PHP

Unauthenticated remote PHP file execution in Combodo iTop prior to 3.2.3 allows attackers to invoke arbitrary PHP files from the env-production module directory by sending crafted requests to the exec.php dispatcher, which performed no authentication check before routing to module pages. The flaw is classified as CWE-306 (Missing Authentication for Critical Function) and carries a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N), indicating zero-friction network exploitation with no credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote code execution in xShop 3.0.3, an open-source Laravel e-commerce platform by 4xmen, arises from an unrestricted file-upload flaw in the admin attachment handler that accepts executable content such as .php files. An authenticated administrator can upload a crafted PHP payload and have the web server execute it, yielding full server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue is fixed in version 3.0.4, whose diff adds strict MIME-type validation to the upload request.

Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface.

Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.

Compile-time PHP code injection in the Phalcon (cphalcon) PHP framework's Volt template compiler (versions 5.15.0 and earlier) lets an attacker who can influence Volt template source achieve remote code execution. The Volt `join` filter emits the separator and array arguments as raw, unescaped bytes into the generated PHP, so quote-breaking content escapes the `join('…')` call and is written into the cached compiled template that is then require()'d at render time. Publicly available exploit code exists (a working PoC that runs shell_exec is published in the GHSA advisory); the issue is not listed in CISA KEV and no active exploitation is confirmed.

Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.

Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.

Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.

SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.

Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.

Remote code execution in SPIP before 4.4.20 allows unauthenticated attackers to run arbitrary PHP on the server by exploiting flawed detection of `<?php` blocks combined with var_export's mishandling of input containing a '<' character. The CVE description itself reports exploitation in the wild during August 2026, and the flaw is network-reachable with no authentication or user interaction (CVSS 9.8). This is a CWE-94 code-injection issue affecting all SPIP releases prior to the fixed 4.4.20.

Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engineering chain requiring only that an administrator bookmark an attacker-controlled URL. The permalink handler in BookmarkListController.php writes raw bookmark titles into the HTML <title> element without HTML escaping, and Shaarli's built-in metadata fetcher copies remote page titles verbatim - meaning an attacker who controls a webpage's title silently plants a persistent payload the moment any admin bookmarks that URL. The injected script then executes in the Shaarli origin for every subsequent visitor to the permalink, including the administrator on first save, creating a one-shot session-hijacking path; no public exploit has been identified at time of analysis.

Authenticated path traversal in Winter CMS's LESS compilation pipeline allows backend users holding any of four specific permissions to exfiltrate arbitrary files readable by the PHP process - most critically the application .env file containing APP_KEY and database credentials. The vulnerability affects Winter CMS versions through 1.2.12 via four injection sinks: Brand Settings, Editor Settings, Mail Brand Settings colour fields, and theme CSS assets compiled by CombineAssets. No public exploit identified at time of analysis and no active exploitation confirmed, but confidentiality impact is high given .env disclosure enables full application key compromise.

Authenticated IDOR in the Winter CMS backend FileUpload widget (versions through 1.2.12) allows any backend user - including those with no role beyond default My Account access - to manipulate attachment metadata and sort ordering across the entire application by submitting an attacker-controlled file_id POST parameter. Because the system_files table uses sequential integer primary keys, any authenticated attacker can enumerate and target arbitrary System\Models\File records belonging to unrelated users or models, overwriting title, description, and sort_order, and potentially triggering onRemoveAttachment against unrelated records through the same unscoped lookup. No public exploit has been identified at time of analysis, and no CISA KEV entry exists.

Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.

Stored XSS and arbitrary file upload in Laravel Backpack CRUD allows an authenticated admin to bypass the `SingleBase64Image` uploader's trivial `data:image` prefix check, writing files of any MIME type - including SVG with embedded JavaScript - to the configured storage disk. A companion bug in `FileNameGenerator` causes stored files to receive extensionless names because `mime_content_type()` returns false when passed a data URI string rather than a filesystem path, compounding server-side MIME enforcement failures. Affected versions span 6.0.0-6.8.13 and 7.0.0-7.0.37; vendor-released patches 6.8.14 and 7.0.38 address both flaws. No public exploit code or CISA KEV listing was identified at time of analysis.

