PHP

CVE-2025-8509 Aug 03, 13:15 LOW POC Monitor

A vulnerability was found in Portabilis i-Educar 2.9. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8508 Aug 03, 11:15 LOW POC Monitor

A vulnerability was found in Portabilis i-Educar 2.9. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8507 Aug 03, 10:15 LOW POC Monitor

A vulnerability was found in Portabilis i-Educar 2.9. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8504 Aug 03, 08:15 LOW POC Monitor

A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8503 Aug 03, 07:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8502 Aug 03, 07:15 MEDIUM POC This Month

A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8501 Aug 03, 06:15 LOW POC Monitor

A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8500 Aug 03, 05:15 LOW POC Monitor

A vulnerability was found in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8499 Aug 03, 05:15 MEDIUM POC This Month

A vulnerability was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8498 Aug 03, 04:15 MEDIUM POC This Month

A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8497 Aug 03, 04:15 MEDIUM POC This Month

A weakness has been identified in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8496 Aug 03, 04:15 MEDIUM POC This Month

A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8495 Aug 03, 02:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8494 Aug 03, 00:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8493 Aug 02, 23:15 MEDIUM POC This Month

A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8471 Aug 02, 19:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8470 Aug 02, 18:15 MEDIUM POC This Month

A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8469 Aug 02, 17:15 MEDIUM POC This Month

A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8468 Aug 02, 15:15 MEDIUM POC This Month

A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-7710 Aug 02, 12:15 CRITICAL This Week

The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-7500 Aug 02, 12:15 MEDIUM This Month

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8467 Aug 02, 11:15 MEDIUM POC This Month

A vulnerability was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8488 Aug 02, 10:15 MEDIUM Monitor

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-6722 Aug 02, 10:15 MEDIUM This Month

The BitFire Security - Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_*. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-8466 Aug 02, 09:15 MEDIUM POC This Month

A vulnerability was found in code-projects Online Farm System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8400 Aug 02, 09:15 MEDIUM This Month

The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-8399 Aug 02, 09:15 MEDIUM This Month

The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8391 Aug 02, 09:15 MEDIUM This Month

The Magic Edge - Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-6832 Aug 02, 09:15 MEDIUM This Month

The All in One Time Clock Lite - Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-8317 Aug 02, 08:15 MEDIUM This Month

The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8152 Aug 02, 08:15 MEDIUM This Month

The WP CTA - Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_cta_status' and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-6626 Aug 02, 08:15 MEDIUM Monitor

The ShortPixel Adaptive Images - WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2025-4588 Aug 02, 08:15 MEDIUM This Month

The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8146 Aug 02, 05:15 MEDIUM This Month

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-7694 Aug 02, 04:15 MEDIUM This Month

The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() function in all versions up to, and. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2025-50870 Aug 01, 18:15 CRITICAL Act Now

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-50869 Aug 01, 18:15 MEDIUM This Month

A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-50868 Aug 01, 18:15 MEDIUM This Month

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-52390 Aug 01, 16:15 CRITICAL Act Now

Saurus CMS Community Edition since commit d886e5b0 (2010-04-23) is vulnerable to a SQL Injection vulnerability in the `prepareSearchQuery()` method in `FulltextSearch.class.php`. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-52327 Aug 01, 16:15 HIGH This Week

SQL Injection vulnerability in Restaurant Order System 1.0 allows a local attacker to obtain sensitive information via the payment.php file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2025-44139 Aug 01, 16:15 HIGH POC This Week

Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dangerous Type via /emlog/admin/plugin.php?action=upload_zip. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-41376 Aug 01, 13:15 MEDIUM This Month

CRLF Injection vulnerability in Limesurvey v2.65.1+170522. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-41375 Aug 01, 13:15 CRITICAL Act Now

SQL Injection vulnerability in Limesurvey v2.65.1+170522. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-41374 Aug 01, 13:15 HIGH This Week

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-41373 Aug 01, 13:15 HIGH POC This Week

