PHP
Monthly
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.
SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
DNS zone-file injection in Froxlor's DomainZones.add API (versions ≤ 2.3.7) enables an authenticated customer with DNS-zone permissions to embed arbitrary BIND resource-record lines into zone files by supplying tab characters, newlines, and semicolons in the `record` or `type` parameter - characters the code processes through IDNA encoding and lowercasing but never rejects. BIND parses the resulting file without error, treating injected control characters as legitimate zone-file syntax and accepting the fabricated RRs as valid DNS entries. No public exploit is in CISA KEV, but the GHSA advisory published by the researcher (Yaohui Wang) includes a working proof-of-concept with confirmed BIND zone load output; exploitation is bounded to domains the attacker already manages within Froxlor.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Authorization bypass in Dolibarr ERP/CRM's clonetasks mass action allows authenticated users with project creation permissions to insert task records into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actions_massactions.inc.php incorrectly grants authorization to non-members when it should deny them. The attacker controls the target via a user-supplied projectid POST parameter, making exploitation straightforward for any authenticated user with basic project permissions. No public exploit code has been identified at time of analysis, and a vendor patch is available via upstream commit.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSHRM1.php, executing within the victim's browser session when a crafted link is followed. A public proof-of-concept exploit is available via a GitHub issue, lowering the practical bar for exploitation despite the low CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV; impact is bounded by mandatory user interaction and the browser-session scope of injected code.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSCE2.php, executing in the context of a victim's browser upon interaction with a crafted link. A public proof-of-concept exploit exists (GitHub issue, VulDB reference), raising the practical exploitability above the base CVSS 4.0 score of 5.3 would suggest in isolation. No active exploitation is confirmed by CISA KEV, and real-world impact is substantially constrained by the product's narrow academic/student deployment footprint.
SQL injection in SourceCodester Pet Grooming Management Software 1.0 exposes the /admin/get_barcode_data.php endpoint to remote attackers who can manipulate the unsanitized 'barcode' parameter to read, alter, or corrupt the underlying database. The CVSS 4.0 vector assigns no authentication or user-interaction requirement, and a publicly available proof-of-concept lowers the exploitation bar to script-level effort. No CISA KEV listing exists, but the combination of a network-exposed attack surface and published exploit code makes this a higher practical priority than the nominal Medium score implies for any internet-facing deployment.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
Race condition in Azuriom CMS up to v1.2.12 allows authenticated users to exploit a time-of-check time-of-use (TOCTOU) flaw in the money transfer handler, potentially duplicating in-game currency by submitting concurrent transfer requests that each pass the balance check before any deduction is applied. The commit diff confirms the vulnerability in ProfileController.php::transferMoney(), where a balance check was performed outside any database transaction lock. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists. Attack complexity is rated high due to the narrow timing window required to win the race.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
User enumeration via observable response discrepancy in automad's password reset endpoint (versions up to 2.0.0-beta.32) allows unauthenticated remote attackers to determine whether a given username or email address is registered. The `requestPasswordResetToken` function in `UserController.php` previously returned a distinct error (`userNotFoundError`) for non-existent accounts while returning a success response for valid ones, enabling systematic account enumeration. No active exploitation is confirmed by CISA KEV, though the exploit technique has been publicly disclosed per the VulDB submission.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
PHP Object Injection in the Turnkey bbPress by WeaverTheme WordPress plugin (all versions through 1.7.1) allows authenticated administrators to pass arbitrary PHP objects through the plugin's settings-restore handler, which reads an uploaded file's raw contents and passes them directly to `unserialize()` without validation. The immediate danger is conditional: no POP chain exists within the plugin itself, but any co-installed plugin or theme supplying a POP chain elevates this to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.
SQL injection in code-projects Online Shopping System 1.0 allows remote unauthenticated attackers to manipulate the email parameter on the /login.php endpoint, potentially bypassing authentication and reading or modifying backend database contents. A public proof-of-concept exploit has been published on GitHub, confirming practical exploitability. No patch is available at time of analysis, and the product is a low-prevalence academic/demo codebase with no indication of CISA KEV listing.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.
Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.
Insufficient entropy in API key generation for pkp/pkp-lib 3.3.0, 3.4.0, and 3.5.0 exposes generated API keys to brute-force prediction. The vulnerable code derived API keys using SHA1 of the current Unix timestamp (sha1(time())), which yields a deterministic, low-entropy value easily narrowed to a small candidate window if the approximate key-generation time is known or guessable. No public exploit or CISA KEV listing exists at time of analysis, but the upstream fix commit (529b5df) is publicly visible and the flaw is self-evident from the diff.
Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.
Unbounded authentication attempts against Open Source Point of Sale (versions 3.4.0-3.4.2) allow remote attackers to brute-force user credentials via the login endpoint without triggering any lockout or throttle. The Login::index function in app/Config/Validation/OSPOSRules.php performs no rate limiting on failed authentication attempts, leaving all user accounts exposed to automated credential guessing. Publicly available exploit code exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, and the official upstream project has not yet responded to the responsible disclosure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
SQL injection in SourceCodester Simple Client Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `ID` parameter in `/classes/Master.php?f=save_service`. The vulnerability allows arbitrary SQL query manipulation, enabling data exfiltration and potential data modification against the backend database. A publicly disclosed proof-of-concept exploit exists (referenced in GitHub issue lyf3273/CVE/issues/3), elevating near-term exploitation risk for any internet-exposed instances despite the limited prevalence of this product.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the `/classes/Master.php?f=save_cargo_type` endpoint to database manipulation via a crafted `id` argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Open redirect in Saurus CMS Community Edition's logout handler allows unauthenticated attackers to redirect authenticated users to attacker-controlled domains or javascript: URIs immediately after session destruction. The vulnerability exists in classes/port.inc.php, where the `url` GET/POST parameter is passed unsanitized into the HTTP Location header with no allowlist, scheme check, or path restriction. A publicly available proof-of-concept demonstrates exploitation; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 with UI:A reflects the social-engineering dependency inherent to post-logout redirect abuse.
SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.
Reflected cross-site scripting in Serendipity CMS versions 2.3.5 through 2.6.0 enables arbitrary JavaScript execution in a victim's browser via the clean-URL search route. The flaw in include/functions_routing.inc.php's serveSearch() inverts the sanitization order - urldecode() runs after htmlspecialchars() and strip_tags(), so a URL-encoded payload survives HTML encoding intact and is decoded back into executable markup before page rendering. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.6.1.
SQL LIKE wildcard injection in phpMyFAQ's chat user search endpoint (GET /api/chat/users?q=) allows any authenticated user to bypass the intended display-name filter and enumerate all active user accounts. The vulnerability exists because the Chat::searchUsers() method applies database escape() to prevent SQL string breakout but omits escaping of the LIKE metacharacters % and _, which the database engine still interprets as wildcards. A PoC is publicly available demonstrating full user enumeration via q=%25%25 and q=__; no KEV listing exists at time of analysis.
Reflected XSS in LibreNMS 26.4.0 and earlier allows an authenticated attacker to inject arbitrary JavaScript into any victim's browser session by embedding a payload in the GET parameters `instance` or `vmid` of the Proxmox application module. The root cause is unsafe PHP string interpolation of unsanitized GET input directly into a `document.title` JavaScript assignment in `LegacyController.php:75`, bypassed with a simple single-quote injection. A working proof-of-concept demonstrating cookie exfiltration is publicly documented in the GitHub security advisory GHSA-jmqm-f8q4-v7wx; this CVE is not in CISA KEV.
