analysis beyond the researcher disclosure.
Private playlist schedule metadata in WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) is exposed via missing ownership validation in the Playlists_schedules/list.json.php and Live/calendar.json.php PHP endpoints. Both unauthenticated requesters and low-privilege users holding canStream rights can supply arbitrary playlist identifiers to retrieve private schedule names, descriptions, timestamps, and playlist identifiers with no ownership verification performed server-side. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; real-world impact is bounded by the read-only, metadata-only nature of the disclosure.
Missing authorization in the PlayerSkins mediaSession.json.php endpoint of WWBN AVideo exposes protected video metadata to unauthenticated network attackers. By supplying a video ID parameter to this endpoint, any remote attacker can retrieve the title and owner email address of password-protected videos without providing credentials, defeating the access-control intent of password protection. No public exploit or KEV listing is identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects a narrowly scoped confidentiality impact limited to metadata rather than video content.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposes password-protected video metadata to anonymous remote attackers via a missing authorization check on the videosAndroid.json.php endpoint. Any unauthenticated guest can retrieve sensitive owner data - including email addresses, last login timestamps, filenames, and hashIds - with a trivial GET request, bypassing the password-protection intent entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication, zero-complexity attack surface makes opportunistic mass harvesting straightforward.
Missing authorization in WWBN AVideo's ImageGallery list.json.php endpoint allows unauthenticated attackers to enumerate password-protected gallery file listings and retrieve the exposed image files directly without credentials. All AVideo installations through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected when the ImageGallery plugin is active. No public exploit code or active exploitation has been identified at time of analysis, though the attack requires no technical sophistication and is trivially automatable.
Missing authorization in WWBN AVideo's Bookmark plugin exposes chapter names from password-protected videos to unauthenticated network attackers. The `getBookmarks.json.php` PHP endpoint accepts a video ID parameter and returns bookmark/chapter metadata without verifying that the requester holds the video password or any session credential, bypassing the password-protection model entirely for this data class. Exploitation is trivial given network access and a valid video ID; no KEV listing or public POC exists at time of analysis.
Missing authorization in AVideo's like.json.php endpoint allows any authenticated user to submit like interactions on password-protected or group-restricted videos they are not permitted to watch. The like counter for access-controlled content is incremented without the server verifying the requesting user's view permission, constituting a CWE-862 integrity bypass affecting all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1. No public exploit code has been identified at time of analysis, and real-world impact is bounded to engagement metric manipulation rather than content disclosure.
Missing authorization in WWBN AVideo's commentAddNew.json.php endpoint permits authenticated users to post comments on password-protected and group-restricted videos regardless of whether they can access the content. The flaw affects all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1 of the self-hosted PHP video platform. An attacker holding any valid session can submit crafted POST requests to pollute comment threads on restricted videos, defeating both password and group-membership access controls without gaining actual view access to the content.
Missing authorization in WWBN AVideo's videoAddViewCount.json.php endpoint allows authenticated users to manipulate view counts and watch-time statistics on videos they are not permitted to access. Affected versions span all commits through c3edcc274c389816d434acadac07ee78eaf330c1 of the WWBN AVideo open-source PHP video platform. An attacker with any valid account can submit crafted requests with arbitrary video IDs to inflate engagement metrics on restricted or private content, undermining the integrity of access-controlled video libraries. No public exploit code or active exploitation has been identified at time of analysis.
Missing authentication in WWBN AVideo's Live plugin allows unauthenticated remote attackers to inject arbitrary socket notification messages to any administrator whose live stream key is known. The endpoint `/plugin/Live/socketMessageLiveOwner.json.php` validates that the stream *owner* holds admin privileges but performs no caller authentication (`User::isLogged()` is never invoked) and enforces no CSRF token, meaning the caller-identity check is entirely absent. No patch was available at time of publication; VulnCheck reported the issue against commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier.
