PHP
Monthly
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.
Stored Cross-Site Scripting in Newsletters Lite WordPress plugin versions ≤4.15 permits authenticated attackers with contributor-level access to inject arbitrary web scripts by abusing the 'link' attribute of the post_thumbnail and newsletters_post_thumbnail shortcodes. When a privileged user accesses a page containing the injected shortcode, the script executes in their session, potentially leading to session hijacking or credential theft. No active exploitation or public proof-of-concept is identified at time of analysis.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.
SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.
SQL Injection in kishan0725 Hospital Management System 4.0 exposes patient medical history records to unauthenticated remote attackers via the `viewid` parameter of the `view-medhistory.php` endpoint. The CVSS vector confirms no authentication, complexity, or user interaction is required, and the SSVC framework independently verifies a proof-of-concept exists and the attack is fully automatable. Despite a low EPSS score of 0.14%, the sensitivity of medical record data and zero-barrier exploitation make any internet-exposed instance a meaningful risk; no public exploit identified at time of analysis as confirmed active exploitation (KEV not listed).
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
Path disclosure in Quick.CMS (<=6.8.0) allows authenticated admins to expose directory structure and absolute file paths via the admin.php p parameter. The vulnerability requires high privileges and the vendor does not consider a fix necessary. No public exploit or active exploitation has been reported.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Information disclosure through SQL injection in Ninja Forms for WordPress versions 3.14.9 and earlier enables authenticated administrators to extract sensitive database data. The vulnerability originates from unsanitized keys in the 'settings' object when importing form files, allowing SQL payload injection via two distinct sinks. No active exploitation is confirmed, and EPSS indicates low exploitation probability.
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.
SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint `/OnlineClassroom/loginlinkadmin.php` to unauthenticated remote attackers who can manipulate the `aid` parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal.
Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Dompdf's chroot filesystem restriction is bypassed by embedding SVG content as a base64-encoded data-URI, enabling any external user who controls HTML input to read arbitrary image files from the server filesystem and exfiltrate them via the rendered PDF output. The attack exploits a two-stage validation gap: dompdf's data:// protocol handler applies no chroot rules, and the downstream php-svg-lib dependency - invoked with allowExternalReferences forced to true - calls file_get_contents() with zero chroot awareness. A complete working proof-of-concept is published in the GitHub security advisory (GHSA-cx96-42px-69fm); no public exploit identified beyond the advisory PoC, and no active exploitation confirmed at time of analysis.
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the `day` parameter in `/BSIS.php`. The CVSS 4.0 score of 2.1 reflects constrained real-world impact — user interaction is required and integrity impact is low — though a public proof-of-concept has been disclosed via a GitHub issue, confirming exploitability. No active exploitation has been confirmed via CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `day` argument in /class.php, requiring only passive user interaction (UI:P). Publicly available exploit code exists per VulDB submission and a referenced GitHub proof-of-concept issue, though no CISA KEV listing has been issued. The CVSS 4.0 score of 2.1 reflects the narrow impact profile — limited integrity effect on the vulnerable system only, with no confidentiality or availability consequences recorded.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the `/web/web_file/upload.php` endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.
Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled `rap2hpoutre/laravel-log-viewer` override decrypts a user-supplied `dl` parameter and resolves its absolute path before applying the intended `storage/logs` directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets.
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.
Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_room1.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter of `/prescriptionorderdetail.php`. An authenticated low-privilege user can extract, alter, or delete sensitive patient and prescription records stored in the backend database. A public exploit proof-of-concept is available on GitHub (E:P per CVSS 4.0), lowering the barrier to exploitation; however, no CISA KEV listing has been identified, and the overall impact is bounded to low-level confidentiality, integrity, and availability effects.
Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected `wp2pcl_ajax_process_request_inner` AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible `tmp/` directory at a predictable URL, exposing `wp-config.php` database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.
Plaintext credential exposure in Frogman's audit logging pipeline allows any authenticated low-privilege user holding PERM_READ access to recover passwords and extension secrets set by administrative operations. Frogman versions prior to 1.6.2 encode full tool response payloads - including the plaintext password returned by fm_reset_password and the plaintext secret returned by fm_add_extension - directly into the oc_audit_log.detail column via auditOutcome in Frogman.class.php. Because fm_audit_search was gated only at PERM_READ rather than PERM_ADMIN, any read-tier caller could query historical audit entries and extract those credentials. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 6.5 reflects the authenticated-but-low-privilege access requirement and high confidentiality impact.
