PHP
Monthly
The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. [CVSS 4.3 MEDIUM]
A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. [CVSS 6.3 MEDIUM]
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /student/index.php enables unauthenticated remote attackers to query or manipulate the database. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet. [CVSS 5.3 MEDIUM]
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Code injection in iCMS up to version 8.0.0 allows remote attackers with high privileges to inject arbitrary code via the config POST parameter in the ConfigAdmincp.php component. The vulnerability affects the Save function's parameter handling and has publicly available exploit code, though the extremely low CVSS score (2.0) reflects the requirement for high-privileged authenticated access, limiting real-world risk despite public exploit availability.
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the `keyword` argument in the Search API Endpoint's `like` function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).
Missing authorization in PHPGurukul Small CRM 4.0's /admin/edit-user.php endpoint allows authenticated users to perform unauthorized administrative actions via remote network access. The vulnerability enables privilege escalation or lateral movement by bypassing access controls on user management functions. While publicly available exploit code exists and CVSS indicates network accessibility, the low EPSS score (0.02%, 4th percentile) and requirement for prior authentication suggest limited real-world exploitation despite proof-of-concept availability.
PHP deserialization in EyouCMS up to version 1.7.7 allows authenticated remote attackers to pass a malicious serialized payload via the `attstr` argument to the `arcpagelist` handler in `application/api/controller/Ajax.php`, where the application calls PHP's `unserialize()` on unvalidated input. A public proof-of-concept exploit has been published and is available, lowering the barrier for opportunistic attackers. The vendor has acknowledged the flaw and committed to a fix in the upcoming v1.7.8 release; no confirmed active exploitation (KEV) has been recorded, and EPSS remains at 0.06%, indicating low observed in-the-wild activity at time of analysis.
Cross-site scripting in EyouCMS up to version 1.7.7 allows a low-privileged remote attacker to inject malicious script content via the `content` argument in the Ask Module (`application/home/model/Ask.php`), which executes in the browser of any user who subsequently views the injected submission. A public proof-of-concept is available, though EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate minimal observed exploitation despite the public PoC. The vendor has acknowledged the flaw and committed to releasing v1.7.8 as the fix, though that release has not been independently confirmed as available at time of analysis.
Server-side request forgery (SSRF) in EyouCMS versions up to 1.7.7 allows authenticated remote attackers to manipulate the saveRemote function in application/function.php, enabling arbitrary HTTP requests from the server. The vulnerability carries low confidentiality, integrity, and availability impact but is publicly exploitable with proof-of-concept code available. Vendor has acknowledged the flaw and committed to releasing patched version 1.7.8.
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
SQL injection in itsourcecode Society Management System 1.0 exposes the /admin/add_admin.php endpoint to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The vulnerability is classified under CWE-74 (Injection) and a publicly available proof-of-concept has been published on GitHub, though EPSS sits at a low 0.04% (11th percentile) and it is not listed in CISA KEV, indicating no confirmed widespread exploitation. Given the product's hobbyist/academic PHP codebase and limited deployment footprint, real-world impact is likely narrow but trivially exploitable wherever the system is running.
SQL injection in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter in the edit_admin_query function at /admin/edit_admin_query.php. The affected product is a free PHP-based web application distributed by itsourcecode.com, pinned at version 1.0 with no patch released. Publicly available exploit code exists per the GitHub PoC reference, though EPSS sits at 0.04% (11th percentile), indicating limited observed exploitation activity in the wild despite disclosure.
Server-side request forgery in FeehiCMS 2.1.1 and earlier exposes the bundled TimThumb image-processing script to unauthenticated remote exploitation via a crafted src parameter. An attacker can coerce the application server to issue arbitrary HTTP requests, enabling enumeration of internal network services and cloud metadata endpoints. Exploit code has been publicly disclosed per VulDB submission 718278; EPSS remains very low at 0.04% (14th percentile) and no CISA KEV entry exists, suggesting limited opportunistic exploitation at time of analysis.