Missing authorization in WWBN AVideo's remindMe.json.php endpoint allows authenticated users to create scheduler reminders for private live schedules they are not permitted to view. The generated email job leaks the private schedule's title back to the attacker, constituting an information disclosure via IDOR (CWE-639). Affected through commit c3edcc274c389816d434acadac07ee78eaf330c1 with no specific patched version confirmed at time of analysis; no public exploit code or CISA KEV entry exists.
Unauthenticated information disclosure in WWBN AVideo exposes internal menu configuration data via the plugin/TopMenu/menus.json.php endpoint, which lacks any authentication check. Remote unauthenticated attackers can send a plain GET request to retrieve all menu data, including names of admin-only and inactive menus that are intentionally hidden from the public navbar. No public exploit or active exploitation has been identified, but the endpoint requires zero preconditions against any network-accessible AVideo instance through the affected commit.
Missing authorization in WWBN AVideo's playListAddVideo.json.php endpoint allows authenticated users to add password-protected videos to their own playlists without possessing the watch permissions those videos require. The flaw, identified through commit c3edcc274c389816d434acadac07ee78eaf330c1, stems from the server trusting submitted video and playlist IDs without verifying whether the requesting user is authorized to access the referenced video content. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in WWBN AVideo through commit c3edcc274c exposes inactive admin menu items and embedded secret query parameters via the unprotected `plugin/TopMenu/menuItems.json.php` PHP endpoint. Any network-reachable attacker can POST a `menuId` parameter to retrieve admin-tool URLs that are hidden from the public navbar, including secret tokens or keys embedded directly in those URLs. While the direct impact is limited confidentiality exposure (CVSS 4.0 VC:L), the leaked secret query parameters represent a stepping stone that could enable follow-on attacks against otherwise-obscured admin functionality. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo exposes private playlist data for any user when an attacker supplies a target's user identifier to the playlistsFromUser.json.php endpoint. The root flaw is improper cache keying that fails to scope responses to the requesting user's session, allowing Favorite and Watch Later playlists to leak across user contexts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization in Shopper Framework's Livewire Media component (`Media.store()`) allows any authenticated staff user holding only `browse_products` to overwrite product thumbnail and gallery images without the required `edit_products` permission. This is an incomplete fix: the prior patch for GHSA-h4mp-g9c6-xwph (commit fcd0c59) added `#[Locked]` to the `$product` property but omitted the `authorize()` call present in the five sibling components it did repair (Edit, Inventory, Seo, Shipping, Files). A fully functional proof-of-concept is included in the advisory; vendor-released patch is version 2.9.2. No public exploit identifier at time of analysis beyond the advisory PoC.
Missing server-side authorization (CWE-862) in four Livewire Settings components of Shopper Framework allows any authenticated staff user holding only the coarse `access_setting` permission to invoke destructive delete/edit actions - permanently removing shipping zones, carrier options, tax zones, and tax rates - without holding any `delete_*` or `edit_*` permission. The parent Filament page authorizes `access_setting` but child Livewire components handle their own `/livewire/update` HTTP requests independently and carry zero `->authorize()` calls, creating a privilege boundary gap. A working proof-of-concept validated against the real Livewire/Filament code path is included in the GHSA advisory, confirming low-sophistication exploitation; the fix is available in shopper/framework 2.9.2.
Shopper Framework versions prior to 2.9.0 permit authenticated administrators to create fixed-amount discount records with negative values through the /cpanel/discounts control panel, bypassing all server-side validation. The malformed values persist to the sh_discounts database table and flow unchecked through DiscountCalculator.php, where PHP's min() built-in lacks a lower-bound guard; a negative discount (e.g., -$99,999,999) causes the subtraction in Calculate.php to inflate rather than reduce order totals (subtotal 10,000 − discount −5,000 = 15,000). No public exploit code or CISA KEV listing exists; the issue is fixed in version 2.9.0.