Authorization bypass in RafyMrX TOKO-ONLINE-ROTI allows a low-privileged remote attacker to manipulate the `kd_cs` parameter in `proses/add.php` to access or modify data belonging to other customers, a classic CWE-639 Insecure Direct Object Reference pattern. The application up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is confirmed affected, with no vendor patch available after the vendor failed to respond to responsible disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity of parameter manipulation makes this trivially reproducible with standard HTTP tooling.
Authenticated injection of TIME_TRACKING and REMINDER note types in MantisBT's SOAP and REST APIs allows UPDATER-level users to corrupt billing data and falsify project records. The `note_type` integer parameter supplied by the caller is passed directly to `bugnote_add()` in the SOAP endpoint - and through `mc_issue_update()` in the REST API - without verifying the caller holds sufficient privilege to create that note type. Attackers with UPDATER access can inject arbitrary billable hours into MantisBT's billing reports, generating fraudulent invoices, and can register fake REMINDER notes via SOAP. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.28.4.
Authorization bypass in MantisBT's SOAP API, REST API, and web-based bug update interface allows authenticated lower-privileged users to assign unreleased product versions to issues, circumventing the `report_issues_for_unreleased_versions_threshold` access control. All three issue-update pathways in versions 2.28.3 and earlier were unprotected: the SOAP handler (`mc_issue_api.php`), the web form (`bug_update.php`), and the REST command layer (`IssueAddCommand.php`). No public exploit code and no active exploitation (CISA KEV) have been identified; vendor-released patch version 2.28.4 closes all three vectors.
Full-read SSRF in Koel's podcast subscription feature allows any authenticated user to coerce the server into fetching internal HTTP endpoints - including cloud instance metadata services - and receive the full response. The vulnerability exists because PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE` does not unwrap NAT64 (`64:ff9b::/96`) or 6to4 (`2002::/16`) IPv6 transition addresses, both of which deterministically embed a private IPv4 that the OS kernel routes internally. This affects all Koel deployments through v9.7.0 on NAT64 or dual-stack networks (the default for IPv6-only AWS and GCP subnets); a detailed proof-of-concept with verbatim server output is published in the advisory. No public exploit code is in KEV at time of analysis, but the PoC substantially lowers the exploitation barrier.
Authenticated blind SSRF in Koel v9.6.0 allows any logged-in user to trigger server-side HTTP requests to private, loopback, and RFC1918 destinations by exploiting a missing SafeUrl validation guard on the Subsonic-compatible createPodcastChannel.view route. The main podcast API correctly rejects private URLs with a 422 error, but the Subsonic compatibility layer omits the same SafeUrl rule, and the attacker-supplied URL is fetched synchronously during channel creation via Poddle::fromUrl() - no separate step required. No public exploit identified at time of analysis per KEV status, but a fully documented public PoC with step-by-step curl commands is available in GHSA-w79m-f3jx-779v, validated against the official phanan/koel:9.6.0 Docker image.
MantisBT's REST and SOAP APIs fail to enforce the $g_set_status_threshold authorization gate, allowing any authenticated user holding the UPDATER role (the default update permission) to change an issue's workflow status to values that should require DEVELOPER-level access or higher. The vulnerability is confirmed patched in release 2.28.4 with no public exploit or KEV listing. Because UPDATER is the default role for ordinary authenticated contributors, this flaw is broadly reachable on any MantisBT instance where the API is accessible without further hardening of role assignments.
Remote code execution in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is achievable by authenticated API users holding the api.media.write permission via a double-extension file upload bypass. The HandlesMediaUploads::validateFileExtension() method uses PHP's pathinfo() to inspect only the final file extension, meaning a file named shell.php.jpg passes the dangerous-extension blocklist while retaining a .php segment that certain web server configurations will execute as PHP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and exploitation is low-complexity once permission prerequisites are met.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.
Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `'` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.
SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote attackers to manipulate backend database queries via the unsanitized `user_id` parameter in `/admin/userproductdeletequery.php`. A publicly available proof-of-concept exploit exists on GitHub, and SSVC confirms the attack is automatable with partial impact across confidentiality, integrity, and availability. Despite the public POC, EPSS stands at only 0.33% (25th percentile), reflecting the product's negligible enterprise deployment footprint rather than a benign technical profile.
Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.
