PHP

CVE-2025-6467 is a critical SQL injection vulnerability in code-projects Online Bidding System version 1.0 affecting the /login.php file's User parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially compromise data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score of 7.3 indicates high severity, the attack requires no authentication or user interaction, making it highly exploitable in real-world scenarios.

CVE-2025-6458 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, affecting the /admin/execedituser.php endpoint. An unauthenticated remote attacker can manipulate the 'userid' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.

CVE-2025-6457 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0 affecting the /reservation/demo.php file, where the 'Start' parameter is unsanitized and directly used in database queries. An unauthenticated remote attacker can exploit this vulnerability to read, modify, or delete sensitive database content including guest information, reservations, and payment data. The vulnerability has been publicly disclosed with exploit code available, though specific EPSS probability and KEV/CISA inclusion status cannot be determined from provided data.

CVE-2025-6456 is a critical SQL injection vulnerability in code-projects Online Hotel Reservation System 1.0, specifically in the /reservation/order.php file's 'Start' parameter. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available, and the vulnerability is actively exploitable.

CVE-2025-6455 is a SQL injection vulnerability in code-projects Online Hotel Reservation System version 1.0, specifically in the /messageexec.php file where the 'Name' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, indicating active exploitation risk.

CVE-2025-6451 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/delete_pending.php file where the transaction_id parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, modification, or deletion of the hotel reservation database. Public exploit disclosure and active threat indicators suggest this vulnerability warrants immediate patching.

CVE-2025-6450 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System version 1.0, affecting the /admin/confirm_reserve.php endpoint where the transaction_id parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability meets criteria for active exploitation risk.

CVE-2025-6449 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System v1.0 affecting the /admin/checkout_query.php endpoint. An unauthenticated remote attacker can manipulate the 'transaction_id' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The vulnerability has been publicly disclosed with exploits available, and the CVSS 7.3 score reflects high impact across confidentiality, integrity, and availability despite moderate attack complexity.

CVE-2025-6448 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/delete_room.php endpoint. An unauthenticated remote attacker can manipulate the room_id parameter to execute arbitrary SQL queries, potentially resulting in unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with working exploits available, making active exploitation likely.

CVE-2025-6447 is a critical SQL injection vulnerability in the Simple Online Hotel Reservation System version 1.0, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system disruption. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing the risk of active exploitation.

A critical SQL injection vulnerability exists in code-projects Client Details System version 1.0, specifically in the /clientdetails/admin/index.php file where the Username parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit code available and demonstrates moderate real-world risk despite the critical classification, with a CVSS score of 7.3 indicating concrete but not maximum severity.

Unrestricted file upload in Campcodes Online Recruitment Management System 1.0 allows authenticated attackers to upload arbitrary PHP files via the /admin/ajax.php?action=save_settings endpoint, leading to remote code execution. A public exploit is available, but no active exploitation has been reported (EPSS 0.12%).

A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_account.php file where the 'name' or 'admin_id' parameters are not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of the hotel reservation database. Public exploit code is available and the vulnerability is actively being disclosed, increasing exploitation risk in the wild.

A critical SQL injection vulnerability exists in code-projects Simple Online Hotel Reservation System version 1.0, specifically in the /admin/add_room.php file where the 'room_type' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of hotel reservation system data. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.

CVE-2025-6419 is a critical SQL injection vulnerability in code-projects Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_room.php endpoint, where the 'room_type' parameter is improperly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL commands. The vulnerability has a CVSS score of 7.3 with public proof-of-concept code available, indicating active exploitation risk and widespread discoverability.

CVE-2025-6418 is a critical SQL injection vulnerability in Simple Online Hotel Reservation System 1.0 affecting the /admin/edit_query_account.php endpoint, where the 'Name' parameter is improperly sanitized, allowing remote attackers to execute arbitrary SQL queries without authentication. The vulnerability has been publicly disclosed with exploit code availability, making it a high-priority threat for organizations running this system in production; attackers can manipulate database queries to extract sensitive data, modify records, or potentially escalate privileges.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate the awarddetails parameter in /admin/add-artist.php, potentially leading to data breach or system compromise. A public exploit is available, but no active exploitation has been reported.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage4.php. Public exploit code exists, increasing risk for instances with admin panel exposure.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage3.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage2.php. A public exploit is available, but no active exploitation has been reported (EPSS 0.08%).

