PHP
Monthly
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Missing authorization in Dolibarr ERP's TakePOS module through version 23.0.3 permits authenticated users with only basic cashier-level access to perform sensitive invoice operations - deleting line items, adjusting quantities, modifying prices, and applying discounts - that require the elevated `editlines` permission. The flaw exists because htdocs/takepos/invoice.php processes these actions without verifying the caller holds the `takepos.editlines` right, creating a privilege boundary bypass within the POS subsystem. An upstream patch commit (8992ce8704da947b6abe7b65a6fe59aed736bb81) is available; no CISA KEV listing and no public exploit code identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Local file inclusion in WP Maps Pro (all versions before 6.1.3) allows unauthenticated remote attackers to include and execute arbitrary existing PHP files on the server by exploiting an AJAX action that lacks both a capability check and path sanitization. Any internet-exposed WordPress installation running the affected plugin is susceptible with no authentication, user interaction, or special configuration required. No public exploit identified at time of analysis and EPSS is low (0.32%), but the zero-barrier entry point and code execution potential elevate the real-world priority well above what the CVSS 6.5 score implies.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the application's database to remote manipulation through the unsanitized 'id' parameter in the admin delete-appointment endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity remote exploitation with no authentication formally required per the reporter's assessment, though the /admin/ path implies a session context that should be independently verified. A public proof-of-concept is available on GitHub, raising practical exploitation risk despite the product's limited real-world footprint; no active exploitation (CISA KEV) has been recorded.
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in `stream:` resource type. When Smarty Security is enabled and `Security::$streams` is set to `null` or a restricted allowlist, an attacker able to author or influence a template resource reference can use `stream:php://filter/...` to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.
Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint `/social/ajax.php?action=login` to remote unauthenticated exploitation via the `email` parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint `/viewappointment.php` to database manipulation by authenticated low-privileged users via the `delid` parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized `delid` parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized `editid` parameter in `/treatmentrecord.php`. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the `patientid` parameter in `/treatmentdetail.php`. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/treatment.php` endpoint to database manipulation via the `editid` parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 exposes student records to unauthorized authenticated users by failing to validate the `class_group` parameter in `view_students.php`. The CVSS 4.0 vector (PR:L) confirms that at least low-privilege authentication is required, limiting the attack surface but still enabling lateral access to student data across class groups the attacker should not be permitted to view. No public exploit code has been identified and the product is not listed in the CISA KEV catalog at time of analysis.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 allows authenticated low-privilege users to access records belonging to other users by manipulating the `id` parameter in the `/view.php` endpoint without proper ownership verification. The CVSS 4.0 vector (PR:L, AV:N, VC:L) confirms the flaw is remotely reachable but requires prior authentication, and impact is limited to confidentiality disclosure of a single record type. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the `/classes/Master.php?f=delete_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.
SQL injection in the imranrisal-dev Student-Management-System login component (loginCheckTest.php) allows unauthenticated remote attackers to manipulate backend database queries via the username and password parameters. A public exploit exists (CVSS 4.0 E:P modifier confirmed), making opportunistic exploitation immediately feasible with no authentication or special preconditions. The vendor was unresponsive to responsible disclosure, and no patch has been released, leaving all deployed instances of this repository permanently exposed.
Path traversal in InnoShop versions 0.8.0 through 0.8.2 allows remotely authenticated low-privilege users to delete arbitrary files on the server via the FileManagerController::destroyFiles function exposed through the panel REST API. The affected PHP e-commerce platform by yushine has no vendor-released patch - the vendor did not respond to responsible disclosure - and a public proof-of-concept exploit is available on GitHub. The CVSS 4.0 score of 2.1 reflects limited per-request impact (low integrity, low availability, no confidentiality loss), but the unpatched status combined with public exploit code elevates operational urgency for any deployment.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.
Statamic CMS exposes authenticated users' raw two-factor authentication recovery codes through the Antlers templating engine due to a missing access restriction in the `AugmentedUser::get()` resolver. Unlike `password` and `password_hash` fields, which are explicitly excluded from augmentation, `two_factor_recovery_codes` is returned without restriction and is absent from all Antlers variable guard lists. An administrator or developer who has configured a blueprint field with dynamic Antlers rendering enabled can craft a template (`{{ current_user.two_factor_recovery_codes }}`) that, when rendered by a victim visiting the page, leaks that victim's 2FA recovery codes into the HTML response - enabling 2FA bypass. No public exploit has been identified at time of analysis, and exploitation requires a high-privilege prerequisite (blueprint configuration access).
