PHP
Monthly
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated low-privilege remote attackers to manipulate database queries by injecting malicious SQL through the `productname` parameter in edit-product.php. A public proof-of-concept has been disclosed via GitHub. Despite being labelled 'critical' by the reporter, the CVSS 4.0 vector scores only 2.1, reflecting constrained low-level impact (VC:L/VI:L/VA:L) and the authentication prerequisite that limits opportunistic exploitation.
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the 'webtitle' parameter of /admin/manage-site.php enables remote attackers with low privileges to compromise the database. Exploit code is publicly available, although EPSS indicates a very low probability of widespread exploitation (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the teammember parameter in /admin/add-team.php allows remote attackers to execute arbitrary SQL commands. The vulnerability has a public exploit, but EPSS probability is low (0.04%) and it is not listed in CISA KEV, indicating no active exploitation at this time.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated attackers with low privileges to extract or manipulate database data via the teamid parameter of /admin/all-requests.php. A proof-of-concept exploit is publicly available, but EPSS estimates low exploitation likelihood (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate the teamid parameter in /admin/assigned-requests.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is very low (0.04%), indicating limited real-world risk despite the public disclosure.
SQL injection vulnerability in code-projects Voting System 1.0 allows remote authenticated attackers to manipulate the ID parameter in /admin/positions_edit.php, potentially leading to unauthorized data access or modification. A public exploit is available, but low CVSS score (2.1) and EPSS (0.04%) indicate limited real-world risk, and no active exploitation has been reported.
SQL injection in Code-projects Voting System 1.0 allows remote authenticated attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/positions_row.php. Publicly available exploit code exists, enabling data theft or manipulation.
A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.
SQL injection in FoxCMS admin Video.php allows authenticated attackers to execute arbitrary SQL via the ids parameter. Affects FoxCMS versions up to 1.2.5. Public exploit code exists, but no active exploitation has been reported to CISA KEV; EPSS probability is low (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote authenticated attackers with low privileges to manipulate the teamid parameter in /admin/completed-requests.php, potentially leading to unauthorized data access or modification. A publicly available proof-of-concept exists, but no active exploitation has been confirmed and the EPSS score indicates low real-world exploitation probability.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote attackers with low-privileged access to execute arbitrary SQL commands via the teamid parameter in /admin/new-requests.php. Exploit code is publicly available, though no active exploitation has been reported and EPSS indicates a low probability (0.04%) of widespread use.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate database queries via the teamid parameter in /admin/team-ontheway-requests.php. Exploit code is publicly available, but exploitation requires low‑privileged administrative access. EPSS remains very low (0.05%), and the vulnerability is not listed in CISA KEV.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to execute arbitrary SQL commands via the teamid parameter in /admin/workin-progress-requests.php. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA KEV and the EPSS score is very low (0.04%), indicating limited exploitation likelihood in the wild. The CVSS 4.0 base score of 2.1 reflects low impact and the requirement for low‑privilege authentication.
SQL injection in Online Fire Reporting System 1.2’s admin report page allows authenticated remote attackers to execute arbitrary SQL commands via the fromdate/todate parameters. Public exploit code is available, though EPSS indicates a low exploitation probability of 0.05% and no active exploitation has been confirmed by CISA KEV.
Authenticated SQL injection in code-projects Voting System 1.0 allows a low-privileged attacker to manipulate the description parameter in the admin panel endpoint /admin/positions_add.php, leading to unauthorized data access or modification. Public exploit code is available, but exploitation probability is very low (EPSS 0.04%) and the vector requires authentication; no active exploitation has been confirmed.
SQL injection in code-projects Voting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/voters_row.php, leading to potential database compromise. Exploit code is publicly available, and no vendor patch exists.
SQL injection in code-projects Voting System 1.0 allows authenticated low-privilege attackers to manipulate the ID parameter in /admin/voters_edit.php, potentially accessing or modifying database contents. A public exploit is available, though exploitation probability is low (EPSS 0.04%) and no active exploitation has been reported.
SQL injection in Voting System 1.0 allows remote attackers with low privileges to manipulate database queries via the firstname and lastname parameters in /admin/voters_add.php. Exploit code is publicly available but the vulnerability has a very low EPSS exploitation probability (0.04%) and no active exploitation has been confirmed by CISA KEV.