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate database queries via the editid parameter in /admin/changeimage1.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage.php. A public exploit is available, but no active exploitation has been reported. The EPSS score is low (0.08%), indicating limited exploitation likelihood.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to manipulate the imageid parameter in /admin/changepropic.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.

SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the 'editid' parameter in /admin/edit-art-medium-detail.php. Public exploit code is available, increasing the risk of targeted attacks.

CVE-2025-6409 is a critical SQL injection vulnerability in PHPGurukul Art Gallery Management System 1.1 affecting the /admin/forgot-password.php endpoint. An unauthenticated remote attacker can manipulate the 'email' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. The vulnerability has been publicly disclosed with proof-of-concept availability, making it actively exploitable in the wild.

A critical SQL injection vulnerability exists in Campcodes Online Hospital Management System version 1.0 affecting the /doctor/search.php endpoint via the 'searchdata' parameter. An unauthenticated remote attacker can execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the hospital database. Public exploit disclosure and lack of authentication requirements significantly elevate real-world risk.

A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.

CVE-2025-6406 is a critical SQL injection vulnerability in Campcodes Online Hospital Management System version 1.0, specifically in the /hms/forgot-password.php endpoint where the 'fullname' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of sensitive hospital patient and administrative data. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

CVE-2025-6405 is a critical SQL injection vulnerability in Campcodes Online Teacher Record Management System version 1.0, affecting the /admin/edit-teacher-detail.php endpoint through an unsanitized 'editid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of teacher records and sensitive educational data. Public disclosure and proof-of-concept availability indicate active exploitation risk, though CVSS 7.3 reflects moderate actual impact (read/write/availability) rather than complete system compromise.

CVE-2025-6404 is a critical SQL injection vulnerability in Campcodes Online Teacher Record Management System version 1.0, specifically in the /admin/search.php file's searchdata parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the database. Public disclosure and available proof-of-concept code indicate active exploitation is possible and likely occurring.

The 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ and 'mode' parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.

CVE-2025-6403 is a critical SQL injection vulnerability in code-projects School Fees Payment System version 1.0, specifically in the /student.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of student and payment records. The vulnerability has been publicly disclosed with working exploits available, and while the CVSS score of 7.3 indicates medium-to-high severity, the SQL injection vector combined with public PoC availability presents significant real-world risk for deployed instances.

The TableOn - WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2025-5034 is a Reflected Cross-Site Scripting (XSS) vulnerability in the wp-file-download WordPress plugin versions before 6.2.6, caused by failure to sanitize and escape user-supplied parameters before output. Attackers can craft malicious URLs containing JavaScript payloads that execute in victims' browsers when clicked, potentially stealing session cookies, hijacking accounts, or performing unauthorized actions. The vulnerability requires user interaction (clicking a link) but affects all users without authentication requirements, making it a moderate-to-significant risk for WordPress installations using this plugin.

A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.

A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.

CVE-2025-6363 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /adding-exec.php file where the 'ingname' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. With a CVSS score of 7.3 and network-based attack vector requiring no user interaction, this vulnerability poses significant risk to affected deployments, though real-world exploitation likelihood depends on whether POC code and active exploitation attempts are documented.

CVE-2025-6362 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /editpro.php file where the ID parameter is improperly validated. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has a CVSS score of 7.3 (High) and requires no user interaction or authentication, making it a significant risk for deployments of this application.

CVE-2025-6361 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /adds.php file's userid parameter. An unauthenticated remote attacker can exploit this vulnerability without user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the application database. The vulnerability has a CVSS score of 7.3 (High) and represents an immediate risk to any organization running this unpatched system in production.

