PHP
Monthly
Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.
Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.
Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.
Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.
Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.
Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers
Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.
Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.
Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.
Code injection in ZZCMS 2025 Backend Website Settings Module allows authenticated remote attackers to inject arbitrary code via the icp parameter in the stripfxg function (/admin/siteconfig.php), with limited confidentiality impact. Public exploit code is available, but exploitation requires high-privilege administrative access, significantly limiting practical attack surface despite network-accessible vector.
ZZCMS 2025 stores sensitive user data in cleartext within the User Data Storage Module at /reg/user_save.php, allowing remote attackers with high-level privileges to retrieve unencrypted credentials or personal information from disk. The vulnerability has a published exploit available, though the extremely low EPSS score (0.02%) and requirement for authenticated high-privilege access suggest minimal real-world exploitation risk despite public proof-of-concept availability.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
Stored cross-site scripting (XSS) in VK Google Job Posting Manager WordPress plugin versions up to 1.2.22 allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators. The vulnerability requires user interaction (clicking a link or viewing a malicious page) to trigger payload execution and affects the plugin's web page generation functionality. EPSS probability of exploitation is notably low at 0.04%, suggesting this is primarily a theoretical risk without documented active exploitation.
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Code injection in CTCMS up to version 2.1.2 allows high-privilege authenticated remote attackers to inject arbitrary code via manipulation of the Cj_Add or Cj_Edit arguments in the Backend System Configuration Module (/ctcms/libs/Ct_Config.php). Public exploit code is available, but exploitation requires administrative credentials and produces only low confidentiality impact without scope expansion. EPSS score of 0.07% indicates minimal real-world exploitation probability despite public POC availability.
Code injection in CTCMS up to version 2.1.2 allows high-privileged remote attackers to inject arbitrary code via the CT_App_Paytype parameter in the Backend App Configuration Module's Save function. The vulnerability has a low CVSS score (2.0) due to requiring high administrative privileges (PR:H), but publicly available exploit code exists. Real-world risk is limited to authenticated administrators with backend access.
Stored cross-site scripting (XSS) vulnerability in vion707 DMadmin backend allows high-privilege authenticated users to inject malicious scripts via the Add function in AddonsController, affecting the application's integrity. The vulnerability requires user interaction (UI:P) and high-privilege access (PR:H), limiting real-world exploitation risk despite a network attack vector. Public exploit code is available, but the extremely low CVSS score (1.9) and EPSS probability (0.05th percentile) suggest minimal practical risk in typical deployments.
Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
Command injection in DedeBIZ up to version 6.5.9 allows authenticated high-privilege administrators to execute arbitrary system commands via the /src/admin/catalog_add.php endpoint. The vulnerability requires high-privilege authentication (PR:H in CVSS v4.0) and has publicly available exploit code, but real-world risk is constrained by the authentication requirement and limited scope of impact (CVSS 2.0, EPSS 0.28%).
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
SQL injection in Online Pet Shop Management System 1.0 (by itsourcecode/Facebook Riares) allows unauthenticated remote attackers to manipulate database queries via the `cnpname` parameter in `/pet1/addcnp.php`. A public proof-of-concept exploit exists on GitHub. Despite the PR:N CVSS vector indicating no authentication is required, real-world risk is constrained by the product's negligible deployment footprint - this is a freely distributed PHP student/demo project, not enterprise software. EPSS of 0.05% (15th percentile) reflects the low likelihood of opportunistic exploitation.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
PHP object injection in Doubly Cross Domain Copy Paste plugin (≤1.0.46) allows authenticated attackers with Subscriber-level privileges to execute arbitrary code via deserialized untrusted input from uploaded ZIP archives. Exploitation requires administrators to explicitly enable Subscriber access. Available POP chains enable code execution, file deletion, and sensitive data retrieval. Attack vector requires low privilege (PR:L) authentication with network accessibility and no user interaction. No public exploit identified at time of analysis.
SQL injection in itsourcecode COVID Tracking System 1.0 allows remote attackers to manipulate database queries via the Username parameter of the Admin Login page. A public exploit is available, but the EPSS exploitation probability is very low (0.05%), and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at this time. The flaw can lead to unauthorized data access or authentication bypass.