OAuth provider rebinding in Easy!Appointments prior to version 1.6.0 allows any authenticated backend user - including low-privilege secretary and provider roles - to silently hijack a peer provider's Google Calendar integration by supplying an arbitrary provider_id to the OAuth initiation endpoint. The attacker completes a legitimate Google OAuth flow with their own Google account, which the application then binds to the victim provider's database row without verifying ownership. From that point forward, every appointment on the victim's schedule syncs to the attacker's Google Calendar, leaking customer names and email addresses as attendee data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side request forgery in Easy!Appointments prior to 1.6.0 allows authenticated backend users - admins, providers, or secretaries - to probe internal network hosts by supplying arbitrary URLs to the CalDAV synchronization endpoint. The Guzzle HTTP client in `Caldav.php:60` forwards a REPORT request to the caller-supplied `caldav_url` without validating the scheme or destination host, enabling access to loopback, RFC1918, and link-local addresses on the deployment network. The SSRF is semi-blind, returning up to approximately 120 bytes of upstream response body through the exception path; no public exploit has been identified, exploitation requires an active backend account, and version 1.6.0 resolves the issue.
The reschedule endpoint in Easy!Appointments 1.5.2 and earlier exposes the complete customer database record to any party holding the 12-character appointment hash, with no authentication check and no field whitelisting on the ea_users row. These hashes are deliberately distributed to customers in reschedule emails, embedded in confirmation page URLs, and visible in operator calendar links, which means the effective attacker pool is anyone who has ever received or forwarded a booking email. The fix is available in version 1.6.0 per the GitHub security advisory; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in code-projects Online Job Portal 1.0 allows a remote, low-privileged attacker to inject malicious JavaScript via the /Admin/DetailJob.php endpoint, which executes in the browser of any user who views the affected page. The CVSS 4.0 vector (PR:L/UI:P) confirms that exploitation requires an authenticated session and passive victim interaction, constraining but not eliminating real-world risk. A public proof-of-concept has been disclosed on GitHub; no patch from the vendor has been identified at time of analysis.
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/EditUser.php endpoint to remote database manipulation via the unsanitized UserId parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as remotely exploitable with no authentication or interaction required, though the Admin path location raises questions about actual auth gating in practice. A public exploit exists (E:P confirmed in CVSS 4.0 and via GitHub issue), lowering the skill bar for exploitation considerably; this CVE is not currently listed in CISA KEV.
SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized `fname` parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote attackers to manipulate backend database queries through the unsanitized 'id' parameter of customeredit.php, per the CVSS:3.1 vector (PR:N) without prior authentication. The flaw carries a critical CVSS 9.8 rating with full confidentiality, integrity, and availability impact, enabling database extraction, tampering, or destruction. There is no public exploit code, but a detailed technical write-up documenting the injection point exists, and the EPSS probability is low (0.14%, 4th percentile), indicating limited real-world exploitation interest despite the high severity.
SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.
SQL injection in the Fruits Bazar PHP/MySQLi ecommerce project 1.0 lets remote attackers inject arbitrary SQL through the product-ID parameter of /show_price_by_pdtId.php, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) allowing unauthenticated exploitation. The flaw carries a 9.8 critical score with full confidentiality, integrity, and availability impact, though its EPSS probability is only 0.15% (5th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.
Stored Cross-Site Scripting in Newsletters Lite WordPress plugin versions ≤4.15 permits authenticated attackers with contributor-level access to inject arbitrary web scripts by abusing the 'link' attribute of the post_thumbnail and newsletters_post_thumbnail shortcodes. When a privileged user accesses a page containing the injected shortcode, the script executes in their session, potentially leading to session hijacking or credential theft. No active exploitation or public proof-of-concept is identified at time of analysis.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers inject arbitrary SQL through the fname, lname, and student_class parameters of save_stud.php, enabling database read, modification, and potential full compromise of enrollment records. The flaw carries a 9.8 CVSS rating reflecting network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact. It is not in CISA KEV and its EPSS score is low (0.14%, 4th percentile); no public exploit identified at time of analysis, though an automated TaintRadar taint-analysis writeup documents the injection path.
Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized class_name parameter of update_class.php. Because the flaw is unauthenticated and network-reachable (CVSS 9.8), an attacker can read, alter, or destroy enrollment records and potentially achieve full database compromise. There is publicly available exploit code exists via a public disclosure write-up, though EPSS remains low at 0.14% (4th percentile), indicating limited observed exploitation activity.