Insecure Direct Object Reference in Akaunting's multi-tenant file download route exposes uploaded media records across company boundaries to any authenticated portal customer. The `uploads/{id}/download` endpoint in `app/Http/Controllers/Common/Uploads.php` applies only generic authentication middleware and fetches Media records by raw integer ID without verifying tenant ownership, enabling sequential ID enumeration to exfiltrate invoices, financial statements, and other uploaded documents belonging to unrelated companies on the same instance. No public exploit has been identified and it is not listed in CISA KEV, but the attack is trivially executable by any portal customer given the low complexity of sequential integer enumeration.
Blind SSRF in Firefly III's webhook subsystem exploits two distinct validation failures: an explicit early-return in IsValidWebhookUrl.php that whitelists the entire 127.0.0.0/8 loopback range, and a TOCTOU race where hostname resolution at validation time (gethostbyname()) is decoupled from the independent re-resolution performed by Guzzle at send time, enabling DNS rebinding to bypass private-range filters. Exploitation requires an authenticated user and the webhooks feature to be enabled, which is off by default. This is a blind SSRF primitive with no exploit code publicly identified at time of analysis - webhook responses are written only to a server-side debug log, restricting attacker utility to internal service probing and side-effect triggering rather than direct data exfiltration.
Reflected XSS in 299Ko CMS's public contact form allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by submitting unsanitized POST field values that are echoed unescaped into HTML attributes and a textarea. The vulnerability is in the template engine's output function (`_show_var()` in `common/Template.php`), which lacks any `htmlspecialchars()` encoding, and is exploitable against any visitor - including a targeted administrator - enabling session token theft. No CISA KEV listing exists at time of analysis, but the CVE description provides exact code paths and a working payload, making independent exploit development trivial.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.
Server-side request forgery in Rhymix CMS up to version 2.1.33 enables authenticated administrators to direct the server to fetch arbitrary internal or external URLs via the Data Import Module. The vulnerable entry point is the `procImporterAdminCheckXmlFile` function, where the `filename` argument is passed to server-side request logic without adequate validation, per CWE-918. Publicly available exploit code exists on GitHub (MCzhao2006/Rhymix-SSRF-Report), and this vulnerability is not currently listed in CISA KEV; EPSS data was not provided in source intelligence.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
SQL injection in chetans9's core-php-admin-panel exposes the customers.php endpoint to remote authenticated attackers who can manipulate the filter_col argument to execute arbitrary SQL against the backend database. All code up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f on the rolling-release branch is affected, with no vendor patch issued as the maintainer did not respond to disclosure. A public proof-of-concept exploit is available via GitHub, though no confirmed active exploitation has been recorded by CISA KEV; CVSS 4.0 scores the overall risk at 2.1, reflecting limited but real partial data exposure and database manipulation potential.
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the Author Name argument in /system/htmly.php. A publicly available proof-of-concept exploit (E:P per CVSS 4.0 supplemental metric) exists at a referenced GitHub issue, materially lowering the exploitation bar. The vendor was unresponsive to responsible disclosure, leaving no vendor-confirmed patch and no official mitigation guidance.
Path traversal in danpros HTMLy up to version 3.1.1 enables remote authenticated attackers to delete arbitrary files via the Delete Username endpoint. The PHP `unlink()` function in `/system/htmly.php` accepts a user-controlled `File` argument without path sanitization, allowing traversal outside the intended directory. A public proof-of-concept exploit exists (CVSS 4.0 E:P); no vendor patch is available as the vendor was unresponsive to disclosure, leaving installations permanently exposed without manual mitigation.
Path traversal in danpros HTMLy up to version 3.1.1 permits authenticated remote attackers to manipulate arbitrary file paths via the `oldfile` parameter in the Admin Content Endpoint (`/system/admin/admin.php`), enabling unauthorized file read or write operations outside intended directories. Exploitation requires low-privilege administrative access, and a public proof-of-concept exploit has been released on GitHub. The vendor was notified prior to disclosure but did not respond, meaning no patch has been issued.
Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because `groups_roles.php` handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the `email_templates_key` parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Reflected XSS in the WP Responsive Thumbnail Slider WordPress plugin (all versions before 1.1.53) enables unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing the 'id' parameter. The vulnerable surface is the responsive_thumbnail_image_management() function, which echoes raw GET input into an HTML attribute without esc_attr() and whose only guard - a loose PHP numeric comparison - is trivially bypassed by any string prefixed with a digit. Exploitation requires social engineering a privileged WordPress user into clicking the crafted link; no public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
SQL injection in SourceCodester Modern Loan Management System 1.0 lets attackers manipulate the database via the unsanitized 'id' parameter of /admin/delete_group.php. The flaw carries a CVSS 9.8 and CISA SSVC rates technical impact as total and automatable, but EPSS is only 0.16% (5th percentile) and status is publicly available exploit code exists (POC), not active exploitation. A TaintRadar proof-of-concept is published, making trivial exploitation likely against any exposed instance.