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
Stored cross-site scripting (XSS) in Campcodes Park Ticketing System 1.0 allows high-privileged users to inject malicious scripts via the name/ride parameter in the save_pricing function of admin_class.php, affecting user sessions with user interaction. Publicly available exploit code exists, though EPSS scoring (0.02%) and high privilege requirement (PR:H) suggest limited real-world exploitation likelihood despite the low CVSS score of 1.9.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the chkId[] parameter in /admin/view_products.php, potentially leading to data exposure, modification, or service disruption. The vulnerability has publicly available exploit code and a low EPSS score (0.04%), with no indication of active exploitation.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtAreaCode parameter in /admin/add_area.php. A public exploit is available, but no active exploitation in CISA KEV and EPSS probability is very low (0.04%). Attackers can extract or modify database contents with low impact to confidentiality, integrity, and availability per CVSS.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'searchdata' parameter in the admin invoice search page. An attacker with high privileges can craft a request that, when viewed by another admin, executes malicious scripts, potentially leading to session hijacking or defacement. The vulnerability has a publicly available exploit but requires user interaction and administrative access.
Remote path traversal in GreenCMS up to version 2.3 allows authenticated high-privilege attackers to manipulate the sqlFiles/zipFiles parameters in the File Handler component, leading to unauthorized file access or modification. The vulnerability is exploitable over the network but requires administrative access; public exploit code exists, yet no active exploitation is confirmed. GreenCMS is end-of-life and no longer supported.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
Code injection in CmsEasy up to 7.7.7 allows remote attackers with administrative access to execute arbitrary code through the template management feature. The vulnerability exists in the savetemp_action function, which improperly handles the 'content' and 'tempdata' parameters, and a public exploit is available. Exploitation requires high privileges, no active exploitation has been reported, and EPSS indicates very low exploitation probability.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
SQL injection in the open-source PHP exam application onlinemcqexam (by saiftheboss7) allows remote attackers to manipulate database queries via the ans1 and ans2 parameters of the admin question-addition endpoint /admin/quesadd.php. A public exploit has been disclosed via GitHub, meaning exploitation is not theoretical - any internet-exposed instance with an accessible admin panel is at immediate risk of data exfiltration or manipulation. The vendor did not respond to responsible disclosure, and no patch has been released; the product uses a rolling-release model pinned at commit 0e56806.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Code injection in ChenJinchuang Lin-CMS-TP5 up to 0.3.3 allows authenticated low-privileged attackers to execute arbitrary code remotely. The flaw resides in the file upload handler
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
Unrestricted file upload in jackq XCMS allows high-privilege authenticated users to upload arbitrary files via the ProductImageController component, with publicly available exploit code disclosed. Despite a CVSS score of 2.0 reflecting the high authentication requirement (PR:H), the vulnerability enables authenticated administrators to bypass intended upload restrictions and potentially achieve remote code execution by uploading malicious files. The vendor has been informed via public issue report but has not yet responded with a fix.
Unrestricted file upload in jackq XCMS allows unauthenticated remote attackers to upload arbitrary files via the plupload example script, leading to arbitrary code execution. The vulnerability affects all rolling-release installations up to commit 3fab5342 and has published exploit code. No vendor patch is available, and the project has not responded to reports.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database queries via the /customer_details.php endpoint. A public exploit is available, but the EPSS score is low (0.01%) and no active exploitation has been confirmed through CISA KEV.
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
The All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs - My Sticky Elements plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'my_sticky_elements_bulks' function in all versions up to, and including, 2.3.3. [CVSS 4.3 MEDIUM]
A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.php. [CVSS 6.3 MEDIUM]
SQL injection in itsourcecode School Management System 1.0 via the ID parameter in /student/index.php enables unauthenticated remote attackers to query or manipulate the database. Public exploit code exists for this vulnerability, and no patch is currently available, leaving all installations at risk.