SQL injection in kishan0725 Hospital Management System 4.0 lets attackers manipulate the 'viewid' parameter of /hms/doctor/view-patient.php to inject arbitrary SQL, exposing and altering the backend patient database. The flaw carries a CVSS 9.8 and CWE-89 classification, and publicly available exploit code exists via a TaintRadar research write-up, though it is not listed in CISA KEV and its EPSS score is only 0.14% (4th percentile). CISA's SSVC framework rates it automatable with total technical impact, meaning successful exploitation can fully compromise database confidentiality, integrity, and availability.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers inject arbitrary SQL through the 'doctor' and 'specilizationid' parameters of get_doctor.php, yielding full read/write access to the backend database. The CVSS 9.8 vector (PR:N) indicates unauthenticated network exploitation, though no public exploit is identified and EPSS remains very low at 0.15%. This is an open-source PHP/MySQL project on GitHub rather than commercial enterprise software, so real-world exposure is limited despite the critical score.
SQL injection in kishan0725's open-source PHP Hospital Management System 4.0 lets attackers manipulate the backend database via the 'fromdate' parameter of /betweendates-detailsreports.php. Because input is concatenated directly into a SQL query, an attacker can read, alter, or destroy patient and hospital records; publicly available exploit code exists (sqlmap-confirmed injection techniques documented in the TaintRadar research repository). EPSS is low (0.14%, 4th percentile) and there is no CISA KEV listing, so this is a proof-of-concept-stage issue rather than confirmed active exploitation.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets attackers manipulate the backend database through the new_password parameter of update_password.php, enabling data theft, credential tampering, and unauthorized account takeover. The flaw is a classic CWE-89 injection in a small PHP web application, with publicly available exploit code (TaintRadar/VulDB) but no public exploit confirmed as actively used. EPSS is low (0.14%, 4th percentile), consistent with a niche product that is documented but not mass-targeted.
SQL injection in kishan0725 Hospital Management System 4.0 lets remote attackers manipulate database queries through the unsanitized 'editid' GET parameter of /doctor/edit-patient.php. Successful injection can expose or alter stored patient records and potentially the whole application database. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.14%, though a public technical write-up documenting the injection point exists.
SQL injection in kishan0725's open-source Hospital Management System 4.0 lets remote attackers manipulate backend database queries through the check_availability.php endpoint via the unsanitized emailid and email parameters (CWE-89). The flaw carries a 7.3 CVSS score with a network/no-privilege vector, meaning it is reachable without authentication, though its EPSS probability is low (0.15%, 5th percentile) and no public exploit identified at time of analysis. The vulnerability is documented in the academic TaintRadar SQLi corpus but is not listed in CISA KEV.
SQL injection in the Advocate Office Management System 1.0 (a SourceCodester PHP application) lets remote unauthenticated attackers inject arbitrary SQL through the 'id' GET parameter of control/activate_case.php. Publicly available exploit code exists (SSVC exploitation status: poc), with confirmed error-based and time-based blind techniques enabling full database extraction; the 'remote code execution' framing in the report is not substantiated by the provided sqlmap payloads. EPSS is low (0.16%, 6th percentile) and the flaw is not on CISA KEV, so no active exploitation is confirmed.
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 lets remote attackers manipulate backend database queries through the unsanitized 'status' parameter of /save_user.php, enabling data theft, tampering, or authentication bypass. The flaw carries a CVSS 7.3 and a documented technical writeup exists in the TaintRadar research repository, though it is not listed in CISA KEV and its EPSS exploitation probability is very low (0.14%, 4th percentile). No vendor patch has been identified for this end-of-life hobbyist PHP application.
SQL Injection in kishan0725 Hospital Management System 4.0 exposes patient medical history records to unauthenticated remote attackers via the `viewid` parameter of the `view-medhistory.php` endpoint. The CVSS vector confirms no authentication, complexity, or user interaction is required, and the SSVC framework independently verifies a proof-of-concept exists and the attack is fully automatable. Despite a low EPSS score of 0.14%, the sensitivity of medical record data and zero-barrier exploitation make any internet-exposed instance a meaningful risk; no public exploit identified at time of analysis as confirmed active exploitation (KEV not listed).