SQL injection in SourceCodester Modern Loan Management System 1.0 allows remote attackers to inject arbitrary SQL through the district_id, division_id, region_id, and ward_id parameters of ajaxData.php. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication or user interaction and yields total compromise of the backend database (confidentiality, integrity, and availability all High). Publicly available exploit code exists (documented in the TaintRadar research repository), though EPSS remains low at 0.16% and the flaw is not on the CISA KEV list.
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
Open redirect in Serendipity's exit.php allows unauthenticated attackers to craft URLs on a legitimate blog domain that silently forward victims to arbitrary attacker-controlled sites. All Serendipity installations prior to version 2.6.1 are affected, but only when the Track Exits plugin is active and configured with commentredirection set to "s9y" - a non-default, explicit setting. No public exploit code and no CISA KEV listing exist at time of analysis; the CVSS 4.0 score of 2.1 reflects limited direct technical impact, though the phishing, malware-delivery, and URL-reputation-bypass potential represents meaningful real-world risk for organizations where blog domain credibility matters.
Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.
SQL injection in PHP Jabbers Car Rental Script allows unauthenticated remote attackers to inject arbitrary SQL through sorting-related parameters that are not properly neutralized before use in database queries. The flaw (CWE-89) carries a CVSS 4.0 base score of 9.3 and enables reading or manipulating backend database contents; there is no public exploit identified at time of analysis, and it is fixed in version 4.1. Because sorting parameters are typically reachable on public-facing catalog/listing pages, exploitation requires no credentials or user interaction.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `&lt;script&gt;` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated attackers to database manipulation via the `delid` parameter in `/viewdoctorconsultancycharge.php`. The vulnerability is PHP-based, requires only low-privilege authentication, and carries a public proof-of-concept exploit documented on GitHub. No active exploitation has been confirmed via CISA KEV, and the CVSS 4.0 score of 2.1 reflects constrained impact, though the sensitivity of healthcare data elevates organizational risk beyond the raw score.
File inclusion in DedeCMS up to 5.7.118 UTF8SP2 allows a remote attacker with low privileges and high-complexity conditions to include arbitrary files via the _4_Setup function within the Installation Wizard (install/index.php). Exploitation results in limited confidentiality, integrity, and availability impact. A proof-of-concept has been publicly disclosed via GitHub, though no active exploitation has been confirmed by CISA KEV. The CVSS 4.0 score of 1.3 reflects the constrained real-world impact and significant attack complexity required.
Missing authorization in Dolibarr ERP's TakePOS module through version 23.0.3 permits authenticated users with only basic cashier-level access to perform sensitive invoice operations - deleting line items, adjusting quantities, modifying prices, and applying discounts - that require the elevated `editlines` permission. The flaw exists because htdocs/takepos/invoice.php processes these actions without verifying the caller holds the `takepos.editlines` right, creating a privilege boundary bypass within the POS subsystem. An upstream patch commit (8992ce8704da947b6abe7b65a6fe59aed736bb81) is available; no CISA KEV listing and no public exploit code identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewdoctor.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing authenticated remote attackers to read, modify, or potentially delete records including patient and physician data. No active exploitation is confirmed in the CISA KEV catalog, but a public proof-of-concept exploit exists on GitHub, materially lowering the skill threshold for attacks. The CVSS 4.0 score of 5.3 with PR:L reflects a constrained but realistic threat to healthcare deployments with lax access controls.
Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Local file inclusion in WP Maps Pro (all versions before 6.1.3) allows unauthenticated remote attackers to include and execute arbitrary existing PHP files on the server by exploiting an AJAX action that lacks both a capability check and path sanitization. Any internet-exposed WordPress installation running the affected plugin is susceptible with no authentication, user interaction, or special configuration required. No public exploit identified at time of analysis and EPSS is low (0.32%), but the zero-barrier entry point and code execution potential elevate the real-world priority well above what the CVSS 6.5 score implies.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Simple Doctors Appointment System 1.0 exposes the application's database to remote manipulation through the unsanitized 'id' parameter in the admin delete-appointment endpoint. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates low-complexity remote exploitation with no authentication formally required per the reporter's assessment, though the /admin/ path implies a session context that should be independently verified. A public proof-of-concept is available on GitHub, raising practical exploitation risk despite the product's limited real-world footprint; no active exploitation (CISA KEV) has been recorded.