CVE-2025-6360 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /portal.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

CVE-2025-6359 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /cashconfirm.php file where the 'transactioncode' parameter is unsanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.

CVE-2025-34030 is a critical OS command injection vulnerability in sar2html versions 3.2.2 and earlier that allows unauthenticated remote attackers to execute arbitrary shell commands through unsanitized input in the 'plot' parameter of index.php. The vulnerability has a perfect CVSS score of 10.0 and requires no authentication, user interaction, or special privileges to exploit. Active exploitation was observed by the Shadowserver Foundation as of February 4, 2025, indicating this is not a theoretical threat.

CVE-2025-34022 is an unauthenticated path traversal vulnerability in Selea Targa IP OCR-ANPR cameras affecting at least 9 models (iZero, Targa 512, Targa 504, Targa Semplice, Targa 704 TKM, Targa 805, Targa 710 INOX, Targa 750, Targa 704 ILB). The /common/get_file.php script fails to validate the 'file' parameter, allowing remote attackers to read arbitrary files including system credentials in cleartext. Active exploitation was confirmed by Shadowserver Foundation on 2025-02-02 UTC, indicating this is not theoretical-it is actively weaponized in the wild.

CVE-2025-25037 is a critical authentication bypass vulnerability in Aquatronica Controller System that exposes an unauthenticated tcp.php endpoint, allowing remote attackers to retrieve plaintext administrative credentials and sensitive system configuration data without authentication. Affected versions include firmware ≤5.1.6 and web interface ≤2.0. Successful exploitation enables complete system compromise, including unauthorized control of connected aquarium devices and manipulation of critical parameters, representing a direct path to full administrative access with no user interaction required.

SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 contain a PHP object injection vulnerability via the SugarRestSerialize.php script. The rest_data parameter is passed to unserialize() without validation, allowing unauthenticated attackers to inject malicious PHP objects for remote code execution.

CVE-2025-6358 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, affecting the /saveorder.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, and system disruption. Public proof-of-concept code is available, increasing the immediate risk of active exploitation.

CVE-2025-6357 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /paymentportal.php file where the 'person' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability with no user interaction required to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing the likelihood of active exploitation.

CVE-2025-6356 is a critical SQL injection vulnerability in code-projects Simple Pizza Ordering System version 1.0, specifically in the /addmem.php file that allows unauthenticated remote attackers to manipulate database queries. An attacker can exploit this vulnerability to read, modify, or delete sensitive data from the underlying database. The vulnerability has public exploit code available and may be actively exploited in the wild.

CVE-2025-6355 is a critical SQL injection vulnerability in SourceCodester Online Hotel Reservation System version 1.0, specifically in the /admin/execeditroom.php file where the 'userid' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure and proof-of-concept availability significantly elevate real-world exploitation risk.

CVE-2025-6354 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0 affecting the customer signup functionality (/function/customer_signup.php). An unauthenticated remote attacker can manipulate the email parameter to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept availability and demonstrates active exploitation potential.

Cross-site scripting (XSS) in Responsive Blog 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the keyword parameter in /search.php. A public exploit exists, but no active exploitation has been reported and EPSS risk is low (0.06%).

A security vulnerability in A vulnerability classified as problematic (CVSS 5.3). Risk factors: public PoC available.

SQL injection in itsourcecode Employee Record Management System 1.0 allows remote authenticated attackers to manipulate the emp1name parameter in /editprofile.php, potentially leading to data breach or modification. A public exploit exists, but no active exploitation has been confirmed (EPSS 0.06%).

Cross-site scripting (XSS) in Responsive Blog 1.0/1.12.4/3.3.4 via the admin pageViewMembers.php allows authenticated attackers with high privileges to inject malicious scripts. A public exploit exists, but EPSS score is low (0.04%) and no active exploitation in CISA KEV.