SQL injection in Sourcecodester CASAP Automated Enrollment System 1.0 allows attackers to manipulate backend database queries through the fname and student_class parameters of update_student.php, enabling extraction or tampering of student enrollment records. The flaw carries CVSS 7.3 (network-reachable, low complexity) but is a niche PHP tutorial-grade application with negligible exploitation probability (EPSS 0.14%, 4th percentile), and no public exploit identified at time of analysis. Not listed in CISA KEV.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
Path disclosure in Quick.CMS (<=6.8.0) allows authenticated admins to expose directory structure and absolute file paths via the admin.php p parameter. The vulnerability requires high privileges and the vendor does not consider a fix necessary. No public exploit or active exploitation has been reported.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
SQL injection in the Chaty Pro WordPress plugin (up to version 3.5.5) allows authenticated attackers with subscriber-level access to extract sensitive database contents, including user credentials and configuration data. The vulnerability exists in the fetch_custom_field() function, which directly concatenates the widget_id POST parameter into a raw SQL query without using $wpdb->prepare(). No public exploit or active exploitation has been identified at the time of analysis, and the risk is elevated by the low privilege requirement.
SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via the order_by parameter of /customers/search. Under certain MySQL configurations, the flaw can escalate to remote code execution by writing a PHP webshell using INTO OUTFILE. Public exploit code exists, though no active exploitation has been reported to CISA KEV.
Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.
Information disclosure through SQL injection in Ninja Forms for WordPress versions 3.14.9 and earlier enables authenticated administrators to extract sensitive database data. The vulnerability originates from unsanitized keys in the 'settings' object when importing form files, allowing SQL payload injection via two distinct sinks. No active exploitation is confirmed, and EPSS indicates low exploitation probability.
Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.
Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.
SQL injection in CodeAstro Online Classroom 1.0 exposes the admin login endpoint `/OnlineClassroom/loginlinkadmin.php` to unauthenticated remote attackers who can manipulate the `aid` parameter to alter backend SQL queries. The practical impact extends beyond the CVSS 4.0 score of 5.5 because the vulnerable file is the admin authentication gateway, meaning successful exploitation can bypass login controls entirely and expose or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no public exploit identified at time of analysis as a KEV-confirmed active exploitation campaign, though the barrier to exploitation is now minimal.
Directory traversal in the WP Encryption WordPress plugin (all versions through 7.8.6.6) allows authenticated administrators to read arbitrary server files via the unsanitized 'imploded' parameter in le_admin.php, potentially exposing credentials, API keys, and configuration secrets. Beyond file-read access, the plugin's write path sanitizes output only through esc_html() - which blocks PHP tag execution but leaves plaintext files such as .htaccess fully writable, opening a secondary path to denial-of-service or malicious redirect injection. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA's KEV catalog; Wordfence has published an upstream changeset suggesting remediation is in progress.
Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.
Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.
Resource exhaustion in Dompdf v3.1.5 allows remote attackers to crash the PHP process by submitting a crafted HTML document containing a high-entropy PNG image encoded in Base64 at dimensions of 30,000x30,000 pixels. The attack bypasses Dompdf's dimension validation by exploiting the gap between the early-stage dimension check and the unbounded memory allocation during the rendering phase, forcing ~1.2 GB of uncompressed bitmap allocation that triggers a PHP Fatal Error or OS-level OOM kill. Publicly available exploit code exists (full PoC published in the GHSA advisory); no confirmed active exploitation in CISA KEV at time of analysis.
Uncontrolled resource consumption in dompdf's BMP image processing pipeline allows any unauthenticated attacker who can submit HTML to a dompdf-powered endpoint to exhaust server memory and stall PHP-FPM worker pools with a 169-byte HTTP request. The library trusts attacker-controlled BMP header dimensions without bounding width × height, causing PHP's GD extension to allocate a full native pixel canvas - bypassing PHP's memory_limit entirely because GD allocates through its own native allocator. A publicly available, verified proof-of-concept demonstrates ~12× memory amplification (34 MB control vs ~412 MB attack peak RSS) from identically-sized requests, making this a high-impact, low-effort denial-of-service primitive. No active exploitation confirmed in CISA KEV at time of analysis.
Dompdf's chroot filesystem restriction is bypassed by embedding SVG content as a base64-encoded data-URI, enabling any external user who controls HTML input to read arbitrary image files from the server filesystem and exfiltrate them via the rendered PDF output. The attack exploits a two-stage validation gap: dompdf's data:// protocol handler applies no chroot rules, and the downstream php-svg-lib dependency - invoked with allowExternalReferences forced to true - calls file_get_contents() with zero chroot awareness. A complete working proof-of-concept is published in the GitHub security advisory (GHSA-cx96-42px-69fm); no public exploit identified beyond the advisory PoC, and no active exploitation confirmed at time of analysis.