Arbitrary file deletion in Laravel Backpack CRUD (all 5.x, 6.x < 6.8.12, 7.x < 7.0.35) allows any authenticated low-privilege user - such as a content editor - to delete files outside the scope of the record they are editing by injecting arbitrary disk-relative paths into the `clear_<attr>[]` request parameter. The root cause is that `HasUploadFields::uploadMultipleFilesToDisk` passes attacker-supplied paths directly to `Storage::disk()->delete()` without intersecting them against the filenames actually stored in the database for that record. No confidentiality impact exists (files cannot be read), but an attacker can destroy any file reachable under the configured storage disk root, including other records' attachments and shared operational assets. No public exploit or KEV listing has been identified at time of analysis.

Remote code execution in Laravel Backpack CRUD's upload handling allows authenticated administrators to place PHP webshells in web-accessible storage by exploiting the lack of file extension validation inside `HasUploadFields` and `FileNameGenerator`. Affected are installations on the 6.x series before 6.8.14 and the 7.x series before 7.0.38 where the `public` disk with `storage:link` is in use and no explicit `mimes:` or `mimetypes:` Laravel validation rule guards upload fields - conditions common in quickstart-following deployments. No public exploit code has been identified and no CISA KEV listing is present at time of analysis; vendor-confirmed patches are available in releases 6.8.14 and 7.0.38.

Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.

SQL injection in itsourcecode Hospital Management System 1.0 permits authenticated low-privilege users to manipulate database queries through the `delid` parameter of `/viewappointmentpending.php`, potentially exposing or corrupting patient appointment records. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid application account, narrowing the realistic attack surface despite network reachability. Publicly available exploit code (confirmed by E:P in the CVSS 4.0 vector) exists, modestly elevating practical risk; however, no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis.

SQL injection in CodeAstro Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the email parameter of the password-recovery.php script. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public proof-of-concept exploit is available on GitHub, lowering the skill threshold for opportunistic attacks. No active exploitation has been confirmed in CISA KEV at time of analysis, and impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L).

SQL injection in CodeAstro Apartment Visitor Management System 1.0 exposes the unauthenticated password-reset endpoint (/apartment-visitor/forgotpw.php) to remote database manipulation via the `secode` parameter. A publicly available proof-of-concept exploit exists, lowering the bar for exploitation. Affected deployments risk partial database read and write access without any prior authentication, as confirmed by the CVSS 4.0 vector (PR:N, UI:N). No KEV listing exists, and exploitation is expected to remain opportunistic and targeted to organizations running this niche PHP application.

Improper authorization in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows authenticated remote attackers to perform unauthorized grade operations against arbitrary student records by manipulating the student_id parameter in the add_grade function at /index.php. This is a horizontal privilege escalation flaw - an authenticated user (e.g., a student) can affect records they do not own, compromising both confidentiality and integrity of academic grade data. No public exploit or active exploitation (CISA KEV) has been identified at the time of analysis, and the CVSS 4.0 score of 5.3 reflects medium severity with limited but real impact.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_category` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to read or modify the underlying database. The CVSS 4.0 vector confirms no authentication, no user interaction, and no special conditions are required to exploit the flaw. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier for opportunistic attacks against any internet-facing deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/fos/admin/view_order.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no user interaction required. A public exploit has been released - referenced via GitHub and VulDB - materially raising near-term opportunistic exploitation risk despite the moderate overall score.

Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.

SQL injection and chained code injection in baserCMS before 5.3.0 allow authenticated administrators to exfiltrate arbitrary data from a PostgreSQL backend via BcDatabaseService.php. The attack chains two flaws: a backup restore mechanism that unconditionally executes PHP code outside class definitions in schema files upon loading, enabling an admin to plant malicious table names, which are then passed unsanitized into SQL statements across sequence update, CSV export, and table management operations. Error-based SQL injection against the PostgreSQL backend can then retrieve database version, schema contents, and sensitive application data. No public exploit has been identified and this CVE is not in CISA KEV, but the VulnCheck advisory provides sufficient technical detail to guide exploitation by motivated actors.