CSRF in Concrete CMS 9.5.2 and below allows a remote unauthenticated attacker to permanently delete all entries of an Express entity by tricking an authenticated administrator into visiting an attacker-controlled page. The root flaw is that the delete_entries controller records a CSRF token mismatch but proceeds with the destructive operation anyway, making the protection entirely non-functional. The default Contact Express object ships with a fixed, predictable entity UUID, so attackers can target that data store without any prior dashboard access.
Missing CSRF token validation in Concrete CMS before 9.5.3 allows a remote attacker to trick an authenticated calendar editor into silently creating unwanted duplicate events. The vulnerable endpoint - the Calendar event duplicate dialog's submit() action in concrete/controllers/dialog/event/duplicate.php - enforced only object-level permissions (canAccess() and canAddCalendarEvent()) without verifying an anti-CSRF synchronizer token, meaning any forged cross-site request submitted on behalf of a legitimate session could produce spurious CalendarEvent and CalendarEventVersions database records. No public exploit or active exploitation has been identified; the vendor-assigned CVSS 4.0 score of 5.3 reflects the bounded, integrity-only impact.
Server-Side Template Injection in Concrete CMS 9 through 9.5.2 allows a privileged user holding the Theme Customization permission to inject arbitrary LESS directives into style values processed by the server-side LESS compiler. By crafting an @import (inline) directive within color, font, or image style fields, the attacker can read arbitrary files from the server filesystem and reach internal network resources via PHP stream wrappers, with the compiled output - including any exfiltrated file contents - written directly to the publicly accessible CSS cache. This combination of sensitive file disclosure and SSRF enables credential theft and further lateral movement; no public exploit has been identified at time of analysis.
Missing authorization in the block alias route of Concrete CMS 9.x through 9.5.2 allows an authenticated editor holding only a limited area-scoped add_block_to_area delegation to read and permanently destroy arbitrary block content across the entire site. The vulnerable method Process::alias() in concrete/controllers/backend/block/process.php accepts caller-supplied block IDs without verifying ownership over the source block or confirming it is genuinely orphaned on the caller's page, enabling cross-page content theft via duplication and forced silent deletion of the original. No active exploitation has been confirmed in CISA KEV and no public exploit code exists, but the attack is mechanically straightforward for any qualifying editor account.
Unauthorized group enumeration in Concrete CMS 9.2.0 through 9.5.2 exposes the full organizational group structure to any authenticated API user holding a groups:read token. The root cause is a permission-checker callback in the REST API Groups controller that unconditionally returns true, eliminating per-object (tree-node) authorization on the group collection endpoint. With authentication required and no public exploit identified, the practical blast radius is limited to insiders or compromised API accounts, but the disclosed group hierarchy can materially assist privilege-escalation reconnaissance on affected sites.
Authenticated SQL injection in GamiPress ≤7.9.7 allows a Subscriber-level WordPress user to exfiltrate the entire site database through a boolean-based blind injection channel in the wpForo integration AJAX handler. The flaw exploits a subtle interaction between WordPress core magic-quote processing and MySQL backslash semantics: `$wpdb->esc_like()` is called after magic quotes have already escaped a single quote to `\'`, producing `\\'` — which MySQL parses as one literal backslash plus a live closing quote, escaping the LIKE string context. No public exploit or CISA KEV listing has been identified at time of analysis, but Wordfence has confirmed the vulnerability with direct source-code references.
Missing ownership-check IDOR in AVideo through 29.0 allows an authenticated low-privilege user to recursively delete any category's on-disk asset directory (icons and images) regardless of ownership. The vulnerable endpoint `objects/categoryDeleteAssets.json.php` validates the CSRF nonce and the `canCreateCategory` capability but skips the `userCanEditCategory` ownership check enforced by the sibling delete handler, passing attacker-controlled category IDs directly to `Category::deleteAssets()`. No patched version was available at the time of advisory publication; exploitation requires the non-default `usersCanCreateNewCategories` site setting to be enabled.
