PHP
Monthly
Path traversal in Veno File Manager 4.4.9 exposes arbitrary server files to authenticated super administrators via two crafted HTTP requests targeting /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. The vulnerability allows directory escape through unsanitized path parameters, enabling disclosure of sensitive files such as configuration files, credentials, or system data accessible to the web server process. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37066), and no public exploit has been confirmed as actively exploited per CISA KEV.
Unauthorized file access in Veno File Manager 4.4.9 exposes any user-uploaded file to other authenticated users via the /vfm-admin/ajax/streamvid.php streaming endpoint, which applies no per-user authorization enforcement before returning file content. An attacker holding a valid account on the same instance can craft a GET request to retrieve files belonging to any other user, provided the target file's path and filename are known. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37070; no active exploitation is confirmed by CISA KEV.
Unauthenticated SMTP abuse in Veno File Manager 4.4.9 exposes the `/vfm-admin/ajax/sendfiles.php` endpoint without any access control, allowing any remote attacker to send arbitrary emails through the application's pre-configured SMTP server. By submitting a crafted POST request with the appropriate parameters, an attacker can impersonate the legitimate server's email identity without knowing SMTP credentials - enabling spam delivery, phishing, or targeted social engineering from a trusted domain. No CISA KEV listing exists and EPSS is 0.16% (6th percentile), but a public proof-of-concept repository on GitHub lowers the exploitation barrier.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin login endpoint to unauthenticated remote exploitation via the email parameter in /admin/ajax.php?action=login2. The flaw allows attackers to manipulate SQL queries sent to the backend database, enabling authentication bypass and potential data exfiltration or modification. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing is present, but the exploit's public availability materially lowers the barrier to exploitation.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
HTML injection in OpenSTAManager versions 2.10.1 and earlier allows an authenticated high-privilege user to embed arbitrary HTML - including redirect anchor tags - into the user group name field, which is then rendered unsanitized to all users who view the group assignment interface in modules/utenti/edit.php. The attack enables phishing and open-redirect scenarios targeting other application users without requiring any special server configuration. Publicly available exploit code exists (documented in GHSA-crx4-7mmq-j74j with screenshots); this CVE is not in CISA KEV, and EPSS data was not provided.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.
SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).
Broken access control in GazellePW's IP lock manager allows any authenticated user to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock, bypassing per-account authorization checks. A public write-up at snaacky.com describes this flaw as part of a 1-click exploit chain enabling complete GazellePW database compromise, substantially elevating its effective impact beyond the standalone CVSS 5.4 score. No CISA KEV listing exists, but the public chain write-up makes this an urgent remediation priority for any GazellePW operator.
Stored XSS in GazellePW (GazellePosterWall) allows authenticated low-privilege users to inject persistent JavaScript via a crafted subtitle filename, which is stored during upload and rendered unsanitized in the subtitle deletion page. A public exploit writeup (snaacky.com) documents a 1-click chain leveraging this flaw to achieve complete GazellePW database compromise, substantially elevating the practical impact beyond the CVSS 5.4 Medium base score. No public exploit confirmation via CISA KEV exists, but the availability of a detailed public exploit chain warrants prioritized remediation on any instance where untrusted authenticated users can upload subtitles.
Stored XSS in GazellePW's forum reward comment system allows network-accessible attackers to inject persistent JavaScript payloads into the `data-tooltip` attribute of forum thread views, which Tooltipster then renders as live HTML in victims' browsers. The vulnerable endpoint is `/forums.php?action=ajax_get_jf` (parameter `c`), confirmed at commit 86c4bedf727691b5a97af42a4864869d18446449 of the Mosasauroidea repository. A publicly referenced write-up claims this can be chained for complete GazellePW database compromise, though that escalation path has not been independently verified or confirmed by CISA KEV.