Broken access control in Winter CMS (composer/winter/wn-cms-module ≤ 1.2.12) allows any authenticated backend user holding at least one Theme Editor permission to pivot beyond their authorized scope via crafted AJAX requests. The Cms\Controllers\Index controller gated section access with OR-logic across five permissions but individual handlers - onSave(), onDelete(), onDeleteTemplates(), and AssetList.onUpload() - performed no per-template-type authorization check, enabling cross-template actions such as deleting layouts, modifying partials, reading content files, and uploading arbitrary files to the active theme asset directory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released fix is v1.2.13.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions prior to 4.9.2) allows low-privileged WordPress users to weaponize the server as an HTTP proxy by abusing the public ?vdl=<post_id> download handler, which fetches and streams back the URL stored in a post's mp4 metadata field without destination validation. Attackers who can set that meta value can redirect server-side requests to internal network resources, cloud instance metadata endpoints, or RFC-1918 address space, with the full HTTP response returned to the attacker. No confirmed active exploitation (CISA KEV) at time of analysis, but a publicly available proof-of-concept exploit reported by WPScan exists; EPSS is low at 0.13% (3rd percentile), suggesting exploitation remains targeted rather than widespread.
SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the `/admin/ajax.php?action=set_appointment` endpoint to unauthenticated remote attackers who can manipulate database queries by supplying crafted values for the `id` argument. The attack requires no privileges or user interaction, and a public proof-of-concept is available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch has been identified at time of analysis, leaving all deployed instances of version 1.0 unmitigated.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.
Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).
Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.
SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
DNS zone-file injection in Froxlor's DomainZones.add API (versions ≤ 2.3.7) enables an authenticated customer with DNS-zone permissions to embed arbitrary BIND resource-record lines into zone files by supplying tab characters, newlines, and semicolons in the `record` or `type` parameter - characters the code processes through IDNA encoding and lowercasing but never rejects. BIND parses the resulting file without error, treating injected control characters as legitimate zone-file syntax and accepting the fabricated RRs as valid DNS entries. No public exploit is in CISA KEV, but the GHSA advisory published by the researcher (Yaohui Wang) includes a working proof-of-concept with confirmed BIND zone load output; exploitation is bounded to domains the attacker already manages within Froxlor.
Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.
Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.
Cross-site request forgery in MyBB's Admin CP Recovery Codes module allows same-site attackers to silently rotate a victim administrator's Two-Factor Authentication recovery codes by tricking them into loading a crafted URL. All MyBB installations prior to 1.8.40 are affected. An attacker who can deliver a link to an authenticated admin - for example, a registered forum member posting a crafted URL - can invalidate the admin's existing 2FA recovery codes, potentially locking them out of account recovery. No public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in MyBB's Mod CP Report Center prior to version 1.8.40 permits any moderator holding the general `canmodcp` permission to mark reported content as resolved, regardless of whether they hold the specific `canmanagereportedcontent` or `canmanagereportedposts` capability. The bypass is triggered via the `modcp.php?action=do_reports` handler, which skips the finer-grained permission check; when the moderator's forum scope is empty, the `$flist_reports` variable is empty and the SQL UPDATE against `mybb_reportedcontent` fires without the expected permission-based WHERE clause. The vendor has released a confirmed fix in MyBB 1.8.40, and no active exploitation or public exploit code has been identified at time of analysis.
MyBB's calendar module prior to version 1.8.40 exposes private forum events to any authenticated user possessing calendar viewing or moderation permissions, due to seven missing authorization checks across calendar.php action handlers. Authenticated forum members can read and modify private calendar events created by other users - data the event creator intended to restrict exclusively to themselves. No public exploit code has been identified at time of analysis and the flaw is absent from CISA KEV, but exploitation requires only a standard low-privilege forum account, keeping the practical barrier for abuse low.
Buddy list integrity corruption in MyBB before 1.8.40 allows any authenticated forum member to silently remove an arbitrary entry from another user's buddy list as a side effect of their own list management. The root cause is an unchecked array_search() return value (CWE-252) combined with a wrong UID used in the reciprocal update - PHP coerces the false return to array index 0, clobbering the target account's first stored buddy. No active exploitation has been identified at time of analysis, and the vendor-confirmed fix shipped in MyBB 1.8.40.
CAPTCHA replay exploitation in MyBB prior to 1.8.40 allows unauthenticated remote attackers to bypass anti-automation controls by reusing a previously validated CAPTCHA challenge token across five distinct action endpoints. The root cause is missing calls to captcha::invalidate_captcha() after successful validation in contact.php, member.php (do_resendactivation, do_lostpw, do_emailuser), and sendthread.php (do_sendtofriend) when the built-in captchaimage setting is active. No public exploit has been identified at time of analysis, and the flaw enables form-abuse automation rather than code execution or data exfiltration.