Reflected XSS in ATutor 2.2.4's preview.php enables an authenticated attacker to inject arbitrary JavaScript into a victim's browser session by manipulating the popup URL parameter. The frameset rendered by preview.php does not sanitize the popup parameter, allowing an attacker to break out of the HTML attribute context and append an event handler such as onload, even though the child frame file preview_top.php does apply sanitization. No patch exists and no patch is planned, as ATutor is no longer actively maintained; no public exploit or CISA KEV listing has been identified at time of analysis.

Server-side request forgery in ATutor's import functionalities allows an authenticated administrator to coerce the server into issuing HTTP requests to arbitrary internal endpoints, cloud metadata services such as AWS IMDSv1, or local filesystem paths via the file:// URI scheme where PHP URL wrappers are enabled. Only version 2.2.4 has been confirmed vulnerable by CERT.pl researchers; the product is end-of-life with no planned fix. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of cloud metadata reachability and EOL status makes compensating controls the only available path.

SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.

Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.

SQL injection in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the ID parameter in /delete.php. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, enabling exploitation from the network. A public proof-of-concept exploit has been disclosed via GitHub, making this immediately actionable for opportunistic attackers targeting deployments of this PHP application.

Unauthenticated PHP object injection in the Roxnor FundEngine (wp-fundraising-donation) WordPress plugin through version 1.7.9 lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() sink without authentication. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary code execution, file operations, or SQL manipulation. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Local File Inclusion (LFI) in the WP Cafe Pro WordPress plugin before version 3.0.15 allows an authenticated WordPress Author to include arbitrary files from the server's filesystem via unsanitized input passed to PHP file inclusion functions. The vulnerability is classified under CWE-98 and requires a high-privilege WordPress account (Author role), limiting opportunistic exploitation but enabling significant damage - including credential theft and potential remote code execution - if a trusted but malicious or compromised Author account is present. Patchstack reported this flaw and confirmed remediation in version 3.0.15. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and including 1.57.0, letting remote attackers submit crafted serialized data that is deserialized without validation to potentially achieve arbitrary object instantiation and, with a suitable POP gadget chain, remote code execution. The vulnerability carries a CVSS 9.8 rating with a fully unauthenticated network vector and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Local File Inclusion in the Golo Framework WordPress plugin before version 1.7.5 allows unauthenticated remote attackers to read arbitrary local files from the server - including wp-config.php containing database credentials - and potentially achieve code execution via PHP file inclusion mechanisms. The flaw stems from CWE-98: user-controlled input is passed unsanitized to PHP include/require statements, exploitable over the network without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network-accessible attack surface and CVSS 8.1 score make this a meaningful risk for any WordPress installation running the affected plugin.

Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.

User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.

Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.

Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Arbitrary PHP code execution in Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) is reachable by any user holding the manage_options capability, including non-super subsite administrators on WordPress Multisite who would not otherwise have code-execution rights. The plugin writes unsanitized custom widget markup directly to a server-side file that is subsequently executed as PHP, enabling full server-side code injection. A publicly available exploit exists per WPScan; no CISA KEV listing at time of analysis, though the attack scenario is realistic for any WordPress Multisite deployment with delegated administration.

Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.

Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.

SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.

SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.

SQL injection in DeDeCMS 53_1_UTF8 exposes the `/plus/advancedsearch.php` endpoint to remote unauthenticated database manipulation via an unsanitized `sql` argument. The flaw (CWE-89) allows attackers to craft malicious SQL statements that interact directly with the backend database, yielding limited but real confidentiality, integrity, and availability impact. A public exploit has been disclosed (CVSS 4.0 E:P), lowering the skill barrier for exploitation; no CISA KEV listing has been identified at time of analysis.

SQL injection in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the `mailuid` parameter at the Admin Login Endpoint (`/process/aprocess.php`). Successful exploitation can result in authentication bypass, credential extraction, or partial data manipulation depending on database user privileges. A public proof-of-concept exploit is available, materially lowering the technical barrier for opportunistic attacks.