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-41372 Aug 01, 13:15 HIGH This Month

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-41371 Aug 01, 13:15 CRITICAL This Week

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-41370 Aug 01, 13:15 CRITICAL This Week

A SQL injection vulnerability has been found in Gandia Integra Total of TESI from version 2.1.2217.3 to v4.4.2236.1. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-6228 Aug 01, 12:15 MEDIUM This Month

The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-4684 Aug 01, 12:15 MEDIUM This Month

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites - Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8443 Aug 01, 09:15 MEDIUM POC This Month

A vulnerability was found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8442 Aug 01, 08:15 MEDIUM POC This Month

A vulnerability has been found in code-projects Online Medicine Guide 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8441 Aug 01, 08:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, was found in code-projects Online Medicine Guide 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8439 Aug 01, 07:15 MEDIUM POC This Month

A vulnerability, which was classified as critical, has been found in code-projects Wazifa System 1.0.php. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8438 Aug 01, 07:15 MEDIUM POC This Month

A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8437 Aug 01, 07:15 MEDIUM POC This Month

A vulnerability classified as critical has been found in code-projects Kitchen Treasure 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-7646 Aug 01, 07:15 MEDIUM This Month

The The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-8436 Aug 01, 06:15 MEDIUM POC This Month

A vulnerability was found in projectworlds Online Admission System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-5921 Aug 01, 06:15 MEDIUM This Month

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2025-8435 Aug 01, 05:15 MEDIUM POC This Month

A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-7845 Aug 01, 05:15 MEDIUM This Month

The Stratum - Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-7725 Aug 01, 05:15 HIGH This Week

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery - Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-7443 Aug 01, 05:15 HIGH This Week

The BerqWP - Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2025-4523 Aug 01, 05:15 MEDIUM PATCH This Month

The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view(). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2025-8434 Aug 01, 04:16 MEDIUM POC This Month

A vulnerability was found in code-projects Online Movie Streaming 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8433 Aug 01, 04:16 LOW POC Monitor

A vulnerability was found in code-projects Document Management System 1.0 and classified as critical.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-5947 Aug 01, 04:16 CRITICAL POC Act Now

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-5954 Aug 01, 03:15 CRITICAL This Week

The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-8431 Aug 01, 02:15 MEDIUM POC This Month

A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2025-8409 Jul 31, 16:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 exposes the `/filter.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `from` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept exploit is disclosed on GitHub. Despite the trivial exploitation conditions, EPSS at 0.07% (20th percentile) and absence from the CISA KEV catalog indicate no observed widespread exploitation at time of analysis.

CVE-2025-8408 Jul 31, 15:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate the `vehicle` parameter in `/filter1.php` to execute arbitrary SQL against the backend database. A public exploit was disclosed on GitHub, and the CVSS 4.0 E:P supplemental metric confirms publicly available exploit code, though EPSS remains low at 0.07% (20th percentile), reflecting the obscure deployment footprint of this educational PHP project. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.

CVE-2025-8407 Jul 31, 14:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the unsanitized `from` parameter in /filter2.php. A publicly available proof-of-concept exploit is documented on GitHub, making exploitation trivial against any network-exposed instance. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.07% (20th percentile) reflects the product's niche deployment footprint rather than low severity - the underlying flaw class is serious but real-world exposure is narrow.

CVE-2025-8382 Jul 31, 12:15 LOW POC Monitor

SQL injection in Campcodes Online Hotel Reservation System 1.0 allows authenticated remote attackers to manipulate the room_id parameter in /admin/edit_room.php, enabling data exfiltration and modification with low impact. The vulnerability requires valid login credentials (PR:L) and carries a CVSS 2.1 score reflecting limited scope; however, the public exploit disclosure and EPSS percentile 20 suggest limited real-world exploitation interest despite active availability of proof-of-concept code.