Unrestricted file upload in Campcodes Student Enrollment 1.0 allows remote attackers to upload arbitrary files via the photo parameter at the /admin/register.php endpoint. The vulnerability enables potential remote code execution by uploading malicious scripts (e.g., a PHP web shell). A publicly available exploit exists, but no active exploitation has been reported by CISA KEV.
Unrestricted file upload in campcodes Online Student Enrollment System 1.0 allows high-privileged authenticated users to upload arbitrary files via the userphoto parameter in /admin/index.php?page=user-profile, potentially enabling remote code execution or data exfiltration. Public exploit code is available, though the vulnerability's real-world impact is limited by the requirement for administrative credentials and low CVSS/EPSS scores.
Reflected cross-site scripting (XSS) in Qualitor up to version 8.24.73 allows authenticated remote attackers to inject malicious scripts via the cdscript parameter in /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php, exploitable only with user interaction (e.g., clicking a malicious link). While publicly available exploit code exists and the vendor has confirmed and patched the issue, the low CVSS score (2.0) and requirement for both authentication and user interaction significantly limit real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via an unsanitized ID parameter in /update_account.php, potentially leading to unauthorized data modification or access. Public exploit code is available, but EPSS indicates low exploitation probability.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in haxxorsid Stock-Management-System up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the employee_id, id, or admin parameters in model/User.php. The vulnerability has a low CVSS score (2.1) due to limited scope and impact, but carries low but non-zero exploitation probability (EPSS 0.05%). Public exploit code exists and the product is no longer maintained, eliminating vendor-supplied patch availability.
Remote SQL injection in kidaze CourseSelectionSystem through an unknown function in /Profilers/SProfile/reg.php allows unauthenticated attackers to manipulate database queries via the USN parameter. A proof-of-concept exploit is publicly available, but EPSS data indicates a low exploitation probability (0.05%); no active exploitation has been reported.
SQL injection in kidaze CourseSelectionSystem allows unauthenticated remote attackers to execute arbitrary SQL commands via the Username parameter in the login endpoint /Profilers/SProfile/login1.php. Public exploit code is available, though EPSS indicates a very low probability of widespread exploitation. The vulnerability has low confidentiality, integrity, and availability impacts according to CVSS v4.0 scoring.
SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.
SQL injection vulnerability in the Class and Exam Timetable Management System v1.0 login page allows remote, unauthenticated attackers to inject arbitrary SQL via the username and password fields in /index.php. Exploit code is publicly available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates a low exploitation probability.
Unrestricted file upload in SourceCodester Real Estate Property Listing App 1.0 allows high-privileged authenticated users to upload arbitrary files via the image parameter in /admin/property.php, potentially leading to remote code execution. The vulnerability affects only administrators or high-privilege accounts due to PR:H requirements, but public exploit code exists and EPSS scoring indicates low real-world exploitation probability (0.07th percentile).
Remote SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated attackers to manipulate the 'pid' argument in /admin/admin_running.php, leading to potential data exposure or modification. Exploit code is publicly available but no active exploitation has been confirmed (not in CISA KEV); the EPSS score of 0.05% indicates low probability of widespread exploitation despite the low attack complexity and no authentication requirement.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
Unrestricted file upload in baowzh hfly allows authenticated remote attackers to upload arbitrary files via manipulation of the imgFile parameter in /Public/Kindeditor/php/upload_json.php. The vulnerability affects rolling-release versions up to commit 638ff9abe9078bc977c132b37acbe1900b63491c, carries low overall risk (CVSS 2.1, EPSS 0.07%), and has publicly available exploit code but requires authenticated access, significantly limiting real-world exploitability compared to unauthenticated file upload scenarios.
Path traversal vulnerability in baowzh hfly allows authenticated remote attackers to read arbitrary files via manipulation of the filename parameter in the /admin/index.php/datafile/download endpoint. The vulnerability affects versions up to commit 638ff9abe9078bc977c132b37acbe1900b63491c, with publicly available exploit code disclosed and no vendor response to early disclosure notification. CVSS score of 2.1 reflects limited confidentiality impact but the low EPSS (0.15%) suggests minimal real-world exploitation despite public disclosure.