Unauthenticated information disclosure in AVideo's WebRTC plugin exposes sensitive server-side configuration data to any remote user. When the WebRTC plugin is installed, the `/plugin/WebRTC/status.json.php` endpoint responds with the absolute filesystem path of the WebRTC2RTMP binary (revealing document-root layout), the configured WebRTC port, binary existence and executability status, WebRTC log file contents, and TCP reachability results for both loopback and the public address. The endpoint performs no authentication or authorization check of any kind, and no vendor patch had been released at the time of reporting.
XML injection in WWBN AVideo's AD_Server plugin (`plugin/AD_Server/VMAP.php`) allows a remote unauthenticated attacker to inject arbitrary VMAP ad-break nodes into video ad playlist responses when the AD_Server plugin is enabled. When a victim opens a crafted VMAP URL or a video page referencing it, the player's IMA ad client follows the injected ad tag URIs, enabling attacker-controlled ad injection and cross-origin requests from the victim's playback session. The vulnerability was unfixed at time of reporting, and no public exploit has been identified.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Server-side request forgery in WWBN AVideo's login endpoint enables unauthenticated remote attackers to read arbitrary local files or probe internal services by supplying crafted file paths or HTTP URLs to login.json.php. The vulnerability resides in the _json_decode function, which fetches attacker-supplied URLs and local paths without SSRF validation; the fetched content is then parsed as login credentials, creating an unusual secondary attack surface for potential authentication bypass against internal services that return predictable responses. Affected versions span all releases through commit c3edcc274c389816d434acadac07ee78eaf330c1, with no public exploit code identified at time of analysis.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
Unauthenticated order enumeration via IDOR in Woo PDF Invoice Builder (also marketed as PDF Builder for WooCommerce) for WordPress exposes every WooCommerce order on affected stores to any logged-in user with Subscriber-level access or higher. The InspectOrder() AJAX handler registered on wp_ajax_rednao_wcpdfinv_inspect_order performs no capability check and no nonce verification before accepting an attacker-supplied OrderNumber POST parameter, loading the matching WC_Order object, and serializing its complete data-billing and shipping addresses, customer email and phone, payment method, gateway transaction ID, and order totals-to the response. All plugin versions through 2.0.8 are affected; no public exploit or CISA KEV listing has been confirmed at time of analysis.
Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.
Cross-site request forgery in Concrete CMS 9.x through 9.5.2 allows an unauthenticated attacker to forge board-content modifications on behalf of any authenticated user who holds board-edit permission. The saveTemplate() action in the Boards custom slot dialog controller omits anti-CSRF token validation, permitting a crafted HTTP request to write attacker-controlled slot and template data to a board under the victim's authority. No public exploit has been identified at time of analysis, and the vendor has released version 9.5.3 as the fix.
Calendar event authorization in Concrete CMS 8.3.0-9.5.2 is bypassed because the event edit dialog validates the actor's permissions against a calendar identifier supplied in the HTTP request rather than the calendar that actually owns the targeted event occurrence. An authenticated user holding 'Add Event' rights on any single calendar can read and overwrite events across all other calendars in the installation, and delete individual event occurrences; publishing the injected version as the live-approved revision additionally requires approve_calendar_event workflow rights or an auto-approving workflow. Vendor-released patch is available in version 9.5.3; no public exploit has been identified at time of analysis.
NoSQL injection (CWE-943) in the MongoDB PHP Library's GridFS component allows a low-privileged authenticated user who can influence the file identifier parameter to achieve three distinct impacts: reading file content beyond the intended target, deleting all GridFS file chunks within a bucket (rendering stored files unrecoverable), or renaming an unintended file. The CVSS 4.0 vector (AT:P) confirms exploitation depends on the target application routing attacker-influenced input directly into GridFS operations without sanitization. No public exploit or CISA KEV listing has been identified at time of analysis.