CVE-2025-44203 is a critical information disclosure vulnerability in HotelDruid 3.0.7 that allows unauthenticated attackers to extract sensitive database credentials (administrator username, password hash, and salt) through verbose SQL error messages on the creadb.php endpoint. The vulnerability can also cause denial of service conditions that lock administrators out of the system. With a CVSS score of 7.5 and no authentication required, this poses an immediate threat to unpatched HotelDruid installations.

SQL injection in SourceCodester Advance Charity Management System 1.0 allows authenticated attackers to extract or manipulate database contents via the m06 parameter in /members/fundDetails.php. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating limited exploitation likelihood.

Stored cross-site scripting in SourceCodester My Food Recipe 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the Name parameter on the Add Recipe page. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.

CVE-2025-52715 is a PHP Local File Inclusion (LFI) vulnerability in RadiusTheme's Classified Listing plugin that allows authenticated attackers to include and execute arbitrary local files through improper filename validation in PHP include/require statements. The vulnerability affects Classified Listing versions up to 4.2.0, and while the CVSS score of 7.5 indicates high severity, exploitation requires local authentication and non-standard attack complexity, suggesting moderate real-world risk absent evidence of active exploitation or public proof-of-concept.

CVE-2025-52708 is a PHP Local File Inclusion (LFI) vulnerability in RealMag777 HUSKY versions up to 1.3.7, stemming from improper control of filenames in include/require statements. An authenticated attacker with low-to-medium privilege requirements can exploit this remotely to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS 7.5 score and requirement for authenticated access (PR:L) suggest moderate real-world risk; active exploitation status and POC availability are not confirmed from available data, but the vulnerability class (CWE-98 RFI/LFI) is historically high-value for attackers.

CVE-2025-46179 is a critical SQL injection vulnerability in CloudClassroom-PHP Project v1.0's askquery.php file, where the 'squeryx' parameter is passed directly into SQL queries without sanitization. This affects all installations of CloudClassroom-PHP v1.0 and allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to complete database compromise including data exfiltration, modification, and denial of service. The vulnerability has a CVSS 9.8 score reflecting its network-based exploitability with no authentication or user interaction required; active exploitation status and POC availability are unknown from the provided data.

CVE-2025-6344 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /contactus.php file's email parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public disclosure and exploit code availability increase the real-world threat level significantly.

CVE-2025-6343 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_product.php file where the 'pid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the shoe store's database. The exploit has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.

CVE-2025-6342 is a critical SQL injection vulnerability in code-projects Online Shoe Store 1.0, specifically in the /admin/admin_football.php file where the 'pid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it actively exploitable in the wild.

Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the Branch/Address/Detail parameters in /branch.php. A public exploit exists, but no active exploitation has been reported. The EPSS score is low (0.05%), indicating low exploitation likelihood.

A SQL injection vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.

The Beaver Builder Plugin (Starter Version) for WordPress contains an arbitrary file upload vulnerability in the 'save_enabled_icons' function due to missing file type validation, affecting all versions up to and including 2.9.1. Authenticated attackers with Administrator-level access can upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability was only partially patched in version 2.9.1, indicating residual risk in the latest release.

Command injection in DedeCMS up to 5.7.2 allows remote authenticated attackers to execute arbitrary commands via the 'notes' parameter in /include/dedetag.class.php. A public exploit exists, but no active exploitation has been confirmed. EPSS score is low (0.17%), indicating limited exploitation likelihood.

SQL injection in PHPGurukul Directory Management System 2.0 allows authenticated attackers to manipulate the adminname parameter in /admin/admin-profile.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been confirmed.

SQL injection in PHPGurukul Directory Management System 2.0 allows remote authenticated attackers to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-directory.php. A public exploit is available, increasing the risk of exploitation, though EPSS score is low (0.06%).

SQL injection in PHPGurukul Directory Management System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the searchdata parameter in /admin/search-directory.php. A public exploit is available, but no active exploitation has been reported and EPSS risk is low.