Stored cross-site scripting in GazellePW's custom bonus title feature allows authenticated users with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users - including administrators - who view bonus management pages. Affected is a specific commit (86c4bedf) of the GazellePosterWall PHP application. A public exploit writeup at snaacky.com describes a 1-click chain leveraging this and related issues to achieve complete database compromise, significantly elevating real-world impact beyond the base CVSS score of 5.4. No public KEV listing; EPSS is low at 0.29%, but the published exploit chain warrants elevated attention for any operator of this software.
SQL injection in GazellePW's country-code lookup endpoint exposes authenticated operators to arbitrary database reads via the unsanitized `ip` parameter in requests to `tools.php?action=get_cc`. The CVSS-rated confidentiality impact of C:L is likely understated - a publicly referenced blog post titled '1-click exploit chain for complete GazellePW database compromise' indicates full database exfiltration is achievable. No public exploit identified as confirmed CISA KEV, but exploit chain documentation exists, elevating practical risk for private torrent tracker operators running this codebase.
SQL injection in GazellePW's tags manager endpoint allows remote authenticated users holding moderator-level (users_mod) privileges to execute arbitrary SQL commands against the underlying database. The vulnerability resides in the tagid and type parameters passed via POST to tools.php?action=manage_tags at a specific commit (86c4bedf). A publicly documented exploit chain exists at snaacky.com that claims full database compromise, suggesting the official CVSS impact metrics (C:L/I:L) materially understate real-world severity. No public KEV listing; EPSS is low at 0.28% (20th percentile), consistent with the privilege barrier limiting opportunistic exploitation.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.
Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.
Stored XSS in Horde IMP's AppleDouble MIME viewer (all versions before 7.2.0) allows any email sender to execute arbitrary JavaScript in a recipient's browser session when they view a crafted message. No account on the target system is required - only the ability to deliver mail - and because the payload persists in the mailbox it can re-execute on every subsequent view. A publicly available exploit exists, and the researcher documents a chained escalation path combining this flaw with CVE-2026-58451 that reaches application code execution when triggered in an IMP administrator's session.
Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
SQL injection in itsourcecode Payroll System 1.0 exposes the pre-authentication login endpoint to unauthenticated remote attackers via the Username parameter handled by admin_class.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction network exploitation with no prerequisites, and the E:P modifier confirms a public proof-of-concept exploit has been disclosed, lowering the skill bar for exploitation. Partial confidentiality, integrity, and availability impact is assessed (VC:L/VI:L/VA:L), consistent with an attacker being able to manipulate or extract payroll database records but not achieve full system takeover.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/view_prod.php` endpoint to remote unauthenticated database manipulation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network exploitation with no prerequisites, yielding partial confidentiality, integrity, and availability impact against the backend database. A public proof-of-concept exploit is available on GitHub (referenced via VulDB), though the product's extremely narrow deployment footprint as a SourceCodester tutorial application limits real-world blast radius significantly.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin AJAX endpoint /fos/admin/ajax.php?action=save_user to remote database manipulation via an unsanitized Username parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated network exploitation with no user interaction required, meaning any internet-facing instance is trivially reachable. Publicly available exploit code exists (E:P confirmed in supplemental CVSS vector and referenced GitHub issue), though this vulnerability has not been added to the CISA KEV catalog at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=add_to_cart` endpoint to unauthenticated remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (PR:N) confirms no authentication is required despite the admin path, and a public exploit has been disclosed via GitHub. The CIA impact is rated limited across all three dimensions, consistent with a read/write SQL injection that does not achieve full system compromise.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.
Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.
SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface.
Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.
Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.
Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.
Email enumeration in AVideo's RSS feed endpoint (feed/index.php) allows unauthenticated remote attackers to harvest channel owner email addresses across all versions through commit 9c39d8c8. By iterating through public channel names, attackers can systematically extract creator PII from the itunes:email and itunes:author elements of the platform's podcast-compatible RSS output. No public exploit has been identified at time of analysis, but the trivial exploitation path - a standard HTTP GET request requiring no credentials - substantially elevates downstream risk of phishing campaigns and credential-stuffing attacks targeting identified creators.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Unauthorized document access in Combodo iTop before version 3.2.3 allows any authenticated user to retrieve documents and attachments belonging to organizations or objects they lack permission to view. The root cause is a logic inversion in the PHP DownloadDocument method: a host-object rights check could silently pass due to incorrect boolean handling, bypassing the intended access control gate entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS PR:L vector confirms exploitation requires only a valid low-privileged account.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.