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the unauthenticated user registration endpoint (/social/ajax.php?action=signup) to database manipulation via the email parameter. The CVSS 4.0 vector confirms network-exploitable with no authentication, no complexity, and no special attack conditions, while the E:P modifier reflects publicly available exploit code hosted on GitHub. No active exploitation is confirmed in CISA KEV, but the combination of a zero-barrier attack surface and public POC code means any internet-exposed instance should be treated as immediately at risk.
Unrestricted file upload in SourceCodester Photo Share Website 1.0 exposes the /social/ajax.php?action=save_upload endpoint to abuse via crafted img[] and imgName[] POST parameters, allowing authenticated low-privileged users to upload arbitrary file types - including PHP webshells. If the upload directory permits server-side script execution, this escalates to remote code execution on the host. A public proof-of-concept exploit exists on GitHub; the vulnerability is not listed in the CISA KEV catalog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
Smarty PHP template engine versions 5.0.0 through 5.8.3 expose a security policy bypass allowing file disclosure via the built-in `stream:` resource type. When Smarty Security is enabled and `Security::$streams` is set to `null` or a restricted allowlist, an attacker able to author or influence a template resource reference can use `stream:php://filter/...` to read arbitrary local files accessible to the PHP process - bypassing the very control intended to block such access. A public proof-of-concept was disclosed in GHSA-rjhh-76wf-8xmw; no active exploitation is confirmed in CISA KEV. The issue is fixed in v5.8.4.
Symlink-based path traversal in Smarty's Security::_checkDir() allows an attacker who can place a symbolic link inside a trusted directory (such as a template or upload path) to read arbitrary files accessible to the PHP process, bypassing the configured secure_dir sandbox entirely. Affected are Smarty 5.x versions prior to 5.8.2 and all 4.x releases prior to 4.5.7, when Smarty's Security policy is enabled. The root cause is that _checkDir() resolves paths via string normalization only, while the underlying file_get_contents() call faithfully follows symlinks to their targets outside the sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.
SQL injection in SourceCodester Photo Share Website 1.0 exposes the login endpoint `/social/ajax.php?action=login` to remote unauthenticated exploitation via the `email` parameter, enabling attackers to manipulate backend database queries. The CVSS 4.0 vector confirms zero-barrier access - no credentials, no complexity, no user interaction required against a default deployment. A public proof-of-concept exploit is available on GitHub, meaningfully lowering the threshold for opportunistic attacks, though no active exploitation has been confirmed in CISA KEV.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the appointment deletion endpoint `/viewappointment.php` to database manipulation by authenticated low-privileged users via the `delid` parameter. The vulnerability allows partial read, write, and availability impact against the underlying database. A proof-of-concept exploit has been publicly published (CVSS 4.0 E:P), lowering the bar for abuse. No public KEV listing or vendor patch has been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the /viewadmin.php endpoint to database manipulation via the unsanitized `delid` parameter. Authenticated low-privileged attackers with network access can craft malicious requests to read, modify, or delete records from the underlying database. A public exploit exists (POC confirmed via VulDB submission); no KEV listing at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote attackers with low-privilege credentials to manipulate database queries via the unsanitized `editid` parameter in `/treatmentrecord.php`. Exploitation can expose or alter sensitive patient treatment records stored in the backend database. A publicly disclosed exploit exists (E:P), though no confirmed active exploitation appears in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries by supplying crafted input via the `patientid` parameter in `/treatmentdetail.php`. Successful exploitation can result in unauthorized read or modification of patient records and other database contents. Publicly available exploit code exists (CVSS 4.0 supplemental E:P), raising practical risk above the low numeric score of 2.1 suggests; however, no confirmed active exploitation has been identified in CISA KEV at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/treatment.php` endpoint to database manipulation via the `editid` parameter, accessible to remote low-privilege authenticated users. Public exploit code has been released and is referenced via a GitHub issue, making exploitation straightforward for attackers who have obtained any valid session. The CVSS 4.0 score of 2.1 reflects bounded impact (low C/I/A, no subsequent-system scope), but the healthcare context - where treatment records carry regulatory and patient-safety weight - elevates real-world consequence beyond the raw score.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 exposes student records to unauthorized authenticated users by failing to validate the `class_group` parameter in `view_students.php`. The CVSS 4.0 vector (PR:L) confirms that at least low-privilege authentication is required, limiting the attack surface but still enabling lateral access to student data across class groups the attacker should not be permitted to view. No public exploit code has been identified and the product is not listed in the CISA KEV catalog at time of analysis.