CVE-2025-7547 is a critical unrestricted file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the save_movie function in /admin/admin_class.php. An unauthenticated remote attacker can manipulate the 'cover' parameter to upload arbitrary files, potentially leading to remote code execution, data compromise, and service disruption. The exploit has been publicly disclosed and may be actively exploited in the wild.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated, low-privilege attackers to manipulate SQL queries via the ID parameter of /admin/manage-users.php. Public exploit code is available, but there is no evidence of active exploitation (not in CISA KEV). Exploitation can lead to unauthorized access, modification, or extraction of database contents, including user credentials.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
CVE-2025-7542 is a critical SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System version 3.3, located in the /admin/user-profile.php file where the 'uid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction, making it a high-priority threat for affected deployments.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/product_update.php file's image parameter handling. An unauthenticated remote attacker can upload arbitrary files without restriction, potentially leading to remote code execution, data compromise, and system availability impact. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant concern.
CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.
CVE-2025-7536 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the /pages/receipt_credit.php endpoint via the 'sid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, indicating active exploitation risk.
CVE-2025-7535 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, located in the /pages/reprint_cash.php file's 'sid' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making it an immediate threat to deployed instances.
CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable through the 'nid' GET parameter in /notice-details.php. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the application database. Public exploit disclosure and confirmed attack surface (unauthenticated, network-accessible endpoint) elevate real-world risk despite the moderate CVSS 7.3 score.
CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.
SQL injection in the /admin/bwdates-reports-details.php endpoint of Vehicle Parking Management System 1.13 allows remote authenticated attackers to manipulate the fromdate or todate parameters to execute arbitrary SQL queries, potentially compromising the database. A public proof-of-concept exploit exists, but no active exploitation has been confirmed at this time.
CVE-2025-7521 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate exploitation risk.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 exposes the admin-facing `/admin/manage-category.php` endpoint to database manipulation via an unsanitized `del` parameter. Authenticated remote attackers can craft HTTP requests to read or modify the underlying database, with a publicly available proof-of-concept exploit already disclosed. No active exploitation has been confirmed in CISA KEV at time of analysis, and the EPSS score of 0.06% places exploitation probability in the 20th percentile.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
CVE-2025-7513 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slideupdate.php endpoint, where unsanitized idSlide parameter input allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploits available, enabling attackers to read, modify, or delete database records with moderate confidentiality, integrity, and availability impact.
CVE-2025-7512 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting the /contact-back.php file's contact-name parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential with a CVSS score of 7.3.
SQL injection in Chat System 1.0 allows authenticated remote attackers with low privileges to manipulate backend database queries via the musername parameter in /user/update_account.php. Successful exploitation leads to limited confidentiality, integrity, and availability impact. A public exploit is available, but no active exploitation has been confirmed.
CVE-2025-7510 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/productadd_back.php file, where the 'namepro' parameter is improperly sanitized allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, and carries a CVSS 7.3 score indicating moderate-to-high real-world risk with low attack complexity. An attacker can extract, modify, or delete database contents without authentication, compromising confidentiality, integrity, and availability of the application.
CVE-2025-7509 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slide.php endpoint via the idSlide parameter. An unauthenticated remote attacker can exploit this with no user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7508 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/product-update.php endpoint, where the 'idProduct' parameter is improperly validated before database queries. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially exfiltrating sensitive data, modifying product information, or gaining further system access. The vulnerability has public exploit disclosure and active real-world exploitation is likely given the low attack complexity and lack of authentication requirements.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-incomingvehicle.php. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed by CISA KEV. The attack is launched remotely, with an EPSS likelihood of 0.06%, indicating very low exploitation probability despite a critical severity rating.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged authenticated remote attackers to inject arbitrary SQL via the 'del' parameter of /admin/manage-outgoingvehicle.php. This can lead to unauthorized data access or manipulation. A publicly available exploit exists, but no active exploitation (CISA KEV) is confirmed.
SQL injection in PHPGurukul Vehicle Parking Management System version 1.13 allows authenticated low-privileged attackers to manipulate database queries via the 'del' parameter in the admin panel's user management page. Exploit code is publicly available, but no active exploitation has been reported, and the EPSS score (0.06%) indicates a low likelihood of widespread exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 permits an authenticated admin-panel user to manipulate the `searchdata` parameter on `/admin/search-vehicle.php`, enabling arbitrary database reads and writes against the underlying MySQL/MariaDB instance. A public proof-of-concept is documented on GitHub; no CISA KEV listing exists. EPSS sits at 0.06% (17th percentile), consistent with the product's niche deployment footprint.