The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an attacker to log in to any user (when knowing their email address) when such user does not have an account on disqus.com yet. [CVSS 5.3 MEDIUM]
Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Code injection in iCMS up to version 8.0.0 allows remote attackers with high privileges to inject arbitrary code via the config POST parameter in the ConfigAdmincp.php component. The vulnerability affects the Save function's parameter handling and has publicly available exploit code, though the extremely low CVSS score (2.0) reflects the requirement for high-privileged authenticated access, limiting real-world risk despite public exploit availability.
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the `keyword` argument in the Search API Endpoint's `like` function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).
Missing authorization in PHPGurukul Small CRM 4.0's /admin/edit-user.php endpoint allows authenticated users to perform unauthorized administrative actions via remote network access. The vulnerability enables privilege escalation or lateral movement by bypassing access controls on user management functions. While publicly available exploit code exists and CVSS indicates network accessibility, the low EPSS score (0.02%, 4th percentile) and requirement for prior authentication suggest limited real-world exploitation despite proof-of-concept availability.
PHP deserialization in EyouCMS up to version 1.7.7 allows authenticated remote attackers to pass a malicious serialized payload via the `attstr` argument to the `arcpagelist` handler in `application/api/controller/Ajax.php`, where the application calls PHP's `unserialize()` on unvalidated input. A public proof-of-concept exploit has been published and is available, lowering the barrier for opportunistic attackers. The vendor has acknowledged the flaw and committed to a fix in the upcoming v1.7.8 release; no confirmed active exploitation (KEV) has been recorded, and EPSS remains at 0.06%, indicating low observed in-the-wild activity at time of analysis.
Cross-site scripting in EyouCMS up to version 1.7.7 allows a low-privileged remote attacker to inject malicious script content via the `content` argument in the Ask Module (`application/home/model/Ask.php`), which executes in the browser of any user who subsequently views the injected submission. A public proof-of-concept is available, though EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate minimal observed exploitation despite the public PoC. The vendor has acknowledged the flaw and committed to releasing v1.7.8 as the fix, though that release has not been independently confirmed as available at time of analysis.
Server-side request forgery (SSRF) in EyouCMS versions up to 1.7.7 allows authenticated remote attackers to manipulate the saveRemote function in application/function.php, enabling arbitrary HTTP requests from the server. The vulnerability carries low confidentiality, integrity, and availability impact but is publicly exploitable with proof-of-concept code available. Vendor has acknowledged the flaw and committed to releasing patched version 1.7.8.
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
SQL injection in itsourcecode Society Management System 1.0 exposes the /admin/add_admin.php endpoint to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The vulnerability is classified under CWE-74 (Injection) and a publicly available proof-of-concept has been published on GitHub, though EPSS sits at a low 0.04% (11th percentile) and it is not listed in CISA KEV, indicating no confirmed widespread exploitation. Given the product's hobbyist/academic PHP codebase and limited deployment footprint, real-world impact is likely narrow but trivially exploitable wherever the system is running.
SQL injection in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter in the edit_admin_query function at /admin/edit_admin_query.php. The affected product is a free PHP-based web application distributed by itsourcecode.com, pinned at version 1.0 with no patch released. Publicly available exploit code exists per the GitHub PoC reference, though EPSS sits at 0.04% (11th percentile), indicating limited observed exploitation activity in the wild despite disclosure.
Server-side request forgery in FeehiCMS 2.1.1 and earlier exposes the bundled TimThumb image-processing script to unauthenticated remote exploitation via a crafted src parameter. An attacker can coerce the application server to issue arbitrary HTTP requests, enabling enumeration of internal network services and cloud metadata endpoints. Exploit code has been publicly disclosed per VulDB submission 718278; EPSS remains very low at 0.04% (14th percentile) and no CISA KEV entry exists, suggesting limited opportunistic exploitation at time of analysis.