Unrestricted file upload in SourceCodester Online Examination & Learning Management System 1.0 exposes the server to arbitrary file upload via the upload_files.php endpoint, which lacks adequate file type or extension enforcement. The CVSS 4.0 vector indicates low-privilege authentication is required (PR:L) over a network vector with low complexity, and the 'Authentication Bypass' tag raises the possibility that this authentication gate may itself be circumventable. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack class is well-understood and trivially weaponizable against affected deployments.
Authorization bypass in SourceCodester Online Examination & Learning Management System 1.0 allows authenticated low-privilege users to access records belonging to other users by manipulating the `id` parameter in the `/view.php` endpoint without proper ownership verification. The CVSS 4.0 vector (PR:L, AV:N, VC:L) confirms the flaw is remotely reachable but requires prior authentication, and impact is limited to confidentiality disclosure of a single record type. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.
Frontend form upload validation in Statamic CMS fails to enforce administrator-configured file type restrictions, allowing unauthenticated visitors to upload disallowed extensions through public-facing forms containing `assets` or `files` fields. The bypass is constrained: Statamic's global allowlist continues to block truly dangerous executable types such as `.php` and `.html`, meaning direct remote code execution is not achievable through this flaw alone. No public exploit code has been identified at time of analysis; vendor-released patches are available in versions 5.74.3 and 6.24.2.
SQL injection in SourceCodester Computer Repair Shop Management System 1.0 exposes the `/classes/Master.php?f=delete_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to execute arbitrary SQL against the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit has been disclosed on GitHub. Impact is assessed as limited (VC:L/VI:L/VA:L) with no scope change to subsequent systems, though the availability of exploit code meaningfully lowers the bar for opportunistic abuse of any internet-exposed instance.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `editid` parameter in /servicetype.php. The vulnerability is a classic CWE-89 unsanitized input passed directly to a SQL query, enabling read and write access to the underlying database. A public proof-of-concept exploit exists (GitHub issue linked in references), raising the practical risk above the low CVSS 4.0 base score of 2.1 - though exploitation is not confirmed in CISA KEV and real-world deployment of this product is limited.
Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.
SQL injection in the imranrisal-dev Student-Management-System login component (loginCheckTest.php) allows unauthenticated remote attackers to manipulate backend database queries via the username and password parameters. A public exploit exists (CVSS 4.0 E:P modifier confirmed), making opportunistic exploitation immediately feasible with no authentication or special preconditions. The vendor was unresponsive to responsible disclosure, and no patch has been released, leaving all deployed instances of this repository permanently exposed.
Path traversal in InnoShop versions 0.8.0 through 0.8.2 allows remotely authenticated low-privilege users to delete arbitrary files on the server via the FileManagerController::destroyFiles function exposed through the panel REST API. The affected PHP e-commerce platform by yushine has no vendor-released patch - the vendor did not respond to responsible disclosure - and a public proof-of-concept exploit is available on GitHub. The CVSS 4.0 score of 2.1 reflects limited per-request impact (low integrity, low availability, no confidentiality loss), but the unpatched status combined with public exploit code elevates operational urgency for any deployment.
Unrestricted file upload in imranrisal-dev's Student-Management-System (PHP) permits authenticated remote attackers to upload arbitrary file types through the storeProfileImage function in student_profile_pic.php by manipulating the choose_file argument. In a PHP application where uploaded files are served under the web root, this class of flaw (CWE-434) directly enables webshell deployment and full server-side remote code execution. A proof-of-concept exploit has been publicly disclosed on GitHub; the vendor did not respond to responsible disclosure, and no patch exists given the project's rolling-release model with no versioned releases.
Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.
Statamic CMS exposes authenticated users' raw two-factor authentication recovery codes through the Antlers templating engine due to a missing access restriction in the `AugmentedUser::get()` resolver. Unlike `password` and `password_hash` fields, which are explicitly excluded from augmentation, `two_factor_recovery_codes` is returned without restriction and is absent from all Antlers variable guard lists. An administrator or developer who has configured a blueprint field with dynamic Antlers rendering enabled can craft a template (`{{ current_user.two_factor_recovery_codes }}`) that, when rendered by a victim visiting the page, leaks that victim's 2FA recovery codes into the HTML response - enabling 2FA bypass. No public exploit has been identified at time of analysis, and exploitation requires a high-privilege prerequisite (blueprint configuration access).
Insecure Direct Object Reference in Akaunting's multi-tenant file download route exposes uploaded media records across company boundaries to any authenticated portal customer. The `uploads/{id}/download` endpoint in `app/Http/Controllers/Common/Uploads.php` applies only generic authentication middleware and fetches Media records by raw integer ID without verifying tenant ownership, enabling sequential ID enumeration to exfiltrate invoices, financial statements, and other uploaded documents belonging to unrelated companies on the same instance. No public exploit has been identified and it is not listed in CISA KEV, but the attack is trivially executable by any portal customer given the low complexity of sequential integer enumeration.