File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.
Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescription.php` endpoint to database manipulation via the unsanitized `editid` parameter, exploitable by remote authenticated users. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for exploitation. No CISA KEV listing is present; the CVSS 4.0 score of 2.1 reflects low impact across all dimensions, likely constrained by the database user's privileges or the limited data scope accessible through this endpoint.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the `day` parameter in `/BSIS.php`. The CVSS 4.0 score of 2.1 reflects constrained real-world impact — user interaction is required and integrity impact is low — though a public proof-of-concept has been disclosed via a GitHub issue, confirming exploitability. No active exploitation has been confirmed via CISA KEV.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `day` argument in /class.php, requiring only passive user interaction (UI:P). Publicly available exploit code exists per VulDB submission and a referenced GitHub proof-of-concept issue, though no CISA KEV listing has been issued. The CVSS 4.0 score of 2.1 reflects the narrow impact profile — limited integrity effect on the vulnerable system only, with no confidentiality or availability consequences recorded.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the `/web/web_file/upload.php` endpoint to unauthenticated remote attackers who can upload arbitrary file types - including PHP webshells - enabling effective remote code execution on the device. The CVSS 4.0 base vector confirms no authentication, user interaction, or special attack conditions are required (PR:N/UI:N/AC:L). A public exploit has been disclosed (CVSS 4.0 E:P modifier, corroborated by a referenced Feishu exploit document), and the DNS-320 is an end-of-life device for which no vendor patch has been identified, leaving exposed deployments persistently vulnerable.
Arbitrary file read via path traversal in FreeScout's App Logs feature exposes any server-local file readable by the PHP process to authenticated administrators prior to version 1.8.224. The bundled `rap2hpoutre/laravel-log-viewer` override decrypts a user-supplied `dl` parameter and resolves its absolute path before applying the intended `storage/logs` directory restriction, allowing the restriction to be bypassed entirely. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation could expose sensitive server files such as environment credentials or application secrets.
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_schoolyr.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or complexity barrier, and publicly available exploit code exists, referenced on GitHub. While KEV listing is absent and per-CIA impact is rated Low across all pillars, the combination of zero-barrier remote access and a live POC makes this a credible threat for any internet-exposed instance.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_subject.php` endpoint to unauthenticated remote exploitation via the unsanitized `id` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network access with no authentication or user interaction required against default installations. A public proof-of-concept exploit has been disclosed on GitHub, substantially lowering the skill threshold for exploitation; however, this vulnerability is not currently listed in CISA KEV, so confirmed active exploitation has not been established.
Unrestricted file upload in SourceCodester Pizzafy Ecommerce System 1.0 exposes the admin panel's `save_settings` function to arbitrary file upload via the `img` parameter in `/admin/admin_class_novo.php`. The CVSS 4.0 vector (PR:H) confirms exploitation requires authenticated administrator-level access, but once achieved, a PHP webshell can be uploaded to the server and potentially executed, escalating effective impact well beyond the base score's conservative VC:L/VI:L ratings. No public exploit code and no CISA KEV listing exist at time of analysis.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.
Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.
Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_room1.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate database queries via the `delid` parameter of `/prescriptionorderdetail.php`. An authenticated low-privilege user can extract, alter, or delete sensitive patient and prescription records stored in the backend database. A public exploit proof-of-concept is available on GitHub (E:P per CVSS 4.0), lowering the barrier to exploitation; however, no CISA KEV listing has been identified, and the overall impact is bounded to low-level confidentiality, integrity, and availability effects.
Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected `wp2pcl_ajax_process_request_inner` AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible `tmp/` directory at a predictable URL, exposing `wp-config.php` database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.
Plaintext credential exposure in Frogman's audit logging pipeline allows any authenticated low-privilege user holding PERM_READ access to recover passwords and extension secrets set by administrative operations. Frogman versions prior to 1.6.2 encode full tool response payloads - including the plaintext password returned by fm_reset_password and the plaintext secret returned by fm_add_extension - directly into the oc_audit_log.detail column via auditOutcome in Frogman.class.php. Because fm_audit_search was gated only at PERM_READ rather than PERM_ADMIN, any read-tier caller could query historical audit entries and extract those credentials. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 6.5 reflects the authenticated-but-low-privilege access requirement and high confidentiality impact.