CVE-2025-8381 Jul 31, 12:15 LOW POC Monitor

SQL injection in Campcodes Online Hotel Reservation System 1.0 via the room_id parameter in /add_reserve.php allows authenticated remote attackers to execute arbitrary SQL queries, but CVSS 2.1 and EPSS 0.07% (20th percentile) indicate minimal real-world risk despite public exploit availability. The vulnerability requires valid user authentication and produces only low confidentiality, integrity, and availability impact-inconsistent with the 'critical' classification in the initial report.

CVE-2025-8380 Jul 31, 11:15 LOW POC Monitor

Cross-site scripting (XSS) in Campcodes Online Hotel Reservation System 1.0 allows authenticated users to inject malicious scripts via the Name parameter in /admin/add_query_account.php, affecting the integrity of admin-level functionality. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct remote exploitation to attackers with valid credentials; however, publicly available exploit code exists, and the CVSS 2.0 score with VI:L (integrity impact) reflects limited but confirmed damage potential in a stored XSS context.

CVE-2025-8379 Jul 31, 11:15 LOW POC Monitor

Unrestricted file upload in Campcodes Online Hotel Reservation System 1.0 allows high-privileged authenticated administrators to upload arbitrary files via the photo parameter in /admin/edit_room.php, potentially leading to remote code execution. The vulnerability requires administrative credentials to exploit and has publicly available proof-of-concept code, but carries low real-world risk due to the high privilege requirement (PR:H) and limited confidentiality/integrity impact in the CVSS v4.0 vector.

CVE-2025-8378 Jul 31, 10:15 MEDIUM POC This Month

SQL injection in the login endpoint of Campcodes Online Hotel Reservation System 1.0 enables unauthenticated remote attackers to manipulate the username and password parameters submitted to /admin/index.php, potentially bypassing authentication entirely or extracting the underlying database. A public proof-of-concept exploit is confirmed via GitHub, meaningfully lowering the barrier to attack. Despite the PoC availability, EPSS sits at just 0.07% (21st percentile), consistent with the niche deployment footprint of this PHP educational software rather than suppressed exploitation.

CVE-2025-8376 Jul 31, 10:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 exposes the `/updatebal.php` endpoint to remote, unauthenticated database manipulation via the unsanitized `company` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or user interaction is required, and a public proof-of-concept is available on GitHub. Despite the reporter's 'critical' classification, the CVSS 4.0 score of 5.5 with limited CIA impact ratings and an EPSS of 0.07% (20th percentile) indicate low observed exploitation activity; real-world risk is further constrained by the product's narrow deployment footprint as a PHP demo/student project.

CVE-2025-8375 Jul 31, 09:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 allows remote unauthenticated attackers to manipulate the `vehicle` parameter in /addvehicle.php to execute arbitrary SQL against the backend database. The flaw is network-accessible with no authentication required (PR:N, AV:N per CVSS 4.0 vector) and a public proof-of-concept has been disclosed on GitHub. Despite the public exploit and no-auth attack path, EPSS sits at just 0.07% (20th percentile) and this product is absent from CISA KEV, consistent with the application's extremely limited real-world deployment footprint.

CVE-2025-8374 Jul 31, 09:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 exposes the `/addcompany.php` endpoint to unauthenticated remote attackers who can manipulate the `company` parameter to execute arbitrary SQL queries against the backend database. The vulnerability (CWE-74) is trivially exploitable with no authentication or user interaction required per the CVSS 4.0 vector (PR:N/UI:N/AV:N), and a proof-of-concept has been publicly disclosed on GitHub. While not listed in CISA KEV and carrying a low EPSS score of 0.07%, the public POC elevates opportunistic exploitation risk for any internet-exposed instances.

CVE-2025-8373 Jul 31, 08:15 MEDIUM POC This Month

SQL injection in code-projects Vehicle Management 1.0 exposes the `/print.php` endpoint to remote unauthenticated database manipulation via the unsanitized `sno` parameter. Any attacker with network access to the application can craft malicious HTTP requests to read or modify backend database contents without authentication, as confirmed by the CVSS 4.0 PR:N metric. A public proof-of-concept exploit is available on GitHub, though the EPSS score of 0.07% (20th percentile) indicates limited automated exploitation activity at this time; no CISA KEV listing is present.