Authenticated path traversal in Winter CMS's LESS compilation pipeline allows backend users holding any of four specific permissions to exfiltrate arbitrary files readable by the PHP process - most critically the application .env file containing APP_KEY and database credentials. The vulnerability affects Winter CMS versions through 1.2.12 via four injection sinks: Brand Settings, Editor Settings, Mail Brand Settings colour fields, and theme CSS assets compiled by CombineAssets. No public exploit identified at time of analysis and no active exploitation confirmed, but confidentiality impact is high given .env disclosure enables full application key compromise.
Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.
Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.
Stored XSS and arbitrary file upload in Laravel Backpack CRUD allows an authenticated admin to bypass the `SingleBase64Image` uploader's trivial `data:image` prefix check, writing files of any MIME type - including SVG with embedded JavaScript - to the configured storage disk. A companion bug in `FileNameGenerator` causes stored files to receive extensionless names because `mime_content_type()` returns false when passed a data URI string rather than a filesystem path, compounding server-side MIME enforcement failures. Affected versions span 6.0.0-6.8.13 and 7.0.0-7.0.37; vendor-released patches 6.8.14 and 7.0.38 address both flaws. No public exploit code or CISA KEV listing was identified at time of analysis.
Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside `HasUploadFields` and `FileNameGenerator`. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the `public` disk with `storage:link` is in use and no explicit `mimes:` or `mimetypes:` Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. No public exploit code has been identified and no CISA KEV listing is present at time of analysis; vendor-confirmed patches are available in releases 6.8.14 and 7.0.38.
SQL injection in itsourcecode Hospital Management System 1.0 permits authenticated low-privilege users to manipulate database queries through the `delid` parameter of `/viewappointmentpending.php`, potentially exposing or corrupting patient appointment records. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid application account, narrowing the realistic attack surface despite network reachability. Publicly available exploit code (confirmed by E:P in the CVSS 4.0 vector) exists, modestly elevating practical risk; however, no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis.
SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L).
SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application.
Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_category` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to read or modify the underlying database. The CVSS 4.0 vector confirms no authentication, no user interaction, and no special conditions are required to exploit the flaw. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks against any internet-facing deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/view_order.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no user interaction required. A public exploit has been released - referenced via GitHub and VulDB - materially raising near-term opportunistic exploitation risk despite the moderate overall score.
Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.
Reflected XSS in ATutor 2.2.4's preview.php enables an authenticated attacker to inject arbitrary JavaScript into a victim's browser session by manipulating the popup URL parameter. The frameset rendered by preview.php does not sanitize the popup parameter, allowing an attacker to break out of the HTML attribute context and append an event handler such as onload, even though the child frame file preview_top.php does apply sanitization. No patch exists and no patch is planned, as ATutor is no longer actively maintained; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in ATutor's import functionalities allows an authenticated administrator to coerce the server into issuing HTTP requests to arbitrary internal endpoints, cloud metadata services such as AWS IMDSv1, or local filesystem paths via the file:// URI scheme where PHP URL wrappers are enabled. Only version 2.2.4 has been confirmed vulnerable by CERT.pl researchers; the product is end-of-life with no planned fix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of cloud metadata reachability and EOL status makes compensating controls the only available path.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.
SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.
SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.
SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.
Unauthenticated SQL injection in code-projects Hospital Information System 1.0 exposes the login endpoint to remote database manipulation via the unsanitized `email` parameter in `UsersController.php`. The flaw allows network-accessible attackers to alter authentication query logic, potentially bypassing login controls or extracting sensitive records such as patient data and credentials. No CISA KEV listing exists, but a published proof-of-concept exploit is referenced in the intelligence feed, materially lowering the barrier to exploitation.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.