Mail header injection in MyBB's Email User feature (prior to 1.8.40) allows CRLF sequences embedded in the unsanitized `fromname` HTTP parameter to inject arbitrary SMTP headers - including Bcc, Reply-To, and Return-Path - into outgoing forum emails. The attack surface is conditional on two prerequisites: the `mail_handler` must be set to PHP (the default) and the `cansendemail` group permission must be enabled for the attacker's user group, including guests for the unauthenticated path. No public exploit code exists and this vulnerability is not listed in CISA KEV, but successful exploitation turns the forum's mail infrastructure into a phishing or spam relay, weaponizing the forum's domain reputation against recipients.
Incorrect authorization in MyBB's calendar module prior to version 1.8.40 allows authenticated users holding moderation rights on one calendar to relocate events to calendars where they possess only viewing permissions. The `do_move` action in `calendar.php` validated `canmoderateevents` for the source calendar but omitted the equivalent check for the destination, enabling unauthorized cross-calendar event manipulation. No public exploit code or active exploitation has been identified; the fix is confirmed in version 1.8.40 via a one-line permission guard added to the destination calendar lookup.
CSRF in MyBB's Admin Control Panel UTF-8 Conversion module allows same-site attackers to trigger destructive database ALTER TABLE operations by luring an authenticated administrator into following a specially crafted GET URL. The do=all control flow in admin/modules/tools/system_health.php executed table encoding changes, column rewrites, and fulltext index rebuilds without any synchronizer-token verification, exposing any named database table to attacker-chosen manipulation. No public exploit has been identified at time of analysis; the issue is confirmed fixed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Security Questions module (versions prior to 1.8.40) permits same-site attackers to toggle registration challenge questions on or off by tricking an authenticated administrator into visiting a specially crafted URL. The vulnerable controller in admin/modules/config/questions.php accepted GET requests for enable and disable actions and directly modified the mybb_questions.active database field without calling verify_post_check() against the my_post_key anti-CSRF token. No public exploit has been identified at time of analysis, and the vendor released a patch in MyBB 1.8.40.
Incorrect authorization in MyBB's calendar module prior to 1.8.40 allows any authenticated forum member to enumerate the titles of calendars restricted from them. Two separate code paths in calendar.php evaluate permission checks against the wrong PHP variable ($calendar['cid'] instead of $calendar_option['cid']), causing the authorization logic to resolve permissions for an unintended calendar context rather than the one being listed. A second affected path additionally omits the canmoderateevents permission check entirely. Exploitation is limited to calendar title disclosure - content, events, and user data are not exposed - and no public exploit or active exploitation has been identified.
CAPTCHA bypass in MyBB's registration workflow allows unauthenticated remote attackers to create accounts without solving the Security Question challenge. The `member.php?action=do_register` endpoint accepts a hidden `question_id` field but fails open when that identifier is blank, forged, or expired - the validation logic has no fail-closed fallback, so the request proceeds without challenge verification. The issue is resolved in MyBB 1.8.40; no public exploit is identified at time of analysis.
Server-side request forgery in MyBB prior to 1.8.40 allows authenticated forum users to bypass the remote host blocklist by supplying IPv6 targets, causing the application to issue unintended internal network requests. The flaw is a fail-open design: `fetch_remote_file()` skips blocklist validation entirely when `get_ip_by_hostname()` returns an empty array - which it always did for IPv6 hostnames because the resolver only extracted 'ip' keys, not 'ipv6' keys. Compounding the issue, the default disallowed host list contained no IPv6 CIDR ranges, meaning IPv6 addresses would have bypassed even a correctly functioning resolver. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Cross-site request forgery in MyBB's Admin Control Panel View Manager allows same-site attackers to silently change an administrator's default user list view by tricking the admin into visiting a specially crafted URL. All MyBB installations prior to version 1.8.40 are affected; the root cause is the set_default action in admin/inc/functions_view_manager.php accepting state-changing GET requests without CSRF token validation. No public exploit code has been identified and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog; the vendor-released fix is confirmed in MyBB 1.8.40.