SQL injection in PHPGurukul Vehicle Parking System 1.13 allows authenticated remote attackers to manipulate database queries via the 'viewid' parameter in /admin/view-outgoingvehicle-detail.php. Successful exploitation can result in unauthorized reading or modification of data, though only low-level impacts are expected. Public exploit code exists, but active exploitation is not confirmed.
CVE-2025-7483 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /users/forgot-password.php endpoint's email parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant concern.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers to manipulate database queries via the 'vid' parameter in the /users/print.php endpoint. The vulnerability is publicly disclosed with exploit code available, though no active exploitation in the wild has been confirmed. It requires low-privilege authentication for exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows authenticated remote users to manipulate database queries by injecting malicious SQL syntax into the `firstname` parameter at `/users/profile.php`. The advisory notes additional parameters in the same file may be vulnerable, broadening the attack surface. A proof-of-concept is publicly available on GitHub, though no active exploitation is confirmed and EPSS sits at a very low 0.06%, reflecting limited real-world uptake.
CVE-2025-7480 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, located in the /users/signup.php file where the email parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, though no KEV or EPSS data is referenced in the provided intelligence.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows an authenticated attacker with low privileges to execute arbitrary SQL commands via the viewid parameter of /users/view--detail.php. A publicly available exploit exists, but no active exploitation has been reported in CISA KEV and EPSS probability is very low (0.06%).
CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.
Unrestricted file upload in Code-projects Simple Car Rental System 1.0 allows authenticated administrators to upload malicious files via /admin/add_cars.php, potentially leading to remote code execution. A public proof-of-concept exploit exists, but no active exploitation has been reported. EPSS score of 0.07% indicates low probability of widespread attacks.
CVE-2025-7476 is a critical SQL injection vulnerability in code-projects Simple Car Rental System 1.0 affecting the /admin/approve.php endpoint's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, elevating real-world risk despite the CVSS 7.3 score suggesting moderate impact.
CVE-2025-7475 is a critical SQL injection vulnerability in code-projects Simple Car Rental System version 1.0, located in the /pay.php file where the 'mpesa' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. The vulnerability has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk in real-world deployments.
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
The Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and restore-info.json. Unauthenticated attackers can discover and download complete site backups containing the database, wp-config.php with credentials, and all uploaded files.
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-7469 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the product addition functionality (/pages/product_add.php). An unauthenticated remote attacker can manipulate the 'prod_name' parameter to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely in the near term.
The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The Friends plugin for WordPress versions up to 3.5.1 contains a PHP Object Injection vulnerability in the query_vars parameter that allows authenticated subscribers and above to inject malicious serialized objects through unsafe deserialization. While the plugin itself lacks a known gadget chain (POP chain), successful exploitation depends on the presence of vulnerable code in other installed plugins or themes; if such a chain exists, attackers can achieve arbitrary file deletion, data exfiltration, or remote code execution, but exploitation requires knowledge of the site's SALT_NONCE and SALT_KEY values.
CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.
A critical SQL injection vulnerability exists in 1000projects ABC Courier Management version 1.0 affecting the /add_dealerrequest.php endpoint, where the 'Name' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it an active threat.
A remote code execution vulnerability in all (CVSS 8.8). High severity vulnerability requiring prompt remediation.
The Nokri - Job Board WordPress Theme contains a critical privilege escalation vulnerability (CVE-2025-1313) affecting all versions up to 1.6.3, where authenticated Subscriber-level users can change arbitrary user email addresses without proper identity validation. This allows attackers to reset administrator passwords and achieve complete account takeover, resulting in full WordPress site compromise. With a CVSS score of 8.8 and low attack complexity requiring only valid subscriber credentials, this vulnerability poses significant real-world risk to WordPress installations using this theme.
CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upload_handle() function due to missing file type validation, allowing unauthenticated attackers to upload malicious files and potentially achieve remote code execution. With a CVSS score of 9.8, network-accessible attack vector, and no authentication requirement, this vulnerability poses an immediate and severe threat to any WordPress installation using the affected plugin.
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.