Path traversal in Veno File Manager 4.4.9 exposes arbitrary server files to authenticated super administrators via two crafted HTTP requests targeting /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php. The vulnerability allows directory escape through unsanitized path parameters, enabling disclosure of sensitive files such as configuration files, credentials, or system data accessible to the web server process. A public proof-of-concept repository exists on GitHub (jfs-jfs/CVE-2026-37066), and no public exploit has been confirmed as actively exploited per CISA KEV.
Unauthorized file access in Veno File Manager 4.4.9 exposes any user-uploaded file to other authenticated users via the /vfm-admin/ajax/streamvid.php streaming endpoint, which applies no per-user authorization enforcement before returning file content. An attacker holding a valid account on the same instance can craft a GET request to retrieve files belonging to any other user, provided the target file's path and filename are known. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37070; no active exploitation is confirmed by CISA KEV.
Unauthenticated SMTP abuse in Veno File Manager 4.4.9 exposes the `/vfm-admin/ajax/sendfiles.php` endpoint without any access control, allowing any remote attacker to send arbitrary emails through the application's pre-configured SMTP server. By submitting a crafted POST request with the appropriate parameters, an attacker can impersonate the legitimate server's email identity without knowing SMTP credentials - enabling spam delivery, phishing, or targeted social engineering from a trusted domain. No CISA KEV listing exists and EPSS is 0.16% (6th percentile), but a public proof-of-concept repository on GitHub lowers the exploitation barrier.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin login endpoint to unauthenticated remote exploitation via the email parameter in /admin/ajax.php?action=login2. The flaw allows attackers to manipulate SQL queries sent to the backend database, enabling authentication bypass and potential data exfiltration or modification. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing is present, but the exploit's public availability materially lowers the barrier to exploitation.
Unauthenticated remote access to the CRUD operation handler in itsourcecode Payroll System 1.0 allows any network-accessible attacker to create, read, update, or delete payroll records without credentials. The root cause is CWE-306 - the ajax.php endpoint processes the 'action' parameter and executes database operations without verifying caller identity. A public proof-of-concept exploit is available on GitHub, making exploitation trivially accessible to low-skill attackers against any internet-exposed deployment.
HTML injection in OpenSTAManager versions 2.10.1 and earlier allows an authenticated high-privilege user to embed arbitrary HTML - including redirect anchor tags - into the user group name field, which is then rendered unsanitized to all users who view the group assignment interface in modules/utenti/edit.php. The attack enables phishing and open-redirect scenarios targeting other application users without requiring any special server configuration. Publicly available exploit code exists (documented in GHSA-crx4-7mmq-j74j with screenshots); this CVE is not in CISA KEV, and EPSS data was not provided.
Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.
SQL injection in code-projects Simple Inventory System 1.0 exposes the /InventoryManagement/edit.php endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. An attacker with network access can inject arbitrary SQL into backend database queries, enabling unauthorized extraction and modification of all inventory records. Publicly available exploit code exists (CVSS 4.0 E:P), though no CISA KEV listing has been issued, suggesting opportunistic rather than targeted active exploitation at this time.
SQL injection in SililaWijesinghe's PHP-based Food Ordering System allows unauthenticated remote attackers to manipulate the search_box parameter in /search.php, causing the backend database to execute attacker-controlled SQL queries. A public proof-of-concept exploit has been disclosed via GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch available. The CVSS 4.0 vector confirms low-complexity, no-authentication remote exploitability with a confirmed proof-of-concept modifier (E:P).
Broken access control in GazellePW's IP lock manager allows any authenticated user to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock, bypassing per-account authorization checks. A public write-up at snaacky.com describes this flaw as part of a 1-click exploit chain enabling complete GazellePW database compromise, substantially elevating its effective impact beyond the standalone CVSS 5.4 score. No CISA KEV listing exists, but the public chain write-up makes this an urgent remediation priority for any GazellePW operator.