Cross-site request forgery in MyBB's Admin CP Mass Mail module (versions prior to 1.8.40) allows same-site attackers to manipulate an authenticated administrator's session to create draft mass mail entries from archived ones. The Resend route under Users & Groups → Mass Mail → Mass Mailing Archive processed GET requests and performed state-changing database writes (setting mybb_massemails.status = 0) without any CSRF token verification, enabling forged requests via a specially crafted URL. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released patch is available in MyBB 1.8.40.
Authorization bypass in Dolibarr ERP/CRM's clonetasks mass action allows authenticated users with project creation permissions to insert task records into private projects they are not authorized to access. An inverted boolean condition in the private-project membership check within actions_massactions.inc.php incorrectly grants authorization to non-members when it should deny them. The attacker controls the target via a user-supplied projectid POST parameter, making exploitation straightforward for any authenticated user with basic project permissions. No public exploit code has been identified at time of analysis, and a vendor patch is available via upstream commit.
SQL injection in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to unauthenticated remote exploitation via the email parameter. The vulnerable function Operation::select_with_multiple_condition fails to sanitize user input before constructing SQL queries, enabling authentication bypass or database enumeration. A public proof-of-concept exploit is available per VulDB and a linked GitHub issue, materially lowering the skill threshold for exploitation; no confirmed CISA KEV listing exists at time of analysis.
Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.
SQL injection in PHPGurukul Complaint Management System 1.0 exposes the user/check_availability.php endpoint to remote unauthenticated database manipulation via a crafted email parameter, enabling unauthorized data read, write, and limited availability disruption against the backend database. A public proof-of-concept exploit is confirmed available on GitHub, lowering the skill bar for opportunistic exploitation. No CISA KEV listing at time of analysis, but the CVSS 4.0 vector includes E:P confirming exploit code exists publicly.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewbilling.php endpoint to database manipulation via the unsanitized delid parameter, exploitable by any low-privileged authenticated user over the network. A publicly available proof-of-concept has been disclosed on GitHub, lowering the barrier to exploitation significantly. Impact is bounded to partial confidentiality, integrity, and availability loss against the application database, with no confirmed scope change to adjacent systems.
SQL injection in itsourcecode Hospital Management System 1.0 allows low-privileged remote attackers to manipulate the `delid` parameter in `/viewdepartment.php`, enabling arbitrary SQL query execution against the backend database. The CVSS 4.0 score of 5.3 reflects limited but confirmed confidentiality, integrity, and availability impact. A proof-of-concept exploit is publicly available on GitHub, materially lowering the barrier to exploitation; however, no active exploitation has been confirmed via CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient and operational database contents to remote authenticated attackers via the `delid` parameter in `/viewroom.php`. The vulnerability carries a CVSS 4.0 score of 5.3 with a network attack vector and low complexity, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the combination of a live exploit and sensitive healthcare data context elevates practical urgency beyond what the moderate score alone suggests.
Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject1.php` endpoint to unauthenticated remote attackers who can manipulate the `ID` parameter to execute arbitrary SQL against the underlying database. The vulnerability carries a CVSS 4.0 score of 6.9 with no authentication or user interaction required, and a proof-of-concept exploit has been publicly disclosed via GitHub. No KEV listing exists, but the public POC materially lowers the barrier to exploitation for opportunistic attackers targeting exposed instances.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject2.php` endpoint to remote unauthenticated attackers who can manipulate the `ID` parameter to execute arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites. Public exploit code exists per the referenced GitHub issue, lowering the skill bar for attackers, though no CISA KEV listing confirms widespread active exploitation at time of analysis.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSHRM1.php, executing within the victim's browser session when a crafted link is followed. A public proof-of-concept exploit is available via a GitHub issue, lowering the practical bar for exploitation despite the low CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV; impact is bounded by mandatory user interaction and the browser-session scope of injected code.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSCE2.php, executing in the context of a victim's browser upon interaction with a crafted link. A public proof-of-concept exploit exists (GitHub issue, VulDB reference), raising the practical exploitability above the base CVSS 4.0 score of 5.3 would suggest in isolation. No active exploitation is confirmed by CISA KEV, and real-world impact is substantially constrained by the product's narrow academic/student deployment footprint.