Unauthenticated SQL injection in code-projects Hospital Information System 1.0 exposes the login endpoint to remote database manipulation via the unsanitized `email` parameter in `UsersController.php`. The flaw allows network-accessible attackers to alter authentication query logic, potentially bypassing login controls or extracting sensitive records such as patient data and credentials. No CISA KEV listing exists, but a published proof-of-concept exploit is referenced in the intelligence feed, materially lowering the barrier to exploitation.

XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.

Missing centralized authorization in Leantime's JSON-RPC API dispatcher (through v3.9.0) enables any authenticated user to invoke service-layer methods against arbitrary resources they do not own, resulting in full account takeover of other users including administrators. The dispatcher in app/Domain/Api/Controllers/Jsonrpc.php routes API calls without an authorization gate, allowing a caller to supply a victim's user ID to the editOwn method and overwrite their password. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), though VokeCyber's published research significantly lowers the technical barrier for exploitation.

Memory exhaustion denial-of-service in MCP PHP SDK's HttpTransport crashes client processes when connected to a malicious or compromised MCP server. Affected versions (mcp/sdk >= 0.5.0, < 0.7.1) accumulate SSE stream data into an unbounded in-memory buffer inside processSSEStream() - a server that withholds the SSE event delimiter ('\n\n') forces the buffer to grow at 4 KiB per tick until the PHP process hits its memory_limit and crashes with a fatal OOM error. A proof-of-concept is publicly available and reproduces the crash deterministically against the released Packagist package; this is not confirmed in CISA KEV.

Insecure direct object reference in Snipe-IT prior to 8.6.3 allows any authenticated low-privilege user to read signed EULA documents belonging to other users by exploiting inconsistent authorization enforcement across two Laravel controllers. The attacker calls /api/v1/users/{target_id}/eulas to learn the target's randomized EULA filename, then retrieves the file via the /account/stored-eula-file/{filename} route, which bypasses the stricter checks enforced by the primary /stored-eula-file/{filename} endpoint. No public exploit has been identified at time of analysis, and the vendor has released a fix in version 8.6.3.

Horizontal privilege escalation in Snipe-IT prior to 8.6.3 allows any authenticated company user to read asset maintenance records - including purchase costs, supplier details, asset tags, and notes - without holding asset view or maintenance permissions. The root cause is a missing `authorize()` call in `MaintenancesController.php show()`, which the company-scoped route-model binding did not compensate for since it only blocks cross-company access, not intra-company unauthorized reads. No public exploit has been identified at time of analysis; vendor-released patch is available in version 8.6.3.

Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.

Privilege escalation in the Grav API Plugin (prior to 1.0.8) allows any authenticated panel user to generate or revoke API keys on behalf of arbitrary accounts, including super-administrators, by exploiting an insufficient authorization check in the apiKeyGenerate and apiKeyRevoke admin task handlers. The plugin enforced only the baseline admin.login permission - held by every panel user - without verifying that the caller had rights over the target account specified in the route parameter, enabling a low-privilege user to mint persistent API credentials carrying the target's full permissions. No public exploit has been identified at time of analysis; the issue is fixed in version 1.0.8.

Remote code execution in Grav CMS prior to 2.0.7 allows low-privileged page editors to execute arbitrary OS commands as the web server user via a callable-injection flaw in Blueprint::dynamicData(). An account holding admin.pages or api.pages.write permission can embed a malicious data-options@ blueprint directive in page frontmatter that chains through Utils::arrayFilterRecursive() as a trampoline into PHP's system() function, executing the command when the page is rendered. No CISA KEV listing or public exploit code is identified at time of analysis; the full attack technique is documented in GitHub Security Advisory GHSA-fj2p-qj2f-74v5.

Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.

Regex-driven denial of service in Grav CMS prior to 2.0.4 allows authenticated page editors to exhaust PHP worker CPU by injecting catastrophically backtracking regular expression patterns through the allowlisted `regex_replace` Twig filter. The vulnerable path exists in `GravExtension::regexReplace()`, which forwards editor-supplied patterns directly to `preg_replace()` without backtrack-limit enforcement or error recovery. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack is straightforward for any user who holds page-editor privileges on an affected instance with Twig content processing enabled.

Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the api.webhooks.write permission register webhook URLs that the server dereferences with no protocol allow-listing. Because WebhookController.php validates the URL only with FILTER_VALIDATE_URL and WebhookDispatcher.php builds cURL without CURLOPT_PROTOCOLS/CURLOPT_REDIR_PROTOCOLS, an attacker can force the server to fetch file://, gopher://, dict://, and private/link-local targets, exfiltrating local files and internal HTTP responses including cloud metadata credentials. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause and fix are confirmed in the vendor advisory and commit.

Authorization bypass in the Grav Flex Objects Plugin prior to version 1.4.3 permits an authenticated user holding only the api.access permission to invoke all admin API handlers - index, show, create, update, delete, export, and media - against any Flex Objects directory whose blueprint omits the config.admin.permissions field. The root cause is a logic inversion in requireFlexPermission() inside FlexApiController.php: when no blueprint permissions are defined, the original code iterated over an empty set and silently returned without throwing a ForbiddenException, bypassing the core admin.flex-object authorization fallback that would otherwise deny the same actions. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor-released patch is available as version 1.4.3.

Disk-exhaustion denial of service in Grav CMS prior to 2.0.1 is reachable through the ZipArchiver::extract() code path, which passes attacker-controlled ZIP archives to PHP's ZipArchive::extractTo() without enforcing the platform's configured limits on uncompressed size, file count, or directory nesting depth. An authenticated attacker with plugin or theme upload access can submit a crafted decompression bomb to exhaust disk space or inodes, rendering the site unavailable. No public exploit code has been identified, and CISA KEV listing is absent; a vendor-released patch is available as of Grav 2.0.1 (June 22, 2026).

Denial-of-service in the J-BusinessDirectory Joomla extension (all versions before 6.2.3) allows unauthenticated remote attackers to crash directory listing pages by supplying array or non-numeric values to pagination parameters such as limitstart[]. PHP arithmetic performed on these malformed inputs triggers fatal type errors, rendering the affected extension inoperable. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Wildcard injection in phpMyFAQ before 4.1.7 allows unauthenticated attackers to cause denial of service via the public FAQ search form when the application is running against PostgreSQL through PHP's native pgsql extension. The underlying defect is a character mismatch in LIKE escape handling: Search/Database/Pgsql.php declares '=' as the LIKE ESCAPE character but escapeLikeWildcards() prefixes user input with '|', making wildcard sanitization entirely inert. Submitted % and _ characters pass through as active SQL wildcards, forcing PostgreSQL into maximally broad sequential table scans. No public exploit has been identified at time of analysis, and the vulnerability explicitly does not enable SQL injection or data exfiltration.

Local file disclosure in phpMyFAQ before 4.1.7 is triggered through unsanitized HTML in FAQ answers when PDF documents are generated via TCPDF. Any user holding FAQ creation or editing rights can embed an img tag whose src attribute references a local file within the content/ directory - when PDF export runs, TCPDF fails to parse the target as an image and raises an uncaught exception whose stack trace exposes a portion of the file's raw contents, potentially including database credentials stored in content/core/config/database.php. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact accurately reflects the realistic severity given the potential for full credential exposure under permissive PHP runtime settings.

Pre-authentication PHP code injection in Balbooa Forms, a commercial Joomla form-builder extension, in all versions before 2.4.3.2 lets a remote unauthenticated attacker run arbitrary server-side code. The flaw stems from the optional custom-PHP post-submission handler being executed through eval() after the [URL parameter = X] shortcode is replaced with the raw, unescaped value of an attacker-controlled query parameter. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the combination of unauthenticated network reach and full remote code execution makes this a maximum-severity issue wherever a matching handler is configured.

Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.