Stored XSS in GazellePW (GazellePosterWall) allows authenticated low-privilege users to inject persistent JavaScript via a crafted subtitle filename, which is stored during upload and rendered unsanitized in the subtitle deletion page. A public exploit writeup (snaacky.com) documents a 1-click chain leveraging this flaw to achieve complete GazellePW database compromise, substantially elevating the practical impact beyond the CVSS 5.4 Medium base score. No public exploit confirmation via CISA KEV exists, but the availability of a detailed public exploit chain warrants prioritized remediation on any instance where untrusted authenticated users can upload subtitles.
Stored XSS in GazellePW's forum reward comment system allows network-accessible attackers to inject persistent JavaScript payloads into the `data-tooltip` attribute of forum thread views, which Tooltipster then renders as live HTML in victims' browsers. The vulnerable endpoint is `/forums.php?action=ajax_get_jf` (parameter `c`), confirmed at commit 86c4bedf727691b5a97af42a4864869d18446449 of the Mosasauroidea repository. A publicly referenced write-up claims this can be chained for complete GazellePW database compromise, though that escalation path has not been independently verified or confirmed by CISA KEV.
Stored cross-site scripting in GazellePW's custom bonus title feature allows authenticated users with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users - including administrators - who view bonus management pages. Affected is a specific commit (86c4bedf) of the GazellePosterWall PHP application. A public exploit writeup at snaacky.com describes a 1-click chain leveraging this and related issues to achieve complete database compromise, significantly elevating real-world impact beyond the base CVSS score of 5.4. No public KEV listing; EPSS is low at 0.29%, but the published exploit chain warrants elevated attention for any operator of this software.
SQL injection in GazellePW's country-code lookup endpoint exposes authenticated operators to arbitrary database reads via the unsanitized `ip` parameter in requests to `tools.php?action=get_cc`. The CVSS-rated confidentiality impact of C:L is likely understated - a publicly referenced blog post titled '1-click exploit chain for complete GazellePW database compromise' indicates full database exfiltration is achievable. No public exploit identified as confirmed CISA KEV, but exploit chain documentation exists, elevating practical risk for private torrent tracker operators running this codebase.
SQL injection in GazellePW's tags manager endpoint allows remote authenticated users holding moderator-level (users_mod) privileges to execute arbitrary SQL commands against the underlying database. The vulnerability resides in the tagid and type parameters passed via POST to tools.php?action=manage_tags at a specific commit (86c4bedf). A publicly documented exploit chain exists at snaacky.com that claims full database compromise, suggesting the official CVSS impact metrics (C:L/I:L) materially understate real-world severity. No public KEV listing; EPSS is low at 0.28% (20th percentile), consistent with the privilege barrier limiting opportunistic exploitation.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Authorization bypass in the FundEngine WordPress donation and crowdfunding plugin (all versions through 1.8.1) allows authenticated subscribers to overwrite the title, body, and author field of any post or page on the affected site. The vulnerable handler in apps/content.php accepts an attacker-supplied post_author integer without verifying the caller's rights over the target post, and the wp_rest nonce that nominally gates the endpoint is freely retrievable by any logged-in user from /wp-admin/admin-ajax.php?action=rest-nonce, eliminating it as a meaningful access control. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal authentication requirement elevate real-world risk on sites that permit open subscriber registration.
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.
Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Path traversal in Faveo Helpdesk versions 2.0.0 through 2.0.3 enables remote authenticated administrators to delete arbitrary files on the server by manipulating the `data1` argument passed to PHP's `unlink()` function within the Logo Handler component (`SettingsController.php`). Exploitation is limited to accounts holding high privileges, constraining realistic impact despite network reachability. Publicly available exploit code exists via a GitHub issue report; the vendor has not responded to the disclosure as of time of analysis.