CVE-2025-8372 Jul 31, 08:15 MEDIUM POC This Month

SQL injection in code-projects Exam Form Submission 1.0 exposes the application's database to remote manipulation through the credits parameter of /admin/update_s7.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for exploitation. Despite a network-accessible attack vector with no confirmed authentication barrier, real-world risk is constrained by the product's extremely limited deployment footprint - it is a PHP academic demo project with negligible enterprise presence.

CVE-2025-8371 Jul 31, 07:15 MEDIUM POC This Month

SQL injection in code-projects Exam Form Submission 1.0 allows remote attackers to manipulate the backend database via the `credits` parameter in `/admin/update_s5.php`. The CVSS 4.0 vector assigns PR:N, though the admin-prefixed endpoint path introduces ambiguity about authentication enforcement. A publicly available proof-of-concept exploit exists on GitHub, though EPSS sits at just 0.07% (20th percentile), reflecting limited real-world interest likely tied to the product's narrow deployment footprint. No vendor patch has been identified at time of analysis.

CVE-2025-8370 Jul 31, 07:15 LOW POC Monitor

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the descricao parameter in /intranet/educar_escolaridade_lst.php, requiring user interaction to execute. The vulnerability has a low CVSS score of 2.1 and EPSS exploitation probability of 0.11%, but publicly available exploit code exists and the vendor did not respond to early disclosure.

CVE-2025-8369 Jul 31, 06:15 LOW POC Monitor

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the titulo_avaliacao parameter in /intranet/educar_avaliacao_desempenho_lst.php. The vulnerability requires user interaction (clicking a malicious link) but has a low CVSS score of 2.1 and a minimal EPSS exploitation probability of 0.11%, placing it in the 29th percentile. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.

CVE-2025-8368 Jul 31, 06:15 LOW POC Monitor

Reflected cross-site scripting in Portabilis i-Educar 2.9 allows remote attackers to inject arbitrary JavaScript via the campo_busca and cpf parameters in /intranet/pesquisa_pessoa_lst.php. The vulnerability requires user interaction (clicking a malicious link) but enables session hijacking, credential theft, or defacement of educational records. Publicly available exploit code exists; the vendor did not respond to disclosure.

CVE-2025-8367 Jul 31, 05:15 LOW POC Monitor

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the 'nome' parameter in /intranet/funcionario_vinculo_lst.php. The vulnerability requires user interaction (clicking a malicious link) but enables session hijacking, credential theft, and unauthorized administrative actions. Public exploit code is available, though EPSS probability remains low at 0.11% percentile, suggesting limited real-world exploitation despite disclosure.

CVE-2025-8366 Jul 31, 05:15 LOW POC Monitor

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote unauthenticated attackers to inject arbitrary JavaScript via the nome or matricula_servidor parameters in /intranet/educar_servidor_lst.php. The vulnerability requires user interaction (clicking a malicious link) and has low confidentiality impact but can lead to session hijacking or credential theft. Publicly available exploit code exists, though exploitation likelihood remains low (EPSS 0.11%) due to user interaction requirement and limited real-world impact surface.

CVE-2025-8365 Jul 31, 04:16 LOW POC Monitor

Stored cross-site scripting (XSS) in Portabilis i-Educar 2.10 via the atendidos_cad.php file allows authenticated remote attackers with user interaction to inject malicious scripts through the nome, nome_social, or email parameters, resulting in minor integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.

CVE-2025-8346 Jul 31, 03:15 LOW POC Monitor

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.10 allows remote unauthenticated attackers to inject arbitrary JavaScript via the ref_cod_matricula parameter in /educar_aluno_lst.php, affecting users who click malicious links. The vulnerability has publicly available exploit code and a low CVSS score (2.1) due to requirement for user interaction, but represents a typical web application flaw in educational management systems with potential for credential theft or session hijacking.