Unauthenticated PHP object/global variable injection in the Broken Link Checker WordPress plugin before 2.4.12 allows attackers to overwrite arbitrary PHP global variables via unfiltered query variables on sites using plain permalinks, escalating to remote code execution when a classic (non-block) theme is active. The flaw is reachable by any unauthenticated visitor (CVSS 3.1 base 9.0, PR:N) but requires the AC:H preconditions of plain permalinks plus a classic theme, so it is not universally exploitable. No public exploit has been identified at time of analysis, and the EPSS probability is low (0.22%, 13th percentile), indicating no observed mass exploitation yet.

Missing capability checks in the Advanced File Manager WordPress plugin (before 5.4.13) allow any authenticated user holding administrator-delegated file-manager access - as low as Subscriber - to read arbitrary server files including wp-config.php and to overwrite existing non-PHP files, creating a direct path to full WordPress site compromise. The CVSS 8.5 score with a scope-changed vector reflects the severity of that impact, while AC:H captures the critical prerequisite: an administrator must explicitly grant file-manager access to low-privileged roles before exploitation is possible. No public exploit has been identified at time of analysis, and a vendor patch is available in version 5.4.13.

Arbitrary file deletion in the Atarim AI Agency for WordPress plugin (all versions through 5.1.1) allows authenticated attackers holding author-level credentials to delete any file on the underlying server via a chained directory traversal attack, with a direct path to remote code execution. The exploit chain poisons WordPress attachment metadata with a traversal path and then triggers the plugin's media replacement workflow to resolve and unlink the attacker-chosen target file. No public exploit has been identified at time of analysis, but the Wordfence advisory fully documents the two-step chain against verified source code, making independent reproduction straightforward for a moderately skilled attacker.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the `/admin/ajax.php?action=delete_menu` endpoint to remote unauthenticated database manipulation via an unsanitized `id` parameter. Per the CVSS 4.0 vector (PR:N, UI:N, AV:N), no authentication or user interaction is required, enabling any network-reachable attacker to read, modify, or delete database contents. A public proof-of-concept exploit exists on GitHub, making this immediately actionable; no patch has been identified at time of analysis.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes backend database contents through the unsanitized ID parameter of the /admin/ajax.php?action=save_menu endpoint, permitting remote attackers to read, modify, or delete application data. The CVSS 4.0 vector assigns PR:N, suggesting the admin-area endpoint may be reachable without authentication - a pattern common in SourceCodester educational applications - though this should be independently verified. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified as confirmed actively exploited by CISA KEV at time of analysis), meaningfully lowering the barrier to opportunistic attacks against any internet-exposed deployment.

SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the unauthenticated admin login endpoint /admin/ajax.php?action=login to remote exploitation via the unsanitized Username parameter. A publicly available proof-of-concept exploit has been published on GitHub, reducing the bar for exploitation to near-zero skill level. The CVSS 4.0 vector confirms no authentication, privileges, or user interaction are required, though impact is limited to partial confidentiality, integrity, and availability compromise of the underlying database.

SQL injection in code-projects Online Job Portal System 1.0 exposes the unauthenticated Password Recovery endpoint (/ForPass.php) to remote exploitation via the txtUserName parameter. The flaw requires no credentials and no user interaction, meaning any network-reachable instance can be targeted directly. A public proof-of-concept exploit has been disclosed via GitHub, confirming the attack is reproducible; no vendor patch has been identified at time of analysis.

Two-Factor Authentication is fully bypassed in Froxlor's API layer (versions prior to 2.3.7), allowing any holder of a valid API key and secret to invoke all API operations - including management of domains, DNS records, SSL certificates, email, FTP, and databases - without supplying the configured TOTP code. The web UI enforces 2FA correctly via `FroxlorTwoFactorAuth::verifyCode()`, but the API authentication function `FroxlorRPC::validateAuth` in `lib/Froxlor/Api/FroxlorRPC.php` checks only key validity, expiration, API permission, and account status, with zero references to 2FA logic across the entire `lib/Froxlor/Api/` directory. Publicly available exploit code exists per the GHSA advisory, which documents a confirmed PoC environment against Froxlor 2.3.5 with a 2FA-enabled admin account.