CVE-2025-7457 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /admin/manage_movie.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising database confidentiality, integrity, and availability. Public disclosure and exploit availability elevate the risk profile significantly.
CVE-2025-7456 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /reserve.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the reservation database. Public exploit code is available, indicating active disclosure risk.
CVE-2025-7455 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /manage_reserve.php file's 'mid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active exploitation potential significantly increase real-world risk despite the moderate CVSS 7.3 score.
CVE-2025-7454 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /admin/manage_theater.php file where the ID parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the theater reservation database. The exploit has been publicly disclosed and is actively exploitable with no authentication required.
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.
CVE-2023-38327 is a security vulnerability (CVSS 5.3) that allows unauthenticated remote attackers. Remediation should follow standard vulnerability management procedures.
A SSRF vulnerability in for WordPress is vulnerable to Server-Side Request Forgery in all (CVSS 7.2). High severity vulnerability requiring prompt remediation. Vendor patch is available.
A remote code execution vulnerability in for WordPress is vulnerable to CSV Injection in all (CVSS 4.1). Remediation should follow standard vulnerability management procedures.
A SQL injection vulnerability in WPGYM - Wordpress Gym Management System (CVSS 7.5). High severity vulnerability requiring prompt remediation.
The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
SQL injection in PHPGurukul Dairy Farm Shop Management System 1.3 allows authenticated low-privilege remote attackers to manipulate database queries by injecting malicious SQL through the `productname` parameter in edit-product.php. A public proof-of-concept has been disclosed via GitHub. Despite being labelled 'critical' by the reporter, the CVSS 4.0 vector scores only 2.1, reflecting constrained low-level impact (VC:L/VI:L/VA:L) and the authentication prerequisite that limits opportunistic exploitation.
CVE-2025-7587 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cover.php endpoint where uname and psw parameters are not properly sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to data exfiltration, authentication bypass, and database manipulation. The vulnerability has been publicly disclosed with working exploits available, making active exploitation highly probable in the wild.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the 'webtitle' parameter of /admin/manage-site.php enables remote attackers with low privileges to compromise the database. Exploit code is publicly available, although EPSS indicates a very low probability of widespread exploitation (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 via the teammember parameter in /admin/add-team.php allows remote attackers to execute arbitrary SQL commands. The vulnerability has a public exploit, but EPSS probability is low (0.04%) and it is not listed in CISA KEV, indicating no active exploitation at this time.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated attackers with low privileges to extract or manipulate database data via the teamid parameter of /admin/all-requests.php. A proof-of-concept exploit is publicly available, but EPSS estimates low exploitation likelihood (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate the teamid parameter in /admin/assigned-requests.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV. EPSS probability is very low (0.04%), indicating limited real-world risk despite the public disclosure.
SQL injection vulnerability in code-projects Voting System 1.0 allows remote authenticated attackers to manipulate the ID parameter in /admin/positions_edit.php, potentially leading to unauthorized data access or modification. A public exploit is available, but low CVSS score (2.1) and EPSS (0.04%) indicate limited real-world risk, and no active exploitation has been reported.
SQL injection in Code-projects Voting System 1.0 allows remote authenticated attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/positions_row.php. Publicly available exploit code exists, enabling data theft or manipulation.
A vulnerability has been found in Zavy86 WikiDocs up to 1.0.77 and classified as critical. Affected by this vulnerability is the function image_drop_upload_ajax/image_delete_ajax of the file submit.php. The manipulation leads to path traversal. The attack can be launched remotely. Upgrading to version 1.0.78 is able to address this issue. The identifier of the patch is 98ea9ee4a2052c4327f89d2f7688cc1b5749450d. It is recommended to upgrade the affected component.
SQL injection in FoxCMS admin Video.php allows authenticated attackers to execute arbitrary SQL via the ids parameter. Affects FoxCMS versions up to 1.2.5. Public exploit code exists, but no active exploitation has been reported to CISA KEV; EPSS probability is low (0.04%).
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote authenticated attackers with low privileges to manipulate the teamid parameter in /admin/completed-requests.php, potentially leading to unauthorized data access or modification. A publicly available proof-of-concept exists, but no active exploitation has been confirmed and the EPSS score indicates low real-world exploitation probability.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows remote attackers with low-privileged access to execute arbitrary SQL commands via the teamid parameter in /admin/new-requests.php. Exploit code is publicly available, though no active exploitation has been reported and EPSS indicates a low probability (0.04%) of widespread use.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to manipulate database queries via the teamid parameter in /admin/team-ontheway-requests.php. Exploit code is publicly available, but exploitation requires low‑privileged administrative access. EPSS remains very low (0.05%), and the vulnerability is not listed in CISA KEV.