SQL injection in SourceCodester Pet Grooming Management Software 1.0 exposes the /admin/get_barcode_data.php endpoint to remote attackers who can manipulate the unsanitized 'barcode' parameter to read, alter, or corrupt the underlying database. The CVSS 4.0 vector assigns no authentication or user-interaction requirement, and a publicly available proof-of-concept lowers the exploitation bar to script-level effort. No CISA KEV listing exists, but the combination of a network-exposed attack surface and published exploit code makes this a higher practical priority than the nominal Medium score implies for any internet-facing deployment.
Code injection in sqlparse prior to 0.6.0 allows attackers to escape generated Python and PHP source-code snippets by supplying crafted SQL containing backslashes immediately before quote characters, exploiting a missing pre-escaping step in the output formatting filters. The flaw resides in sqlparse/filters/output.py, which escapes quotes without first escaping pre-existing backslashes, causing the generated escape to neutralize the backslash rather than the quote and allowing attacker-controlled content to appear outside the intended string literal as executable code. Publicly available exploit code exists via a validated Docker-based proof-of-concept published in GHSA-3496-9g83-7v6x; no confirmed active exploitation in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewprescriptionrecord.php endpoint to authenticated remote attackers who can manipulate the `delid` parameter to execute arbitrary SQL commands against the underlying database. Publicly available exploit code exists on GitHub, confirmed by the CVSS 4.0 E:P modifier, though no CISA KEV listing indicates active widespread exploitation at time of analysis. Given the healthcare context, the combination of public exploit availability and sensitive patient data makes this a higher-priority remediation than the low CVSS 4.0 score of 2.1 alone suggests.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.
Race condition in Azuriom CMS up to v1.2.12 allows authenticated users to exploit a time-of-check time-of-use (TOCTOU) flaw in the money transfer handler, potentially duplicating in-game currency by submitting concurrent transfer requests that each pass the balance check before any deduction is applied. The commit diff confirms the vulnerability in ProfileController.php::transferMoney(), where a balance check was performed outside any database transaction lock. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists. Attack complexity is rated high due to the narrow timing window required to win the race.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter in /viewpaymentreport.php. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier to exploitation for any reachable instance. The CVSS 4.0 vector confirms low-privilege authentication is required (PR:L), and impact is rated partial across confidentiality, integrity, and availability - though SQL injection primitives can often be escalated beyond initial scoring to achieve broader data extraction.
SQL injection in itsourcecode Hospital Management System 1.0 exposes patient management functionality to low-privileged authenticated attackers who can manipulate the `delid` parameter in /viewpatient.php to alter or extract database records. Successful exploitation allows unauthorized read, modification, or deletion of patient data, carrying significant regulatory and privacy consequences in healthcare environments. A proof-of-concept exploit has been publicly disclosed via GitHub, materially lowering the bar for opportunistic attacks against unpatched instances; the vulnerability is not currently listed in the CISA KEV catalog.
User enumeration via observable response discrepancy in automad's password reset endpoint (versions up to 2.0.0-beta.32) allows unauthenticated remote attackers to determine whether a given username or email address is registered. The `requestPasswordResetToken` function in `UserController.php` previously returned a distinct error (`userNotFoundError`) for non-existent accounts while returning a success response for valid ones, enabling systematic account enumeration. No active exploitation is confirmed by CISA KEV, though the exploit technique has been publicly disclosed per the VulDB submission.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
PHP Object Injection in the Turnkey bbPress by WeaverTheme WordPress plugin (all versions through 1.7.1) allows authenticated administrators to pass arbitrary PHP objects through the plugin's settings-restore handler, which reads an uploaded file's raw contents and passes them directly to `unserialize()` without validation. The immediate danger is conditional: no POP chain exists within the plugin itself, but any co-installed plugin or theme supplying a POP chain elevates this to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit has been identified at time of analysis, and no active exploitation is confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.