Unauthenticated actors can post ticket replies in Faveo Helpdesk versions 2.0.0 through 2.0.3 by sending crafted requests to the post-ticket-reply endpoint without valid session credentials. The flaw exists in FormController::post_ticket_reply (CWE-306), allowing manipulation of helpdesk communications and injection of fraudulent responses into active support tickets. A proof-of-concept exploit has been publicly published via a GitHub issue, though no vendor patch is available as the maintainers have not yet responded to the disclosure.
Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.
Stored XSS in Horde IMP's AppleDouble MIME viewer (all versions before 7.2.0) allows any email sender to execute arbitrary JavaScript in a recipient's browser session when they view a crafted message. No account on the target system is required - only the ability to deliver mail - and because the payload persists in the mailbox it can re-execute on every subsequent view. A publicly available exploit exists, and the researcher documents a chained escalation path combining this flaw with CVE-2026-58451 that reaches application code execution when triggered in an IMP administrator's session.
Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=confirm_order` endpoint to arbitrary database query manipulation via the unsanitized `ID` parameter. A public proof-of-concept exploit is available on GitHub, materially elevating exploitation risk beyond the base CVSS 4.0 score of 6.9, though no CISA KEV listing has been confirmed at time of analysis. Any internet-exposed deployment running this PHP application is at immediate risk of database enumeration and data exfiltration by unauthenticated remote attackers.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Real Estate Management System 1.0 exposes the search.php endpoint to remote unauthenticated database manipulation via the search, delivery_type, search_price, and property_type parameters. A public proof-of-concept exploit has been published on GitHub (issue #5, microwaveabi/vul), making this trivially accessible to low-skill attackers. CVSS 4.0 rates this 6.9 with low-level impact across confidentiality, integrity, and availability on the vulnerable system; no active exploitation by CISA KEV has been confirmed at time of analysis.
SQL injection in itsourcecode Payroll System 1.0 exposes the pre-authentication login endpoint to unauthenticated remote attackers via the Username parameter handled by admin_class.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction network exploitation with no prerequisites, and the E:P modifier confirms a public proof-of-concept exploit has been disclosed, lowering the skill bar for exploitation. Partial confidentiality, integrity, and availability impact is assessed (VC:L/VI:L/VA:L), consistent with an attacker being able to manipulate or extract payroll database records but not achieve full system takeover.
Unrestricted file upload in itsourcecode Payroll System 1.0 exposes the application to potential remote code execution through the save_settings function in admin_class.php, where the img parameter accepts files without validating type or content. The CVSS 4.0 vector indicates network-accessible exploitation with no privileges required (PR:N), meaning an attacker can submit a crafted multipart request to upload a PHP webshell directly. A public proof-of-concept exploit exists per the GitHub reference and VulDB reporting; this is not confirmed in CISA KEV, but the low barrier to exploitation combined with POC availability elevates real-world risk beyond the 6.9 score implies.