Blind SSRF in Firefly III's webhook subsystem exploits two distinct validation failures: an explicit early-return in IsValidWebhookUrl.php that whitelists the entire 127.0.0.0/8 loopback range, and a TOCTOU race where hostname resolution at validation time (gethostbyname()) is decoupled from the independent re-resolution performed by Guzzle at send time, enabling DNS rebinding to bypass private-range filters. Exploitation requires an authenticated user and the webhooks feature to be enabled, which is off by default. This is a blind SSRF primitive with no exploit code publicly identified at time of analysis - webhook responses are written only to a server-side debug log, restricting attacker utility to internal service probing and side-effect triggering rather than direct data exfiltration.
Reflected XSS in 299Ko CMS's public contact form allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by submitting unsanitized POST field values that are echoed unescaped into HTML attributes and a textarea. The vulnerability is in the template engine's output function (`_show_var()` in `common/Template.php`), which lacks any `htmlspecialchars()` encoding, and is exploitable against any visitor - including a targeted administrator - enabling session token theft. No CISA KEV listing exists at time of analysis, but the CVE description provides exact code paths and a working payload, making independent exploit development trivial.
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the `wpma_metabox_authors_list` parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at `/wp-admin/edit.php`, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
SQL injection in lavkush-maurya Student-Registration-System 1.0 allows authenticated remote attackers to manipulate backend database queries via the unsanitized `oldpass` parameter in `/student/changepass.php`, potentially exposing or modifying student records. A proof-of-concept exploit has been publicly disclosed on GitHub, making exploitation trivial for any holder of a low-privileged student account. No vendor patch exists - the maintainer did not respond to coordinated disclosure - leaving all deployments of this version permanently unmitigated absent manual intervention.
Server-side request forgery in Rhymix CMS up to version 2.1.33 enables authenticated administrators to direct the server to fetch arbitrary internal or external URLs via the Data Import Module. The vulnerable entry point is the `procImporterAdminCheckXmlFile` function, where the `filename` argument is passed to server-side request logic without adequate validation, per CWE-918. Publicly available exploit code exists on GitHub (MCzhao2006/Rhymix-SSRF-Report), and this vulnerability is not currently listed in CISA KEV; EPSS data was not provided in source intelligence.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
SQL injection in chetans9's core-php-admin-panel exposes the customers.php endpoint to remote authenticated attackers who can manipulate the filter_col argument to execute arbitrary SQL against the backend database. All code up to commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f on the rolling-release branch is affected, with no vendor patch issued as the maintainer did not respond to disclosure. A public proof-of-concept exploit is available via GitHub, though no confirmed active exploitation has been recorded by CISA KEV; CVSS 4.0 scores the overall risk at 2.1, reflecting limited but real partial data exposure and database manipulation potential.
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Cookie domain scope bypass in Guzzle PHP HTTP client (prior to 7.15.2 and 8.0.1) allows improper cookie sharing via non-canonical IP address representations in cookie Domain attributes. The flaw in SetCookie::matchesDomain() fails to recognize hexadecimal (e.g., 0x7f000001), mixed-base octal (e.g., 0177.0.0.0x1), and percent-escaped (e.g., 192.168.0.%31) host spellings as IP literals, so cookies set for such domains incorrectly gain subdomain scope while libcurl resolves the same strings as actual IP addresses. This divergence enables an adversary-controlled host (e.g., evil.0x7f000001) to receive session cookies intended for the target IP, facilitating credential disclosure and session fixation; no public exploit identified at time of analysis.
Path traversal in danpros HTMLy up to version 3.1.1 allows remote unauthenticated attackers to read arbitrary files from the server filesystem by manipulating the Author Name argument in /system/htmly.php. A publicly available proof-of-concept exploit (E:P per CVSS 4.0 supplemental metric) exists at a referenced GitHub issue, materially lowering the exploitation bar. The vendor was unresponsive to responsible disclosure, leaving no vendor-confirmed patch and no official mitigation guidance.
Path traversal in danpros HTMLy up to version 3.1.1 enables remote authenticated attackers to delete arbitrary files via the Delete Username endpoint. The PHP `unlink()` function in `/system/htmly.php` accepts a user-controlled `File` argument without path sanitization, allowing traversal outside the intended directory. A public proof-of-concept exploit exists (CVSS 4.0 E:P); no vendor patch is available as the vendor was unresponsive to disclosure, leaving installations permanently exposed without manual mitigation.