SQL injection in code-projects Online Shopping System 1.0 allows remote unauthenticated attackers to manipulate the email parameter on the /login.php endpoint, potentially bypassing authentication and reading or modifying backend database contents. A public proof-of-concept exploit has been published on GitHub, confirming practical exploitability. No patch is available at time of analysis, and the product is a low-prevalence academic/demo codebase with no indication of CISA KEV listing.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.
Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.
Insufficient entropy in API key generation for pkp/pkp-lib 3.3.0, 3.4.0, and 3.5.0 exposes generated API keys to brute-force prediction. The vulnerable code derived API keys using SHA1 of the current Unix timestamp (sha1(time())), which yields a deterministic, low-entropy value easily narrowed to a small candidate window if the approximate key-generation time is known or guessable. No public exploit or CISA KEV listing exists at time of analysis, but the upstream fix commit (529b5df) is publicly visible and the flaw is self-evident from the diff.
Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_teacher.php` endpoint to unauthenticated remote exploitation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms low-complexity, unauthenticated, network-accessible exploitation with partial confidentiality, integrity, and availability impact. A public proof-of-concept exploit exists (E:P in CVSS 4.0 threat metrics); no vendor-released patch has been identified at time of analysis.
Unbounded authentication attempts against Open Source Point of Sale (versions 3.4.0-3.4.2) allow remote attackers to brute-force user credentials via the login endpoint without triggering any lockout or throttle. The Login::index function in app/Config/Validation/OSPOSRules.php performs no rate limiting on failed authentication attempts, leaving all user accounts exposed to automated credential guessing. Publicly available exploit code exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, and the official upstream project has not yet responded to the responsible disclosure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
SQL injection in SourceCodester Simple Client Management System 1.0 exposes the application's database to unauthenticated remote attackers via the unsanitized `ID` parameter in `/classes/Master.php?f=save_service`. The vulnerability allows arbitrary SQL query manipulation, enabling data exfiltration and potential data modification against the backend database. A publicly disclosed proof-of-concept exploit exists (referenced in GitHub issue lyf3273/CVE/issues/3), elevating near-term exploitation risk for any internet-exposed instances despite the limited prevalence of this product.
Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.
SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the `/classes/Master.php?f=save_cargo_type` endpoint to database manipulation via a crafted `id` argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.
Cross-site request forgery in RosarioSIS up to version 12.8 allows a remote unauthenticated attacker to trigger unintended state-changing actions in Modules.php by luring an authenticated user to a malicious page. The vulnerability stems from the absence of CSRF token validation on the modfunc parameter, compounded by insufficient sanitization of modfunc= in rendered HTML/Markdown output via MarkDownHTML.fnc.php. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor-confirmed patch is available in v12.9.
Arbitrary database table row deletion in RosarioSIS up to version 12.7.4 allows authenticated users to issue DELETE statements against any table in the database by manipulating the unsanitized `table` parameter in `modules/Students/includes/Medical.inc.php`. While `DBEscapeIdentifier()` prevents classic SQL injection syntax escapes, it does not restrict which table is targeted - enabling destruction of records far beyond the medical module's intended scope, including user accounts, grades, or other critical school data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available in version 12.8.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.
Open redirect in Saurus CMS Community Edition's logout handler allows unauthenticated attackers to redirect authenticated users to attacker-controlled domains or javascript: URIs immediately after session destruction. The vulnerability exists in classes/port.inc.php, where the `url` GET/POST parameter is passed unsanitized into the HTTP Location header with no allowlist, scheme check, or path restriction. A publicly available proof-of-concept demonstrates exploitation; no active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 with UI:A reflects the social-engineering dependency inherent to post-logout redirect abuse.
SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.