SQL injection in itsourcecode Library Management System 1.0 allows remote authenticated attackers to manipulate database queries via the ID parameter in editbooks.php. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the book editing function, potentially exposing or corrupting the underlying database. A public proof-of-concept exploit exists, raising the operational risk for any unpatched deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/view_prod.php` endpoint to remote unauthenticated database manipulation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network exploitation with no prerequisites, yielding partial confidentiality, integrity, and availability impact against the backend database. A public proof-of-concept exploit is available on GitHub (referenced via VulDB), though the product's extremely narrow deployment footprint as a SourceCodester tutorial application limits real-world blast radius significantly.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin AJAX endpoint /fos/admin/ajax.php?action=save_user to remote database manipulation via an unsanitized Username parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated network exploitation with no user interaction required, meaning any internet-facing instance is trivially reachable. Publicly available exploit code exists (E:P confirmed in supplemental CVSS vector and referenced GitHub issue), though this vulnerability has not been added to the CISA KEV catalog at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/ajax.php?action=add_to_cart` endpoint to unauthenticated remote attackers who can manipulate the `pid` parameter to execute arbitrary SQL queries against the backend database. The CVSS 4.0 vector (PR:N) confirms no authentication is required despite the admin path, and a public exploit has been disclosed via GitHub. The CIA impact is rated limited across all three dimensions, consistent with a read/write SQL injection that does not achieve full system compromise.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the customer edit endpoint to database manipulation by authenticated network attackers who can control the ID parameter in /pages/cust_edit.php. The CVSS 4.0 base score of 2.1 reflects limited impact across confidentiality, integrity, and availability, though a public proof-of-concept exploit exists on GitHub. No active exploitation by CISA KEV has been confirmed; the low score and limited deployment footprint constrain real-world priority despite the public exploit.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the login endpoint to unauthenticated remote exploitation via the unsanitized `User` parameter in `/pages/processlogin.php`. Attackers can manipulate backend SQL queries without any prior authentication, enabling authentication bypass or database data extraction. A public proof-of-concept has been disclosed on GitHub, and the unauthenticated network attack vector (CVSS 4.0 PR:N, AV:N with E:P) makes any internet-exposed deployment immediately actionable - no public exploit identified as confirmed actively exploited (not in CISA KEV) at time of analysis.
Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.
Authorization bypass via Insecure Direct Object Reference (IDOR) in the Boarder Management Module of code-projects Barangay Resident Profiling Management System 1.0 allows authenticated remote attackers to access or modify boarder records belonging to other users by manipulating the `ID` parameter in `/boarders.php`. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the exploitation barrier. The vulnerability is not listed in CISA KEV, so no confirmed active exploitation campaigns have been identified at time of analysis.
SQL injection in code-projects Barangay Resident Profiling Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search argument in residents.php. The Resident Search Functionality fails to sanitize user-supplied input before constructing SQL statements, enabling read, write, or denial-of-service impact against the underlying database. A public proof-of-concept exploit is available on GitHub, lowering the bar for opportunistic exploitation; however, the product's extremely limited real-world deployment significantly constrains actual attack surface.
Authorization bypass in code-projects Barangay Resident Profiling Management System 1.0 exposes the /archived_records.php endpoint to insecure direct object reference (IDOR) exploitation, allowing low-privileged authenticated attackers to restore or delete archived resident records they do not own by manipulating the resident_id parameter. A public proof-of-concept exploit is available via GitHub, though the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The CVSS 4.0 score of 2.1 reflects limited confidentiality, integrity, and availability impact scoped to the vulnerable system with no lateral scope change.
Improper authorization in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to manipulate the `id` or `username` parameters in `/admin/edit_user_account.php` to modify user accounts they do not own or administer. The flaw is rooted in missing access control checks on the User Account Update endpoint, enabling horizontal or vertical privilege escalation by forging parameter values. A public proof-of-concept exploit has been disclosed on GitHub, raising the practical exploitation risk above what the moderate CVSS score alone suggests.
SQL injection in itsourcecode Hospital Management System Project in PHP 1.0 allows low-privilege authenticated remote attackers to manipulate database queries via the `delid` parameter in `/viewservicetype.php`. Publicly available exploit code exists, reported and disclosed through VulDB. Successful exploitation yields partial confidentiality, integrity, and availability impact against the application database, with no lateral scope change to external systems confirmed.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.
Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.
Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.
Email enumeration in AVideo's RSS feed endpoint (feed/index.php) allows unauthenticated remote attackers to harvest channel owner email addresses across all versions through commit 9c39d8c8. By iterating through public channel names, attackers can systematically extract creator PII from the itunes:email and itunes:author elements of the platform's podcast-compatible RSS output. No public exploit has been identified at time of analysis, but the trivial exploitation path - a standard HTTP GET request requiring no credentials - substantially elevates downstream risk of phishing campaigns and credential-stuffing attacks targeting identified creators.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.