Path traversal in danpros HTMLy up to version 3.1.1 permits authenticated remote attackers to manipulate arbitrary file paths via the `oldfile` parameter in the Admin Content Endpoint (`/system/admin/admin.php`), enabling unauthorized file read or write operations outside intended directories. Exploitation requires low-privilege administrative access, and a public proof-of-concept exploit has been released on GitHub. The vendor was notified prior to disclosure but did not respond, meaning no patch has been issued.
Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.
Insecure Direct Object Reference in Admidio before 5.0.11 allows authenticated low-privilege users to hijack list configurations managed by administrators or other users by manipulating the list_uuid parameter in the save_temporary mode of mylist_function.php. Any user with a valid session can enumerate global list UUIDs and submit crafted requests to overwrite admin-curated global lists or private lists belonging to other users, effectively transferring ownership and demoting shared resources to personal configurations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 5.0.11.
Cross-organization role manipulation in Admidio before 5.0.11 allows authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations hosted on the same instance. The flaw exists because `groups_roles.php` handlers accept role UUIDs without verifying that the target role belongs to the requesting user's organization, enabling cross-tenant privilege structure sabotage. No public exploit has been identified at time of analysis; vendor-released patch version 5.0.11 is available.
Second-order SQL injection in osCommerce 4.14.63493 allows remote attackers with high-privilege (administrator-level) backend access to manipulate the `email_templates_key` parameter in the Email Template Configuration component, enabling database extraction and modification. Public exploit code is confirmed available via an anonymous repository hosting a detailed second-order SQLi report. No vendor patch exists - the vendor did not respond to responsible disclosure - raising operational risk for any organization still running this version despite the PR:H constraint.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.
Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.
Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.
PHP object injection in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) allows authenticated contributors to deserialize attacker-controlled PHP objects through event content fields. Exploitation to achieve remote code execution, arbitrary file deletion, or sensitive data retrieval depends entirely on the presence of a usable POP (Property-Oriented Programming) chain from a co-installed plugin or theme - none exists within this plugin itself. A publicly available exploit exists per WPScan (EUVD-2026-51948), and this CVE represents an incomplete remediation of prior object-injection advisories affecting the same plugin.
Reflected XSS in the WP Responsive Thumbnail Slider WordPress plugin (all versions before 1.1.53) enables unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing the 'id' parameter. The vulnerable surface is the responsive_thumbnail_image_management() function, which echoes raw GET input into an HTML attribute without esc_attr() and whose only guard - a loose PHP numeric comparison - is trivially bypassed by any string prefixed with a digit. Exploitation requires social engineering a privileged WordPress user into clicking the crafted link; no public exploit or CISA KEV listing has been identified at time of analysis.
Sensitive information exposure in the Advanced Views WordPress plugin (wplakeorg, all versions ≤ 3.9.1) allows any authenticated subscriber-level user to harvest admin-authored editor content - including template markup, CSS, JavaScript, and PHP controller variables - via improperly authorized REST API routes. Wordfence identified the flaw across three CPT interactive field classes (base, Layout, and Post Selection). No public exploit code or CISA KEV listing exists at time of analysis, but the low authentication bar of subscriber-level access makes this trivially exploitable on any WordPress site with open user registration.
Local file inclusion in the GetPaid WordPress plugin (versions ≤ 2.8.56) enables authenticated administrators to include and execute arbitrary PHP files on the server by supplying a crafted element type value to the getpaid_payment_form_element function. The root cause (CWE-98) is twofold: the element type string was used unsanitized to construct a PHP template file path, and the bare extract($element) call without EXTR_SKIP allowed attacker-controlled array keys to overwrite internal variables including the path already resolved. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis; real-world risk is substantially constrained by the administrator-level access and PHP file upload prerequisites.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
SQL injection in SourceCodester Modern Loan Management System 1.0 lets attackers manipulate the database via the unsanitized 'id' parameter of /admin/delete_group.php. The flaw carries a CVSS 9.8 and CISA SSVC rates technical impact as total and automatable, but EPSS is only 0.16% (5th percentile) and status is publicly available exploit code exists (POC), not active exploitation. A TaintRadar proof-of-concept is published, making trivial exploitation likely against any exposed instance.
SQL injection in SourceCodester Modern Loan Management System 1.0 allows remote attackers to inject arbitrary SQL through the district_id, division_id, region_id, and ward_id parameters of ajaxData.php. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, exploitation requires no authentication or user interaction and yields total compromise of the backend database (confidentiality, integrity, and availability all High). Publicly available exploit code exists (documented in the TaintRadar research repository), though EPSS remains low at 0.16% and the flaw is not on the CISA KEV list.