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
Stored cross-site scripting (XSS) in Campcodes Park Ticketing System 1.0 allows high-privileged users to inject malicious scripts via the name/ride parameter in the save_pricing function of admin_class.php, affecting user sessions with user interaction. Publicly available exploit code exists, though EPSS scoring (0.02%) and high privilege requirement (PR:H) suggest limited real-world exploitation likelihood despite the low CVSS score of 1.9.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the chkId[] parameter in /admin/view_products.php, potentially leading to data exposure, modification, or service disruption. The vulnerability has publicly available exploit code and a low EPSS score (0.04%), with no indication of active exploitation.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtAreaCode parameter in /admin/add_area.php. A public exploit is available, but no active exploitation in CISA KEV and EPSS probability is very low (0.04%). Attackers can extract or modify database contents with low impact to confidentiality, integrity, and availability per CVSS.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.
Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'searchdata' parameter in the admin invoice search page. An attacker with high privileges can craft a request that, when viewed by another admin, executes malicious scripts, potentially leading to session hijacking or defacement. The vulnerability has a publicly available exploit but requires user interaction and administrative access.
Remote path traversal in GreenCMS up to version 2.3 allows authenticated high-privilege attackers to manipulate the sqlFiles/zipFiles parameters in the File Handler component, leading to unauthorized file access or modification. The vulnerability is exploitable over the network but requires administrative access; public exploit code exists, yet no active exploitation is confirmed. GreenCMS is end-of-life and no longer supported.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
Code injection in CmsEasy up to 7.7.7 allows remote attackers with administrative access to execute arbitrary code through the template management feature. The vulnerability exists in the savetemp_action function, which improperly handles the 'content' and 'tempdata' parameters, and a public exploit is available. Exploitation requires high privileges, no active exploitation has been reported, and EPSS indicates very low exploitation probability.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
SQL injection in the open-source PHP exam application onlinemcqexam (by saiftheboss7) allows remote attackers to manipulate database queries via the ans1 and ans2 parameters of the admin question-addition endpoint /admin/quesadd.php. A public exploit has been disclosed via GitHub, meaning exploitation is not theoretical - any internet-exposed instance with an accessible admin panel is at immediate risk of data exfiltration or manipulation. The vendor did not respond to responsible disclosure, and no patch has been released; the product uses a rolling-release model pinned at commit 0e56806.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Code injection in ChenJinchuang Lin-CMS-TP5 up to 0.3.3 allows authenticated low-privileged attackers to execute arbitrary code remotely. The flaw resides in the file upload handler
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
Unrestricted file upload in jackq XCMS allows high-privilege authenticated users to upload arbitrary files via the ProductImageController component, with publicly available exploit code disclosed. Despite a CVSS score of 2.0 reflecting the high authentication requirement (PR:H), the vulnerability enables authenticated administrators to bypass intended upload restrictions and potentially achieve remote code execution by uploading malicious files. The vendor has been informed via public issue report but has not yet responded with a fix.
Unrestricted file upload in jackq XCMS allows unauthenticated remote attackers to upload arbitrary files via the plupload example script, leading to arbitrary code execution. The vulnerability affects all rolling-release installations up to commit 3fab5342 and has published exploit code. No vendor patch is available, and the project has not responded to reports.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database queries via the /customer_details.php endpoint. A public exploit is available, but the EPSS score is low (0.01%) and no active exploitation has been confirmed through CISA KEV.
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Cross-site scripting (XSS) via unsanitized firstname and lastname parameters in /profile.php of code-projects Student Information System 1.0 allows authenticated remote attackers with user interaction to inject malicious scripts affecting confidentiality. The vulnerability carries a low CVSS score (2.0) due to authentication and user interaction requirements, but publicly available exploit code exists and EPSS analysis assigns 0.06% exploitation probability, reflecting limited real-world attack likelihood despite public POC availability.
Unauthenticated file upload vulnerability in code-projects Student File Management System 1.0 allows authenticated remote attackers to bypass file upload restrictions via manipulation of the File parameter in /save_file.php, despite the CVSS v4.0 score of 2.1 reflecting only low confidentiality, integrity, and availability impact with no scope change. The exploit is publicly available and the low EPSS score (0.09%, 25th percentile) suggests limited real-world exploitation attempts despite public disclosure.
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.