CVE-2025-6330 is a critical SQL injection vulnerability in PHPGurukul Directory Management System version 1.0, specifically in the /searchdata.php file's 'searchdata' parameter. An unauthenticated remote attacker can inject arbitrary SQL commands to compromise confidentiality, integrity, and availability of the underlying database. Public disclosure and proof-of-concept exploitation have occurred, making this an immediately actionable threat despite the moderate CVSS 7.3 score.

Authorization bypass in ScriptAndTools Real Estate Management System 1.0 allows remote authenticated attackers to delete arbitrary users by manipulating the ID parameter in userdelete.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.13%), indicating limited exploitation likelihood.

CVE-2025-6323 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, specifically affecting the /enrollment.php file's 'fathername' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the enrollment database. The vulnerability has public proof-of-concept code available and may be actively exploited in the wild.

CVE-2025-6322 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /visit.php file's 'gname' parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and confirmed POC availability significantly elevate real-world exploitation risk.

SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers with sub-admin privileges to execute arbitrary SQL commands via the sadminusername parameter in /admin/add-subadmin.php. Public exploit code is available, increasing risk for unpatched installations.

SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the classname parameter in /admin/add-class.php, potentially leading to data leakage or modification. Public exploit code is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.06%), indicating low exploitation likelihood.

The Euro FxRef Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's currency shortcode in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

SQL injection in PHPGurukul Pre-School Enrollment System 1.0 allows authenticated attackers to manipulate the tsubject parameter in /admin/add-teacher.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.

CVE-2025-6318 is a critical SQL injection vulnerability in PHPGurukul Pre-School Enrollment System version 1.0, affecting the /admin/check_availability.php file where the 'Username' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. Public disclosure of exploitation details and confirmed POC availability indicate active exploitation risk in the wild.

CVE-2025-6317 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /admin/confirm.php file's ID parameter. An unauthenticated remote attacker can execute arbitrary SQL commands with low complexity, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active attack feasibility significantly elevate real-world risk despite the moderate CVSS score of 7.3.

CVE-2025-6316 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, specifically in the /admin/admin_running.php file where the 'qty' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this flaw to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and while the CVSS score is 7.3 (high), the attack vector is network-based with low complexity, indicating active exploitation is feasible.

CVE-2025-6315 is a critical SQL injection vulnerability in code-projects Online Shoe Store version 1.0, affecting the /cart2.php endpoint via an unsanitized ID parameter. An unauthenticated remote attacker can exploit this over the network with low complexity to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or denial of service. A public proof-of-concept has been disclosed and the vulnerability may be actively exploited.

CVE-2025-6314 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0, specifically in the /pages/cat_update.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially extract, modify, or delete database contents. The vulnerability has a publicly disclosed exploit (POC available), making it an active threat with immediate exploitation risk; the CVSS 7.3 score reflects moderate-to-high severity with network-based attack capability and no authentication required.

CVE-2025-6313 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, affecting the /pages/cat_add.php endpoint where the 'Category' parameter is improperly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising data confidentiality, integrity, and availability. The vulnerability has been publicly disclosed with exploit code available and may be actively exploited in the wild.

CVE-2025-6312 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/cash_transaction.php file where the 'cid' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploitation details available, making it actively exploitable in the wild.

CVE-2025-6311 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/account_add.php endpoint. Unauthenticated remote attackers can manipulate the 'id' or 'amount' parameters to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation risk with a CVSS score of 7.3 indicating medium-to-high severity.

The Custom Post Carousels with Owl WordPress plugin before 1.4.12 uses the featherlight library and makes use of the data-featherlight attribute without sanitizing before using it.

A SQL injection vulnerability (CVSS 7.3). Risk factors: public PoC available.

SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to execute arbitrary SQL commands via the 'ambregnum' parameter in /admin/add-ambulance.php. A public exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.06%), indicating limited exploitation likelihood.

SQL injection in PHPGurukul Emergency Ambulance Hiring Portal 1.0 allows authenticated attackers to manipulate database queries via the fromdate/todate parameters in /admin/bwdates-request-report-details.php. Public exploit code exists, but EPSS score is low (0.06%) and no active exploitation has been reported.