SQL injection in PHPGurukul Online Fire Reporting System 1.2 allows authenticated remote attackers to execute arbitrary SQL commands via the teamid parameter in /admin/workin-progress-requests.php. A proof-of-concept exploit is publicly available, but the vulnerability is not listed in CISA KEV and the EPSS score is very low (0.04%), indicating limited exploitation likelihood in the wild. The CVSS 4.0 base score of 2.1 reflects low impact and the requirement for low‑privilege authentication.
SQL injection in Online Fire Reporting System 1.2’s admin report page allows authenticated remote attackers to execute arbitrary SQL commands via the fromdate/todate parameters. Public exploit code is available, though EPSS indicates a low exploitation probability of 0.05% and no active exploitation has been confirmed by CISA KEV.
Authenticated SQL injection in code-projects Voting System 1.0 allows a low-privileged attacker to manipulate the description parameter in the admin panel endpoint /admin/positions_add.php, leading to unauthorized data access or modification. Public exploit code is available, but exploitation probability is very low (EPSS 0.04%) and the vector requires authentication; no active exploitation has been confirmed.
SQL injection in code-projects Voting System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the ID parameter in /admin/voters_row.php, leading to potential database compromise. Exploit code is publicly available, and no vendor patch exists.
SQL injection in code-projects Voting System 1.0 allows authenticated low-privilege attackers to manipulate the ID parameter in /admin/voters_edit.php, potentially accessing or modifying database contents. A public exploit is available, though exploitation probability is low (EPSS 0.04%) and no active exploitation has been reported.
SQL injection in Voting System 1.0 allows remote attackers with low privileges to manipulate database queries via the firstname and lastname parameters in /admin/voters_add.php. Exploit code is publicly available but the vulnerability has a very low EPSS exploitation probability (0.04%) and no active exploitation has been confirmed by CISA KEV.
CVE-2025-7547 is a critical unrestricted file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the save_movie function in /admin/admin_class.php. An unauthenticated remote attacker can manipulate the 'cover' parameter to upload arbitrary files, potentially leading to remote code execution, data compromise, and service disruption. The exploit has been publicly disclosed and may be actively exploited in the wild.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated, low-privilege attackers to manipulate SQL queries via the ID parameter of /admin/manage-users.php. Public exploit code is available, but there is no evidence of active exploitation (not in CISA KEV). Exploitation can lead to unauthorized access, modification, or extraction of database contents, including user credentials.
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
CVE-2025-7542 is a critical SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System version 3.3, located in the /admin/user-profile.php file where the 'uid' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, and exploitation requires no special privileges or user interaction, making it a high-priority threat for affected deployments.
CVE-2025-7541 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /get_town.php endpoint where the 'countryid' parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the appointment booking system database. The vulnerability has been publicly disclosed with proof-of-concept code available, significantly increasing real-world exploitation risk.
CVE-2025-7540 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System 1.0 affecting the /getclinic.php file's townid parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability has been publicly disclosed with exploit code available, creating immediate operational risk for deployed instances.
CVE-2025-7539 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getdoctordaybooking.php file via the 'cid' parameter. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. Exploitation has been publicly disclosed with proof-of-concept availability, and the vulnerability may be actively exploited in the wild.
CVE-2025-7538 is a critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System version 1.0, specifically in the /pages/product_update.php file's image parameter handling. An unauthenticated remote attacker can upload arbitrary files without restriction, potentially leading to remote code execution, data compromise, and system availability impact. The vulnerability has been publicly disclosed with exploit code available, making active exploitation a significant concern.
CVE-2025-7537 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0 affecting the /pages/product_update.php file. An unauthenticated remote attacker can manipulate the 'ID' parameter to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. Public exploit disclosure and active exploitation indicators suggest immediate remediation is warranted.
CVE-2025-7536 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the /pages/receipt_credit.php endpoint via the 'sid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, indicating active exploitation risk.
CVE-2025-7535 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System version 1.0, located in the /pages/reprint_cash.php file's 'sid' parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploits available, making it an immediate threat to deployed instances.