Header aliasing in Traefik's reverse proxy middleware allows a low-privilege authenticated user to smuggle dot-form header aliases (e.g., X.Authenticated.User) past ForwardAuth and other security middleware, causing CGI, WSGI, PHP, or NGINX backends to read the attacker-supplied value instead of the identity Traefik asserted. In tested PHP 8.2 SAPI over HTTP/1, Go's lexical header ordering makes the attacker-supplied value win deterministically, enabling privilege escalation to any role or user identity the backend trusts via headers. This is an incomplete fix for GHSA-x677-9fxg-v5c5, which previously blocked only the underscore form; fixes exist in v2.11.56 and v3.7.12 but require explicit opt-in configuration to take effect. No public exploit or CISA KEV listing identified at time of analysis.
Cross-site request forgery in AVideo's default-enabled CustomizeUser plugin allows an unauthenticated remote attacker to forge the ExtraSubscribers count on any user channel by inducing a logged-in administrator to load a crafted page containing an img tag. The root cause is that the setSubscribers.json.php endpoint accepts state-mutating GET requests via the $_REQUEST superglobal without any CSRF token validation, because autoCSRFGuard() is scoped exclusively to POST requests and the mutation path bypasses ObjectYPT::save()/isUntrustedRequest() checks. No vendor-released patch was available at the time of reporting; the issue affects all AVideo commits through c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23). No public exploit identified at time of analysis.
Reflected cross-site scripting in Rizwan17's PHP inventory-management-system allows remote unauthenticated attackers to inject arbitrary JavaScript into any user's browser via the unsanitized `msg` parameter on the login page (index.php). The project lacks versioning and the maintainer has not responded to the disclosure filed in GitHub issue #11; no fix exists. Exploit code has been published (CVSS 4.0 E:P), but real-world impact is capped by the requirement for victim interaction and the product's extremely narrow deployment footprint.
SQL injection in Rizwan17's inventory-management-system allows unauthenticated remote attackers to manipulate database queries via the `pro_name[]` array parameter in the `storeCustomerOrderInvoice` function of `includes/manage.php`. The CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms no authentication is required and exploitation is straightforward. A public proof-of-concept exists via GitHub issue #13, and the vendor has not responded to the disclosure, leaving no patch available.
Missing authentication on the Invoice Generation endpoint in Rizwan17's inventory-management-system (PHP, all commits through bfe78a33) allows unauthenticated remote attackers to manipulate the `order_date` and `invoice_no` parameters in `includes/invoice_bill.php` without any credential check (CWE-306). The CVSS 4.0 vector confirms PR:N/UI:N exploitation with low integrity and availability impact and no confidentiality exposure. A public proof-of-concept has been disclosed via GitHub issue #14, and the project maintainer has not yet responded to the report, leaving no patch available at time of analysis.
Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
SQL injection in Rizwan17's inventory-management-system PHP application exposes the update_record() function in includes/manage.php to unauthenticated remote exploitation via unsanitized parameters (update_category, cid, update_brand, update_product). Exploit code is publicly available per the CVSS 4.0 E:P modifier and a VulDB submission, though the project is a small hobby-tier GitHub application with negligible production footprint. The maintainer was notified via a GitHub issue but has not responded, and no patch exists.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated schema mutation in Open-Web-Analytics 1.9.x allows remote attackers to invoke the base.updatesApply action - which applies database schema migrations - without any authentication or CSRF protection. The root cause is an opt-in authorization model in checkCapabilityAndAuthenticateUser(): controllers that omit setRequiredCapability() bypass authentication entirely, leaving the schema-mutation endpoint reachable by anyone. No public exploit or KEV listing exists; a patched release is available at version 1.10.0 via confirmed upstream commit.