Arbitrary file deletion via path traversal in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated remote attackers to delete files by manipulating the filename parameter in /admin/index.php/datafile/delfile. The vulnerability has public exploit code available but remains low-risk due to authentication requirement and limited scope (information integrity impact only).
Stored cross-site scripting (XSS) in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated users with user interaction to inject malicious scripts via the /admin/index.php/advtext/add endpoint in the advtext module. Public exploit code is available, and the vulnerability carries a low CVSS score of 2.0 due to authentication and user-interaction requirements, but the EPSS score of 0.05% indicates minimal real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtunitDetails parameter in /admin/add_unit.php. Public exploit code is available, but EPSS indicates low exploitation probability (0.05%) and it is not listed in CISA KEV.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate database queries via the `txtDistributorAddress` parameter in `/admin/add_distributor.php`. Public exploit code is available, though the EPSS score indicates a very low probability of widespread exploitation.
Shopware, an open commerce platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication controller where the 'waitTime' URL parameter from the login page is rendered directly into the Twig template without validation or sanitization. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 are affected, allowing attackers to inject malicious JavaScript code through crafted URLs. With an EPSS score of only 0.04% (11th percentile), active exploitation appears low despite the availability of patches and public advisories.
SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
Broken access control in OpenSIS 9.2 and earlier lets an authenticated low-privilege user (e.g. a student account) issue unauthorized database writes against other users' records via Student.php, enabling horizontal privilege escalation and tampering with data they should not control. Publicly available exploit code exists for this issue, though it is not listed in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no confirmed widespread exploitation yet.
Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.
Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.
Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.
Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.
Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.
Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers
Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.
Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.
Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.
Code injection in ZZCMS 2025 Backend Website Settings Module allows authenticated remote attackers to inject arbitrary code via the icp parameter in the stripfxg function (/admin/siteconfig.php), with limited confidentiality impact. Public exploit code is available, but exploitation requires high-privilege administrative access, significantly limiting practical attack surface despite network-accessible vector.
ZZCMS 2025 stores sensitive user data in cleartext within the User Data Storage Module at /reg/user_save.php, allowing remote attackers with high-level privileges to retrieve unencrypted credentials or personal information from disk. The vulnerability has a published exploit available, though the extremely low EPSS score (0.02%) and requirement for authenticated high-privilege access suggest minimal real-world exploitation risk despite public proof-of-concept availability.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
Stored cross-site scripting (XSS) in VK Google Job Posting Manager WordPress plugin versions up to 1.2.22 allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators. The vulnerability requires user interaction (clicking a link or viewing a malicious page) to trigger payload execution and affects the plugin's web page generation functionality. EPSS probability of exploitation is notably low at 0.04%, suggesting this is primarily a theoretical risk without documented active exploitation.
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Code injection in CTCMS up to version 2.1.2 allows high-privilege authenticated remote attackers to inject arbitrary code via manipulation of the Cj_Add or Cj_Edit arguments in the Backend System Configuration Module (/ctcms/libs/Ct_Config.php). Public exploit code is available, but exploitation requires administrative credentials and produces only low confidentiality impact without scope expansion. EPSS score of 0.07% indicates minimal real-world exploitation probability despite public POC availability.
Code injection in CTCMS up to version 2.1.2 allows high-privileged remote attackers to inject arbitrary code via the CT_App_Paytype parameter in the Backend App Configuration Module's Save function. The vulnerability has a low CVSS score (2.0) due to requiring high administrative privileges (PR:H), but publicly available exploit code exists. Real-world risk is limited to authenticated administrators with backend access.
Stored cross-site scripting (XSS) vulnerability in vion707 DMadmin backend allows high-privilege authenticated users to inject malicious scripts via the Add function in AddonsController, affecting the application's integrity. The vulnerability requires user interaction (UI:P) and high-privilege access (PR:H), limiting real-world exploitation risk despite a network attack vector. Public exploit code is available, but the extremely low CVSS score (1.9) and EPSS probability (0.05th percentile) suggest minimal practical risk in typical deployments.
Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
Command injection in DedeBIZ up to version 6.5.9 allows authenticated high-privilege administrators to execute arbitrary system commands via the /src/admin/catalog_add.php endpoint. The vulnerability requires high-privilege authentication (PR:H in CVSS v4.0) and has publicly available exploit code, but real-world risk is constrained by the authentication requirement and limited scope of impact (CVSS 2.0, EPSS 0.28%).
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
SQL injection in Online Pet Shop Management System 1.0 (by itsourcecode/Facebook Riares) allows unauthenticated remote attackers to manipulate database queries via the `cnpname` parameter in `/pet1/addcnp.php`. A public proof-of-concept exploit exists on GitHub. Despite the PR:N CVSS vector indicating no authentication is required, real-world risk is constrained by the product's negligible deployment footprint - this is a freely distributed PHP student/demo project, not enterprise software. EPSS of 0.05% (15th percentile) reflects the low likelihood of opportunistic exploitation.
SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.
SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.
Reflected cross-site scripting (XSS) in WPS Visitor Counter WordPress plugin through version 1.4.8 allows remote attackers to inject malicious scripts via the REQUEST_URI parameter, which is output without sanitization in HTML attributes. The vulnerability has a CVSS score of 5.8 and requires user interaction (clicking a crafted link), with exploitation limited primarily to older web browsers due to modern XSS protections. No public exploit code or active exploitation has been identified at the time of analysis.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.
SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.
SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.
SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).
Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.
Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.
PHP object injection in Doubly Cross Domain Copy Paste plugin (≤1.0.46) allows authenticated attackers with Subscriber-level privileges to execute arbitrary code via deserialized untrusted input from uploaded ZIP archives. Exploitation requires administrators to explicitly enable Subscriber access. Available POP chains enable code execution, file deletion, and sensitive data retrieval. Attack vector requires low privilege (PR:L) authentication with network accessibility and no user interaction. No public exploit identified at time of analysis.
SQL injection in itsourcecode COVID Tracking System 1.0 allows remote attackers to manipulate database queries via the Username parameter of the Admin Login page. A public exploit is available, but the EPSS exploitation probability is very low (0.05%), and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at this time. The flaw can lead to unauthorized data access or authentication bypass.
Unrestricted file upload in Campcodes Student Enrollment 1.0 allows remote attackers to upload arbitrary files via the photo parameter at the /admin/register.php endpoint. The vulnerability enables potential remote code execution by uploading malicious scripts (e.g., a PHP web shell). A publicly available exploit exists, but no active exploitation has been reported by CISA KEV.
Unrestricted file upload in campcodes Online Student Enrollment System 1.0 allows high-privileged authenticated users to upload arbitrary files via the userphoto parameter in /admin/index.php?page=user-profile, potentially enabling remote code execution or data exfiltration. Public exploit code is available, though the vulnerability's real-world impact is limited by the requirement for administrative credentials and low CVSS/EPSS scores.
Reflected cross-site scripting (XSS) in Qualitor up to version 8.24.73 allows authenticated remote attackers to inject malicious scripts via the cdscript parameter in /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php, exploitable only with user interaction (e.g., clicking a malicious link). While publicly available exploit code exists and the vendor has confirmed and patched the issue, the low CVSS score (2.0) and requirement for both authentication and user interaction significantly limit real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via an unsanitized ID parameter in /update_account.php, potentially leading to unauthorized data modification or access. Public exploit code is available, but EPSS indicates low exploitation probability.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.
SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.
SQL injection in haxxorsid Stock-Management-System up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the employee_id, id, or admin parameters in model/User.php. The vulnerability has a low CVSS score (2.1) due to limited scope and impact, but carries low but non-zero exploitation probability (EPSS 0.05%). Public exploit code exists and the product is no longer maintained, eliminating vendor-supplied patch availability.
Remote SQL injection in kidaze CourseSelectionSystem through an unknown function in /Profilers/SProfile/reg.php allows unauthenticated attackers to manipulate database queries via the USN parameter. A proof-of-concept exploit is publicly available, but EPSS data indicates a low exploitation probability (0.05%); no active exploitation has been reported.