Unauthorized document access in Combodo iTop before version 3.2.3 allows any authenticated user to retrieve documents and attachments belonging to organizations or objects they lack permission to view. The root cause is a logic inversion in the PHP DownloadDocument method: a host-object rights check could silently pass due to incorrect boolean handling, bypassing the intended access control gate entirely. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS PR:L vector confirms exploitation requires only a valid low-privileged account.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.
Authenticated path traversal in Winter CMS's LESS compilation pipeline allows backend users holding any of four specific permissions to exfiltrate arbitrary files readable by the PHP process - most critically the application .env file containing APP_KEY and database credentials. The vulnerability affects Winter CMS versions through 1.2.12 via four injection sinks: Brand Settings, Editor Settings, Mail Brand Settings colour fields, and theme CSS assets compiled by CombineAssets. No public exploit identified at time of analysis and no active exploitation confirmed, but confidentiality impact is high given .env disclosure enables full application key compromise.
Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.
Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.
Stored XSS and arbitrary file upload in Laravel Backpack CRUD allows an authenticated admin to bypass the `SingleBase64Image` uploader's trivial `data:image` prefix check, writing files of any MIME type - including SVG with embedded JavaScript - to the configured storage disk. A companion bug in `FileNameGenerator` causes stored files to receive extensionless names because `mime_content_type()` returns false when passed a data URI string rather than a filesystem path, compounding server-side MIME enforcement failures. Affected versions span 6.0.0-6.8.13 and 7.0.0-7.0.37; vendor-released patches 6.8.14 and 7.0.38 address both flaws. No public exploit code or CISA KEV listing was identified at time of analysis.
Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside `HasUploadFields` and `FileNameGenerator`. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the `public` disk with `storage:link` is in use and no explicit `mimes:` or `mimetypes:` Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. No public exploit code has been identified and no CISA KEV listing is present at time of analysis; vendor-confirmed patches are available in releases 6.8.14 and 7.0.38.
SQL injection in itsourcecode Hospital Management System 1.0 permits authenticated low-privilege users to manipulate database queries through the `delid` parameter of `/viewappointmentpending.php`, potentially exposing or corrupting patient appointment records. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid application account, narrowing the realistic attack surface despite network reachability. Publicly available exploit code (confirmed by E:P in the CVSS 4.0 vector) exists, modestly elevating practical risk; however, no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis.
SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L).
SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application.
Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_category` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to read or modify the underlying database. The CVSS 4.0 vector confirms no authentication, no user interaction, and no special conditions are required to exploit the flaw. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks against any internet-facing deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/view_order.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no user interaction required. A public exploit has been released - referenced via GitHub and VulDB - materially raising near-term opportunistic exploitation risk despite the moderate overall score.
Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.
Reflected XSS in ATutor 2.2.4's preview.php enables an authenticated attacker to inject arbitrary JavaScript into a victim's browser session by manipulating the popup URL parameter. The frameset rendered by preview.php does not sanitize the popup parameter, allowing an attacker to break out of the HTML attribute context and append an event handler such as onload, even though the child frame file preview_top.php does apply sanitization. No patch exists and no patch is planned, as ATutor is no longer actively maintained; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in ATutor's import functionalities allows an authenticated administrator to coerce the server into issuing HTTP requests to arbitrary internal endpoints, cloud metadata services such as AWS IMDSv1, or local filesystem paths via the file:// URI scheme where PHP URL wrappers are enabled. Only version 2.2.4 has been confirmed vulnerable by CERT.pl researchers; the product is end-of-life with no planned fix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of cloud metadata reachability and EOL status makes compensating controls the only available path.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.
Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.
SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.
SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.
SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.
Unauthenticated SQL injection in code-projects Hospital Information System 1.0 exposes the login endpoint to remote database manipulation via the unsanitized `email` parameter in `UsersController.php`. The flaw allows network-accessible attackers to alter authentication query logic, potentially bypassing login controls or extracting sensitive records such as patient data and credentials. No CISA KEV listing exists, but a published proof-of-concept exploit is referenced in the intelligence feed, materially lowering the barrier to exploitation.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.
Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.
Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.
Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.