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
Open redirect in Serendipity's exit.php allows unauthenticated attackers to craft URLs on a legitimate blog domain that silently forward victims to arbitrary attacker-controlled sites. All Serendipity installations prior to version 2.6.1 are affected, but only when the Track Exits plugin is active and configured with commentredirection set to "s9y" - a non-default, explicit setting. No public exploit code and no CISA KEV listing exist at time of analysis; the CVSS 4.0 score of 2.1 reflects limited direct technical impact, though the phishing, malware-delivery, and URL-reputation-bypass potential represents meaningful real-world risk for organizations where blog domain credibility matters.
Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.
SQL injection in PHP Jabbers Car Rental Script allows unauthenticated remote attackers to inject arbitrary SQL through sorting-related parameters that are not properly neutralized before use in database queries. The flaw (CWE-89) carries a CVSS 4.0 base score of 9.3 and enables reading or manipulating backend database contents; there is no public exploit identified at time of analysis, and it is fixed in version 4.1. Because sorting parameters are typically reachable on public-facing catalog/listing pages, exploitation requires no credentials or user interaction.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `&lt;script&gt;` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
HTTP security header spoofing in CodeIgniter4 prior to 4.7.4 allows remote unauthenticated attackers to trick the framework into treating plain HTTP requests as HTTPS by injecting forged X-Forwarded-Proto or Front-End-Https headers. The root cause is that IncomingRequest::isSecure() unconditionally trusted these headers from any source rather than restricting trust to configured trusted proxies, undermining isSecure(), force_https(), and forceGlobalSecureRequests enforcement logic. No public exploit or CISA KEV listing exists; real-world impact is conditioned on deployment topology and CVSS AC:H reflects this complexity.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
SQL injection in CodeAstro Membership Management System 1.0 allows remote unauthenticated attackers to inject arbitrary SQL through the 'id' parameter of /delete_membership.php, enabling full database compromise. The flaw carries a CVSS 9.8 rating with SSVC noting a public proof-of-concept and 'total' technical impact, though publicly available exploit code exists rather than confirmed active exploitation. Despite the critical severity, EPSS estimates only a 0.14% exploitation probability (4th percentile), reflecting the product's niche footprint.
Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' GET parameter of /print_membership_card.php. Because the endpoint accepts attacker-controlled input directly into a SQL statement, an attacker can extract, alter, or destroy membership records and potentially compromise the entire application database. A public technical write-up documenting the exact injection point exists (TaintRadar research repository), though there is no public exploit identified as weaponized and EPSS remains very low (0.14%, 4th percentile), indicating no observed widespread exploitation.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 lets remote attackers inject arbitrary SQL through the membershipType parameter of renew.php, exposing the backend database to read, modification, and potential full compromise. Rated CVSS 9.8 with an unauthenticated network vector, though this is a niche PHP application and there is no public exploit identified at time of analysis. EPSS is very low (0.14%, 4th percentile), indicating little observed exploitation interest despite the high severity.
SQL injection in CodeAstro Membership Management System 1.0 lets remote unauthenticated attackers manipulate backend database queries through the 'id' parameter of /memberProfile.php, enabling extraction or modification of member records and potential full database compromise. The flaw is trivially reachable over the network (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) and a public technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV. EPSS is low at 0.14% (4th percentile), indicating no observed mass exploitation to date despite the maximal severity score.
SQL injection in CodeAstro Membership Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of /delete_members.php. Per the supplied CVSS 3.1 vector (PR:N), no authentication is required, giving attackers full read/write/delete access to the underlying database. There is no public exploit identified at time of analysis, though a TaintRadar research write-up documenting the flaw is referenced; the EPSS score is low (0.14%, 4th percentile) and the CVE is not listed in CISA KEV.
SQL injection in CodeAstro Membership Management System 1.0 allows attackers to manipulate backend database queries through the unsanitized 'id' parameter of /edit_member.php, enabling extraction or modification of member records and potentially full database compromise. The flaw is a classic CWE-89 error where user-supplied input is concatenated directly into a SQL statement. Publicly available exploit code exists in a documented writeup, though the vulnerability carries a low EPSS probability (0.14%) and is not in CISA KEV, indicating no confirmed active exploitation.
SQL injection in CodeAstro Membership Management System 1.0 lets attackers manipulate the backend database through the unsanitized 'id' parameter of the edit_type.php endpoint (CWE-89). The maximal CVSS 9.8 vector reflects full compromise of confidentiality, integrity, and availability, though the low EPSS score (0.14%, 4th percentile) indicates minimal observed exploitation activity to date. The flaw is documented in public research (TaintRadar) and VulDB, but no public weaponized exploit or active exploitation is confirmed.