CVE-2025-7534 is a critical SQL injection vulnerability in PHPGurukul Student Result Management System 2.0, exploitable through the 'nid' GET parameter in /notice-details.php. An unauthenticated remote attacker can manipulate this parameter to execute arbitrary SQL queries, potentially compromising confidentiality, integrity, and availability of the application database. Public exploit disclosure and confirmed attack surface (unauthenticated, network-accessible endpoint) elevate real-world risk despite the moderate CVSS 7.3 score.
CVE-2025-7533 is a SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /view-details.php file through the job_id parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read, modify, or delete database contents. The vulnerability has a CVSS score of 7.3 (High) with public exploit disclosure and proof-of-concept availability, indicating active exploitation risk in the wild. This is a critical severity issue for all deployments of the affected version with direct database access implications.
SQL injection in the /admin/bwdates-reports-details.php endpoint of Vehicle Parking Management System 1.13 allows remote authenticated attackers to manipulate the fromdate or todate parameters to execute arbitrary SQL queries, potentially compromising the database. A public proof-of-concept exploit exists, but no active exploitation has been confirmed at this time.
CVE-2025-7521 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /admin/index.php file's Username parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate exploitation risk.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 exposes the admin-facing `/admin/manage-category.php` endpoint to database manipulation via an unsanitized `del` parameter. Authenticated remote attackers can craft HTTP requests to read or modify the underlying database, with a publicly available proof-of-concept exploit already disclosed. No active exploitation has been confirmed in CISA KEV at time of analysis, and the EPSS score of 0.06% places exploitation probability in the 20th percentile.
CVE-2025-7517 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /getDay.php file's cidval parameter. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, and exploitation requires no special privileges or user interaction, making it an immediate threat to deployed instances.
CVE-2025-7516 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, affecting the /cancelbookingpatient.php endpoint via the 'appointment' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of appointment records and sensitive patient information. Public disclosure and proof-of-concept availability indicate active exploitation risk.
CVE-2025-7515 is a critical SQL injection vulnerability in code-projects Online Appointment Booking System version 1.0, specifically in the /ulocateus.php file where the 'doctorname' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database contents. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
A SQL injection vulnerability exists in code-projects Modern Bag version 1.0, specifically in the /admin/contact-list.php file where the 'idStatus' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely.
CVE-2025-7513 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slideupdate.php endpoint, where unsanitized idSlide parameter input allows unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploits available, enabling attackers to read, modify, or delete database records with moderate confidentiality, integrity, and availability impact.
CVE-2025-7512 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, affecting the /contact-back.php file's contact-name parameter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has public exploit disclosure and demonstrates active exploitation potential with a CVSS score of 7.3.
SQL injection in Chat System 1.0 allows authenticated remote attackers with low privileges to manipulate backend database queries via the musername parameter in /user/update_account.php. Successful exploitation leads to limited confidentiality, integrity, and availability impact. A public exploit is available, but no active exploitation has been confirmed.
CVE-2025-7510 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/productadd_back.php file, where the 'namepro' parameter is improperly sanitized allowing remote unauthenticated attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with exploit code available, and carries a CVSS 7.3 score indicating moderate-to-high real-world risk with low attack complexity. An attacker can extract, modify, or delete database contents without authentication, compromising confidentiality, integrity, and availability of the application.
CVE-2025-7509 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/slide.php endpoint via the idSlide parameter. An unauthenticated remote attacker can exploit this with no user interaction to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7508 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/product-update.php endpoint, where the 'idProduct' parameter is improperly validated before database queries. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands, potentially exfiltrating sensitive data, modifying product information, or gaining further system access. The vulnerability has public exploit disclosure and active real-world exploitation is likely given the low attack complexity and lack of authentication requirements.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-incomingvehicle.php. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed by CISA KEV. The attack is launched remotely, with an EPSS likelihood of 0.06%, indicating very low exploitation probability despite a critical severity rating.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged authenticated remote attackers to inject arbitrary SQL via the 'del' parameter of /admin/manage-outgoingvehicle.php. This can lead to unauthorized data access or manipulation. A publicly available exploit exists, but no active exploitation (CISA KEV) is confirmed.