PHP code injection in Okta Access Gateway (all versions prior to 2026.9.1) allows an authenticated administrator to execute arbitrary code as the web server process by embedding malicious PHP payloads in dashboard application label values. The gateway writes these labels unsanitized into generated PHP configuration files, which are automatically included on every subsequent authentication request, triggering execution without further interaction. No public exploit has been identified at time of analysis; vendor-released patch is available at version 2026.9.1.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_edit.php, enabling arbitrary SQL query execution against the underlying database. The affected product is a PHP-based open-source educational web application distributed via itsourcecode.com. Publicly available exploit code exists (CVSS 4.0 E:P), though no active exploitation or KEV listing has been recorded, consistent with the product's limited real-world deployment footprint.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
Hard-coded database credentials in ningzichun Student Management System expose MySQL connection secrets in the publicly accessible GitHub repository, allowing any attacker who reads the source to authenticate directly to the backend database. The vulnerability resides in config/database.php where mysqli_connect() is called with literal credential strings (CWE-259), affecting all commits up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Publicly available exploit code exists (E:P per the CVSS 4.0 supplemental); the project maintainer has not responded to the responsible disclosure issue.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Authentication bypass in aircheng-org iWebShop-5 (all versions 5.0-5.15) allows unauthenticated remote attackers to access the seller management panel by manipulating the `Name` parameter in the `Login` function of `controllers/systemseller.php`. A public exploit exists (referenced via GitHub issue #6), and SSVC confirms automatable exploitation with partial technical impact. The vendor has not responded to responsible disclosure, and no patch is available.
Remote code execution in InstantCMS prior to 2.18.2 allows authenticated administrators to execute arbitrary PHP code by abusing the component installer's file upload functionality. The attacker uploads a crafted ZIP archive containing a PHP webshell alongside a custom .htaccess file that overrides the upload directory's default PHP execution prohibition, causing the uploaded PHP files to become executable via direct HTTP request. The vulnerability requires admin-level authentication (PR:H per CVSS), significantly limiting exposure, but full server-side code execution is achievable post-exploitation. No public exploit code has been identified at time of analysis.
Server-Side Request Forgery in InstantCMS versions prior to 2.18.2 allows authenticated users to probe internal network services by exploiting a redirect-bypass flaw in the 'upload from URL' feature. The uploader validates the initial URL against a private IP blacklist, but when the remote server issues an HTTP redirect, the redirected target URL is followed without re-validation, allowing the blacklist to be bypassed entirely. An attacker with any authenticated account can use this to map and interact with internal services not exposed to the public internet. No public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Cross-site request forgery in WWBN AVideo's CustomizeUser plugin allows an unauthenticated attacker to cause an authenticated administrator to lose administrative access. The `swapUser.json.php` endpoint accepts `users_id` via GET requests without CSRF token validation - the global `autoCSRFGuard()` guard is only applied to POST requests - meaning an img tag or crafted link embedded on any attacker-controlled page can silently invoke `User::swapUser()` in the context of a logged-in admin's browser session. Additionally, the JSON response leaks the target user's `session_id`, adding a secondary information disclosure impact. No patch was available at time of publication and the vulnerable plugin is enabled by default.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
Reflected XSS in AppNitro MachForm v30 allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the filter[filters][0][field] parameter of the grid_datasource.php component and socially engineering the victim into following the crafted URL. The vulnerability requires user interaction but no authentication (CVSS PR:N, UI:R), enabling session hijacking, credential theft, or forced browser actions against authenticated MachForm users. Publicly available exploit code exists via a GitHub PoC repository and a PacketStorm Security entry; however, the EPSS score of 0.24% (15th percentile) indicates low observed exploitation activity at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to manipulate the `id` parameter in `/delete_subject.php` to execute arbitrary SQL queries against the backend database. The vulnerability requires no authentication or user interaction, and a public exploit has been released via a GitHub vulnerability report. Internet-exposed deployments face immediate risk of database enumeration, credential theft, and academic record manipulation.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.