Authorization bypass in RafyMrX TOKO-ONLINE-ROTI allows a low-privileged remote attacker to manipulate the `kd_cs` parameter in `proses/add.php` to access or modify data belonging to other customers, a classic CWE-639 Insecure Direct Object Reference pattern. The application up to commit ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 is confirmed affected, with no vendor patch available after the vendor failed to respond to responsible disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity of parameter manipulation makes this trivially reproducible with standard HTTP tooling.
Authenticated injection of TIME_TRACKING and REMINDER note types in MantisBT's SOAP and REST APIs allows UPDATER-level users to corrupt billing data and falsify project records. The `note_type` integer parameter supplied by the caller is passed directly to `bugnote_add()` in the SOAP endpoint - and through `mc_issue_update()` in the REST API - without verifying the caller holds sufficient privilege to create that note type. Attackers with UPDATER access can inject arbitrary billable hours into MantisBT's billing reports, generating fraudulent invoices, and can register fake REMINDER notes via SOAP. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.28.4.
Authorization bypass in MantisBT's SOAP API, REST API, and web-based bug update interface allows authenticated lower-privileged users to assign unreleased product versions to issues, circumventing the `report_issues_for_unreleased_versions_threshold` access control. All three issue-update pathways in versions 2.28.3 and earlier were unprotected: the SOAP handler (`mc_issue_api.php`), the web form (`bug_update.php`), and the REST command layer (`IssueAddCommand.php`). No public exploit code and no active exploitation (CISA KEV) have been identified; vendor-released patch version 2.28.4 closes all three vectors.
Full-read SSRF in Koel's podcast subscription feature allows any authenticated user to coerce the server into fetching internal HTTP endpoints - including cloud instance metadata services - and receive the full response. The vulnerability exists because PHP's `filter_var` with `FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE` does not unwrap NAT64 (`64:ff9b::/96`) or 6to4 (`2002::/16`) IPv6 transition addresses, both of which deterministically embed a private IPv4 that the OS kernel routes internally. This affects all Koel deployments through v9.7.0 on NAT64 or dual-stack networks (the default for IPv6-only AWS and GCP subnets); a detailed proof-of-concept with verbatim server output is published in the advisory. No public exploit code is in KEV at time of analysis, but the PoC substantially lowers the exploitation barrier.
Authenticated blind SSRF in Koel v9.6.0 allows any logged-in user to trigger server-side HTTP requests to private, loopback, and RFC1918 destinations by exploiting a missing SafeUrl validation guard on the Subsonic-compatible createPodcastChannel.view route. The main podcast API correctly rejects private URLs with a 422 error, but the Subsonic compatibility layer omits the same SafeUrl rule, and the attacker-supplied URL is fetched synchronously during channel creation via Poddle::fromUrl() - no separate step required. No public exploit identified at time of analysis per KEV status, but a fully documented public PoC with step-by-step curl commands is available in GHSA-w79m-f3jx-779v, validated against the official phanan/koel:9.6.0 Docker image.
MantisBT's REST and SOAP APIs fail to enforce the $g_set_status_threshold authorization gate, allowing any authenticated user holding the UPDATER role (the default update permission) to change an issue's workflow status to values that should require DEVELOPER-level access or higher. The vulnerability is confirmed patched in release 2.28.4 with no public exploit or KEV listing. Because UPDATER is the default role for ordinary authenticated contributors, this flaw is broadly reachable on any MantisBT instance where the API is accessible without further hardening of role assignments.
Remote code execution in the Grav API plugin (getgrav/grav-plugin-api) before 1.0.3 is achievable by authenticated API users holding the api.media.write permission via a double-extension file upload bypass. The HandlesMediaUploads::validateFileExtension() method uses PHP's pathinfo() to inspect only the final file extension, meaning a file named shell.php.jpg passes the dangerous-extension blocklist while retaining a .php segment that certain web server configurations will execute as PHP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and exploitation is low-complexity once permission prerequisites are met.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.
Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `'` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.
SQL injection in SourceCodester Simple and Nice Shopping Cart Script 1.0 enables remote attackers to manipulate backend database queries via the unsanitized `user_id` parameter in `/admin/userproductdeletequery.php`. A publicly available proof-of-concept exploit exists on GitHub, and SSVC confirms the attack is automatable with partial impact across confidentiality, integrity, and availability. Despite the public POC, EPSS stands at only 0.33% (25th percentile), reflecting the product's negligible enterprise deployment footprint rather than a benign technical profile.