SQL injection in PHPGurukul Vehicle Parking Management System version 1.13 allows authenticated low-privileged attackers to manipulate database queries via the 'del' parameter in the admin panel's user management page. Exploit code is publicly available, but no active exploitation has been reported, and the EPSS score (0.06%) indicates a low likelihood of widespread exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 permits an authenticated admin-panel user to manipulate the `searchdata` parameter on `/admin/search-vehicle.php`, enabling arbitrary database reads and writes against the underlying MySQL/MariaDB instance. A public proof-of-concept is documented on GitHub; no CISA KEV listing exists. EPSS sits at 0.06% (17th percentile), consistent with the product's niche deployment footprint.
SQL injection in PHPGurukul Vehicle Parking System 1.13 allows authenticated remote attackers to manipulate database queries via the 'viewid' parameter in /admin/view-outgoingvehicle-detail.php. Successful exploitation can result in unauthorized reading or modification of data, though only low-level impacts are expected. Public exploit code exists, but active exploitation is not confirmed.
CVE-2025-7483 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, specifically in the /users/forgot-password.php endpoint's email parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation a significant concern.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers to manipulate database queries via the 'vid' parameter in the /users/print.php endpoint. The vulnerability is publicly disclosed with exploit code available, though no active exploitation in the wild has been confirmed. It requires low-privilege authentication for exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows authenticated remote users to manipulate database queries by injecting malicious SQL syntax into the `firstname` parameter at `/users/profile.php`. The advisory notes additional parameters in the same file may be vulnerable, broadening the attack surface. A proof-of-concept is publicly available on GitHub, though no active exploitation is confirmed and EPSS sits at a very low 0.06%, reflecting limited real-world uptake.
CVE-2025-7480 is a critical SQL injection vulnerability in PHPGurukul Vehicle Parking Management System version 1.13, located in the /users/signup.php file where the email parameter is inadequately sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, though no KEV or EPSS data is referenced in the provided intelligence.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows an authenticated attacker with low privileges to execute arbitrary SQL commands via the viewid parameter of /users/view--detail.php. A publicly available exploit exists, but no active exploitation has been reported in CISA KEV and EPSS probability is very low (0.06%).
CVE-2025-7478 is a critical SQL injection vulnerability in code-projects Modern Bag 1.0 affecting the /admin/category-list.php file, where the 'idCate' parameter is not properly sanitized, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with working exploits available, and while classified as critical in the original report, the CVSS 7.3 score indicates moderate-to-high real-world risk with potential for data exfiltration, modification, and denial of service. Active exploitation is likely given public POC availability and the ease of the attack vector.
Unrestricted file upload in Code-projects Simple Car Rental System 1.0 allows authenticated administrators to upload malicious files via /admin/add_cars.php, potentially leading to remote code execution. A public proof-of-concept exploit exists, but no active exploitation has been reported. EPSS score of 0.07% indicates low probability of widespread attacks.
CVE-2025-7476 is a critical SQL injection vulnerability in code-projects Simple Car Rental System 1.0 affecting the /admin/approve.php endpoint's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, elevating real-world risk despite the CVSS 7.3 score suggesting moderate impact.
CVE-2025-7475 is a critical SQL injection vulnerability in code-projects Simple Car Rental System version 1.0, located in the /pay.php file where the 'mpesa' parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of database records. The vulnerability has been publicly disclosed with proof-of-concept availability, indicating active exploitation risk in real-world deployments.
CVE-2025-7474 is a critical SQL injection vulnerability in code-projects Job Diary 1.0 affecting the /search.php file's Search parameter, allowing unauthenticated remote attackers to execute arbitrary SQL commands with potential data exfiltration, modification, and application disruption. The exploit has been publicly disclosed with proof-of-concept code available, and the vulnerability meets the criteria for inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active real-world exploitation.
CVE-2025-7471 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /admin/login-back.php endpoint. An unauthenticated remote attacker can inject malicious SQL code via the 'user-name' parameter to compromise confidentiality, integrity, and availability of the application and underlying database. The vulnerability has been publicly disclosed with proof-of-concept code available, increasing real-world exploitation risk.
The Total Upkeep WordPress backup plugin through version 1.14.9 exposes backup file locations via env-info.php and restore-info.json. Unauthenticated attackers can discover and download complete site backups containing the database, wp-config.php with credentials, and all uploaded files.
A security vulnerability in A vulnerability (CVSS 7.3). Risk factors: public PoC available.