Reflected cross-site scripting in Serendipity CMS versions 2.3.5 through 2.6.0 enables arbitrary JavaScript execution in a victim's browser via the clean-URL search route. The flaw in include/functions_routing.inc.php's serveSearch() inverts the sanitization order - urldecode() runs after htmlspecialchars() and strip_tags(), so a URL-encoded payload survives HTML encoding intact and is decoded back into executable markup before page rendering. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.6.1.
SQL LIKE wildcard injection in phpMyFAQ's chat user search endpoint (GET /api/chat/users?q=) allows any authenticated user to bypass the intended display-name filter and enumerate all active user accounts. The vulnerability exists because the Chat::searchUsers() method applies database escape() to prevent SQL string breakout but omits escaping of the LIKE metacharacters % and _, which the database engine still interprets as wildcards. A PoC is publicly available demonstrating full user enumeration via q=%25%25 and q=__; no KEV listing exists at time of analysis.
Reflected XSS in LibreNMS 26.4.0 and earlier allows an authenticated attacker to inject arbitrary JavaScript into any victim's browser session by embedding a payload in the GET parameters `instance` or `vmid` of the Proxmox application module. The root cause is unsafe PHP string interpolation of unsanitized GET input directly into a `document.title` JavaScript assignment in `LegacyController.php:75`, bypassed with a simple single-quote injection. A working proof-of-concept demonstrating cookie exfiltration is publicly documented in the GitHub security advisory GHSA-jmqm-f8q4-v7wx; this CVE is not in CISA KEV.
Broken access control in Winter CMS (composer/winter/wn-cms-module ≤ 1.2.12) allows any authenticated backend user holding at least one Theme Editor permission to pivot beyond their authorized scope via crafted AJAX requests. The Cms\Controllers\Index controller gated section access with OR-logic across five permissions but individual handlers - onSave(), onDelete(), onDeleteTemplates(), and AssetList.onUpload() - performed no per-template-type authorization check, enabling cross-template actions such as deleting layouts, modifying partials, reading content files, and uploading arbitrary files to the active theme asset directory. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-released fix is v1.2.13.
Unauthenticated arbitrary file write in AVideo's aVideoEncoderChunk.json.php endpoint allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests, requiring no credentials of any kind. All AVideo versions (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) with this endpoint network-exposed are affected, as confirmed by the patch commit diff which shows authentication gating was entirely absent prior to the fix. Exploitation can cause denial of service via disk exhaustion, corrupt the video encoding pipeline, or - when chained with a local file inclusion vulnerability - escalate to remote code execution; no public exploit has been identified at time of analysis.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Host header injection in picocms/Pico through 2.1.4 allows unauthenticated remote attackers to substitute an attacker-controlled domain as the base URL for all JavaScript and CSS assets loaded by the default theme. Because Pico::getBaseUrl() in lib/Pico.php trusts unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers when base_url is not explicitly configured, the derived URL propagates unchecked into theme_url, assets_url, and plugins_url, causing every page rendered by the default theme to fetch scripts and stylesheets from the attacker's server. No public exploit is identified at time of analysis; exploitation requires a victim to load a Pico-generated page in a browser.
Server-Side Request Forgery in the All-in-One Video Gallery WordPress plugin (all versions prior to 4.9.2) allows low-privileged WordPress users to weaponize the server as an HTTP proxy by abusing the public ?vdl=<post_id> download handler, which fetches and streams back the URL stored in a post's mp4 metadata field without destination validation. Attackers who can set that meta value can redirect server-side requests to internal network resources, cloud instance metadata endpoints, or RFC-1918 address space, with the full HTTP response returned to the attacker. No confirmed active exploitation (CISA KEV) at time of analysis, but a publicly available proof-of-concept exploit reported by WPScan exists; EPSS is low at 0.13% (3rd percentile), suggesting exploitation remains targeted rather than widespread.
SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the `/admin/ajax.php?action=set_appointment` endpoint to unauthenticated remote attackers who can manipulate database queries by supplying crafted values for the `id` argument. The attack requires no privileges or user interaction, and a public proof-of-concept is available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch has been identified at time of analysis, leaving all deployed instances of version 1.0 unmitigated.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.