Path traversal in DedeCMS 5.7.118's Album Publishing Feature allows remote attackers with administrative credentials to read or write files outside the intended extraction directory by manipulating the `filename` argument passed to the `ExtractFile` function in `include/zip.class.php`. A public proof-of-concept exploit has been released on GitHub, lowering the skill bar for exploitation, though no active exploitation has been confirmed in the CISA KEV catalog. The CVSS 4.0 score of 5.1 with PR:H reflects the high privilege requirement, which materially limits the exposed attack surface to authenticated admin-level sessions.
OAuth provider rebinding in Easy!Appointments prior to version 1.6.0 allows any authenticated backend user - including low-privilege secretary and provider roles - to silently hijack a peer provider's Google Calendar integration by supplying an arbitrary provider_id to the OAuth initiation endpoint. The attacker completes a legitimate Google OAuth flow with their own Google account, which the application then binds to the victim provider's database row without verifying ownership. From that point forward, every appointment on the victim's schedule syncs to the attacker's Google Calendar, leaking customer names and email addresses as attendee data. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-side request forgery in Easy!Appointments prior to 1.6.0 allows authenticated backend users - admins, providers, or secretaries - to probe internal network hosts by supplying arbitrary URLs to the CalDAV synchronization endpoint. The Guzzle HTTP client in `Caldav.php:60` forwards a REPORT request to the caller-supplied `caldav_url` without validating the scheme or destination host, enabling access to loopback, RFC1918, and link-local addresses on the deployment network. The SSRF is semi-blind, returning up to approximately 120 bytes of upstream response body through the exception path; no public exploit has been identified, exploitation requires an active backend account, and version 1.6.0 resolves the issue.
The reschedule endpoint in Easy!Appointments 1.5.2 and earlier exposes the complete customer database record to any party holding the 12-character appointment hash, with no authentication check and no field whitelisting on the ea_users row. These hashes are deliberately distributed to customers in reschedule emails, embedded in confirmation page URLs, and visible in operator calendar links, which means the effective attacker pool is anyone who has ever received or forwarded a booking email. The fix is available in version 1.6.0 per the GitHub security advisory; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site scripting in code-projects Online Job Portal 1.0 allows a remote, low-privileged attacker to inject malicious JavaScript via the /Admin/DetailJob.php endpoint, which executes in the browser of any user who views the affected page. The CVSS 4.0 vector (PR:L/UI:P) confirms that exploitation requires an authenticated session and passive victim interaction, constraining but not eliminating real-world risk. A public proof-of-concept has been disclosed on GitHub; no patch from the vendor has been identified at time of analysis.
Unrestricted file upload in code-projects Online Job Portal 1.0 exposes unauthenticated remote attackers to arbitrary file upload via the txtFile parameter in /JobSeekerInsert.php, enabling likely webshell deployment and subsequent server-side code execution. A public proof-of-concept exploit exists (no KEV listing), substantially lowering the exploitation barrier for any internet-exposed instance. The CVSS 4.0 impact metrics are conservatively rated Low across C/I/A, which understates the realistic post-exploitation potential of an unrestricted PHP file upload - successful webshell placement typically yields full OS command execution in the web server process context.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/DeleteUser.php endpoint to unauthenticated remote database manipulation. An attacker can craft HTTP requests that inject arbitrary SQL, enabling data extraction, modification, or deletion from the underlying database. A public proof-of-concept exploit exists (GitHub: shihuizhang-dazhi/MY-CVE/issues/4), lowering the bar for exploitation; this vulnerability is not currently listed in CISA KEV.
SQL injection in code-projects Online Job Portal 1.0 exposes the /Admin/EditUser.php endpoint to remote database manipulation via the unsanitized UserId parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) classifies this as remotely exploitable with no authentication or interaction required, though the Admin path location raises questions about actual auth gating in practice. A public exploit exists (E:P confirmed in CVSS 4.0 and via GitHub issue), lowering the skill bar for exploitation considerably; this CVE is not currently listed in CISA KEV.
SQL injection in itsourcecode Electronic Judging System 1.0 exposes the admin panel endpoint /intrams/admin/add_judges.php to database manipulation via the unsanitized `fname` parameter. Authenticated remote attackers can craft malicious input to read, alter, or potentially enumerate backend database contents. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 base score of 2.1 (Low), reflecting the authenticated access prerequisite and limited-scope CIA impact.