CVE-2025-7469 is a critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 affecting the product addition functionality (/pages/product_add.php). An unauthenticated remote attacker can manipulate the 'prod_name' parameter to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with proof-of-concept code available, making active exploitation likely in the near term.
The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The Friends plugin for WordPress versions up to 3.5.1 contains a PHP Object Injection vulnerability in the query_vars parameter that allows authenticated subscribers and above to inject malicious serialized objects through unsafe deserialization. While the plugin itself lacks a known gadget chain (POP chain), successful exploitation depends on the presence of vulnerable code in other installed plugins or themes; if such a chain exists, attackers can achieve arbitrary file deletion, data exfiltration, or remote code execution, but exploitation requires knowledge of the site's SALT_NONCE and SALT_KEY values.
CVE-2025-7467 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0 affecting the /product-detail.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially exfiltrate, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate-to-high real-world impact with low attack complexity and no authentication requirements.
A critical SQL injection vulnerability exists in 1000projects ABC Courier Management version 1.0 affecting the /add_dealerrequest.php endpoint, where the 'Name' parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, making it an active threat.
A remote code execution vulnerability in all (CVSS 8.8). High severity vulnerability requiring prompt remediation.
The Nokri - Job Board WordPress Theme contains a critical privilege escalation vulnerability (CVE-2025-1313) affecting all versions up to 1.6.3, where authenticated Subscriber-level users can change arbitrary user email addresses without proper identity validation. This allows attackers to reset administrator passwords and achieve complete account takeover, resulting in full WordPress site compromise. With a CVSS score of 8.8 and low attack complexity requiring only valid subscriber credentials, this vulnerability poses significant real-world risk to WordPress installations using this theme.
CVE-2025-7461 is a critical SQL injection vulnerability in code-projects Modern Bag version 1.0, located in the /action.php file's proId parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially access, modify, or delete database contents. The vulnerability has been publicly disclosed with exploit code available, and the CVSS 7.3 score reflects moderate confidentiality, integrity, and availability impact; however, the attack requires no authentication or user interaction, making it immediately exploitable in network-accessible deployments.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upload_handle() function due to missing file type validation, allowing unauthenticated attackers to upload malicious files and potentially achieve remote code execution. With a CVSS score of 9.8, network-accessible attack vector, and no authentication requirement, this vulnerability poses an immediate and severe threat to any WordPress installation using the affected plugin.
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
CVE-2025-7459 is a SQL injection vulnerability in code-projects Mobile Shop version 1.0, specifically in the /EditMobile.php file's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries. The vulnerability has been publicly disclosed with proof-of-concept code available, creating immediate risk for deployed instances. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected databases.
CVE-2025-7457 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /admin/manage_movie.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially compromising database confidentiality, integrity, and availability. Public disclosure and exploit availability elevate the risk profile significantly.
CVE-2025-7456 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, affecting the /reserve.php file's ID parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the reservation database. Public exploit code is available, indicating active disclosure risk.
CVE-2025-7455 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /manage_reserve.php file's 'mid' parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or service disruption. Public exploit disclosure and active exploitation potential significantly increase real-world risk despite the moderate CVSS 7.3 score.
CVE-2025-7454 is a critical SQL injection vulnerability in Campcodes Online Movie Theater Seat Reservation System version 1.0, specifically in the /admin/manage_theater.php file where the ID parameter is not properly sanitized. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion of the theater reservation database. The exploit has been publicly disclosed and is actively exploitable with no authentication required.
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitization.
CVE-2023-38327 is a security vulnerability (CVSS 5.3) that allows unauthenticated remote attackers. Remediation should follow standard vulnerability management procedures.
A SSRF vulnerability in for WordPress is vulnerable to Server-Side Request Forgery in all (CVSS 7.2). High severity vulnerability requiring prompt remediation. Vendor patch is available.
A remote code execution vulnerability in for WordPress is vulnerable to CSV Injection in all (CVSS 4.1). Remediation should follow standard vulnerability management procedures.
A SQL injection vulnerability in WPGYM - Wordpress Gym Management System (CVSS 7.5). High severity vulnerability requiring prompt remediation.
The WoodMart plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.2.5 via the woodmart_get_posts_by_query() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.
The FooGallery - Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption-title` & `data-caption-description` HTML attributes in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.