Credential and 2FA-secret disclosure in the Froxlor hosting control panel (versions before 2.3.8) lets an authenticated API caller retrieve password hashes and Base32 TOTP seeds through the Customers, Admins, and Ftps API commands. The affected get()/listing() endpoints run full-row queries (SELECT *) and return the raw rows via $this->response(...) without stripping the password, type_2fa, or data_2fa fields. A detailed proof-of-concept exists (curl calls plus a Python TOTP-code generator); there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.

Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.

DNS zone-file injection in Froxlor's DomainZones.add API (versions ≤ 2.3.7) enables an authenticated customer with DNS-zone permissions to embed arbitrary BIND resource-record lines into zone files by supplying tab characters, newlines, and semicolons in the `record` or `type` parameter - characters the code processes through IDNA encoding and lowercasing but never rejects. BIND parses the resulting file without error, treating injected control characters as legitimate zone-file syntax and accepting the fabricated RRs as valid DNS entries. No public exploit is in CISA KEV, but the GHSA advisory published by the researcher (Yaohui Wang) includes a working proof-of-concept with confirmed BIND zone load output; exploitation is bounded to domains the attacker already manages within Froxlor.

Second-order SQL injection in Froxlor (versions before 2.3.8) enables an authenticated administrator with the change_serversettings=1 privilege to store a UNION-based SQL payload in the panel_admins.ip column via Admins.add or Admins.update, which executes without further victim interaction when IpsAndPorts.listing is called by the poisoned account, returning all administrator login names and bcrypt password hashes. A confirmed, publicly available proof-of-concept demonstrates the complete two-step store-then-trigger chain against a live instance, enabling full database exfiltration and privilege escalation from reseller admin to super-admin. No active exploitation is confirmed in CISA KEV, though the working PoC and the specific threat model of multi-admin hosting deployments materially elevate real-world risk.

Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.

Path traversal via unsanitized plugin identifier in MineAdmin's app-store service enables any authenticated user to read directory existence outside the plugin root, trigger Plugin::install() and Plugin::uninstall() on arbitrary filesystem paths, and potentially execute arbitrary Composer commands. Affected versions are all releases of composer/mineadmin/mineadmin prior to v3.2.0-alpha.2. Compounded by a missing PermissionMiddleware on the plugin store controller (GM-4340), any bearer-token holder - not just administrators - can reach the vulnerable endpoints. A proof-of-concept is publicly available and the vulnerability has been reproduced in a Docker environment.

Missing rate limiting on the POST /v1/sessions login endpoint in Plainpad through 1.1.1 allows unauthenticated remote attackers to submit unlimited credential attempts with no lockout, enabling both credential stuffing and a CPU exhaustion denial-of-service via repeated bcrypt comparisons. The flaw originates from a Laravel framework version mismatch: the throttle middleware was defined in App\Http\Kernel.php, which is dead code never instantiated by the Laravel 11+ bootstrap model, leaving the API route group entirely unthrottled. No public exploit has been identified at time of analysis, though SSVC classifies this as automatable with partial technical impact.

Privilege escalation in Malcolm's nginx Lua RBAC layer allows authenticated low-privilege users to access administrator-only endpoints by submitting percent-encoded request URIs that bypass the access control gate. Malcolm versions up to and including 26.07.1 are affected, with restricted paths including /htadmin, /arkime/api/esadmin, NetBox, and file upload endpoints all reachable via this encoding bypass. A proof-of-concept exists per SSVC classification, though this vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog at time of analysis.

Remote code execution in LibreNMS allows an authenticated administrator to execute arbitrary OS commands on the host server by chaining two unsafe PHP `exec()` calls in the Signal alert transport module. Versions 21.6.0 through 26.5.0 (exclusive) are affected, with the root cause being unescaped user-controlled inputs - the `signal-cli` path and `Recipient` field - interpolated directly into shell commands in `LibreNMS/Alert/Transport/Signal.php` and `scripts/composer_wrapper.php`. A publicly available proof-of-concept with step-by-step exploit instructions is included in the GitHub Security Advisory GHSA-c9fv-cgmm-2wg7; no CISA KEV listing was identified at time of analysis.

Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.

Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.