SQL injection in kidaze CourseSelectionSystem allows unauthenticated remote attackers to execute arbitrary SQL commands via the Username parameter in the login endpoint /Profilers/SProfile/login1.php. Public exploit code is available, though EPSS indicates a very low probability of widespread exploitation. The vulnerability has low confidentiality, integrity, and availability impacts according to CVSS v4.0 scoring.
SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.
SQL injection vulnerability in the Class and Exam Timetable Management System v1.0 login page allows remote, unauthenticated attackers to inject arbitrary SQL via the username and password fields in /index.php. Exploit code is publicly available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates a low exploitation probability.
Unrestricted file upload in SourceCodester Real Estate Property Listing App 1.0 allows high-privileged authenticated users to upload arbitrary files via the image parameter in /admin/property.php, potentially leading to remote code execution. The vulnerability affects only administrators or high-privilege accounts due to PR:H requirements, but public exploit code exists and EPSS scoring indicates low real-world exploitation probability (0.07th percentile).
Remote SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated attackers to manipulate the 'pid' argument in /admin/admin_running.php, leading to potential data exposure or modification. Exploit code is publicly available but no active exploitation has been confirmed (not in CISA KEV); the EPSS score of 0.05% indicates low probability of widespread exploitation despite the low attack complexity and no authentication requirement.
SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.
Unrestricted file upload in baowzh hfly allows authenticated remote attackers to upload arbitrary files via manipulation of the imgFile parameter in /Public/Kindeditor/php/upload_json.php. The vulnerability affects rolling-release versions up to commit 638ff9abe9078bc977c132b37acbe1900b63491c, carries low overall risk (CVSS 2.1, EPSS 0.07%), and has publicly available exploit code but requires authenticated access, significantly limiting real-world exploitability compared to unauthenticated file upload scenarios.
Path traversal vulnerability in baowzh hfly allows authenticated remote attackers to read arbitrary files via manipulation of the filename parameter in the /admin/index.php/datafile/download endpoint. The vulnerability affects versions up to commit 638ff9abe9078bc977c132b37acbe1900b63491c, with publicly available exploit code disclosed and no vendor response to early disclosure notification. CVSS score of 2.1 reflects limited confidentiality impact but the low EPSS (0.15%) suggests minimal real-world exploitation despite public disclosure.
Arbitrary file deletion via path traversal in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated remote attackers to delete files by manipulating the filename parameter in /admin/index.php/datafile/delfile. The vulnerability has public exploit code available but remains low-risk due to authentication requirement and limited scope (information integrity impact only).
Stored cross-site scripting (XSS) in baowzh hfly up to commit 638ff9abe9078bc977c132b37acbe1900b63491c allows authenticated users with user interaction to inject malicious scripts via the /admin/index.php/advtext/add endpoint in the advtext module. Public exploit code is available, and the vulnerability carries a low CVSS score of 2.0 due to authentication and user-interaction requirements, but the EPSS score of 0.05% indicates minimal real-world exploitation probability despite public availability of proof-of-concept code.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtunitDetails parameter in /admin/add_unit.php. Public exploit code is available, but EPSS indicates low exploitation probability (0.05%) and it is not listed in CISA KEV.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate database queries via the `txtDistributorAddress` parameter in `/admin/add_distributor.php`. Public exploit code is available, though the EPSS score indicates a very low probability of widespread exploitation.
Shopware, an open commerce platform, contains a reflected cross-site scripting (XSS) vulnerability in its authentication controller where the 'waitTime' URL parameter from the login page is rendered directly into the Twig template without validation or sanitization. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 are affected, allowing attackers to inject malicious JavaScript code through crafted URLs. With an EPSS score of only 0.04% (11th percentile), active exploitation appears low despite the availability of patches and public advisories.
SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.
SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score
SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).
Broken access control in OpenSIS 9.2 and earlier lets an authenticated low-privilege user (e.g. a student account) issue unauthorized database writes against other users' records via Student.php, enabling horizontal privilege escalation and tampering with data they should not control. Publicly available exploit code exists for this issue, though it is not listed in CISA KEV and carries a low EPSS score (0.26%, 18th percentile), indicating no confirmed widespread exploitation yet.