PHP
Monthly
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rp_user_data' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from user meta like hashed passwords, usernames, and more.
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery - Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The GB Forms DB plugin for WordPress contains a critical unauthenticated Remote Code Execution vulnerability in the gbfdb_talk_to_front() function, affecting all versions up to 1.0.2. The vulnerability stems from unsanitized user input passed directly to call_user_func(), allowing attackers to execute arbitrary PHP code without authentication. This can be leveraged to inject backdoors, create administrative accounts, or achieve full server compromise.
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
A security vulnerability in Order Delivery Date WordPress (CVSS 4.3). Risk factors: public PoC available.
The Premium Age Verification / Restriction for WordPress plugin contains an insufficiently protected remote support functionality in remote_tunnel.php that allows unauthenticated attackers to read from or write to arbitrary files on affected servers. This critical vulnerability (CVSS 9.8) affects all versions up to and including 3.0.2, potentially enabling sensitive information disclosure or remote code execution without authentication. Given the critical CVSS score and network-accessible attack vector, this vulnerability should be treated as high priority pending confirmation of KEV status and active exploitation.
CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.
A security vulnerability in DynamicPageList3 extension (CVSS 8.7). High severity vulnerability requiring prompt remediation.
A denial of service vulnerability in DiscordNotifications (CVSS 9.1) that allows sending requests. Critical severity with potential for significant impact on affected systems.
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.
Cross-site scripting (XSS) in SourceCodester Zoo Management System 1.0 allows authenticated remote attackers to inject arbitrary web script via the 'msg' argument of the animal form template. Exploit code is publicly available, but no active exploitation has been confirmed and the EPSS score indicates very low exploitation probability.
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter.
ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
SQL injection in Campcodes Payroll Management System 1.0 exposes the application's database through the `/ajax.php?action=save_position` endpoint, where unsanitized input to the `ID` parameter is passed directly to backend SQL queries. Unauthenticated remote attackers can read, modify, or delete database records. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS probability remains very low at 0.05% (14th percentile), consistent with the niche footprint of the product.
Unsafe deserialization in Aidigu up to 1.8.2 permits remote unauthenticated attackers to inject malicious serialized PHP objects via the rememberMe cookie in the checkUserCookie function, potentially leading to remote code execution. Public proof-of-concept exploit code has
The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
SQL injection in itsourcecode Insurance Management System up to version 1.0 allows remote attackers to inject arbitrary SQL commands via the agent_id parameter in the /insertAgent.php endpoint. Publicly available exploit code exists, though EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed in CISA KEV. The vulnerability can lead to unauthorized database access and data manipulation.
SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).
Arbitrary file upload in the admin/profile_update.php script of Fabian Ros Library Management System 2.0 permits remote authenticated attackers to upload files without type or extension restrictions, potentially leading to remote code execution. Exploit code is publicly available, though EPSS exploitation probability is low (0.08%) and no active exploitation has been reported. The vulnerability is considered critical due to the ease of exploitation combined with the possibility of full system compromise.
The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
SQL injection in Pharmacy Management System's quantity_upd.php allows low-privileged authenticated attackers to extract or modify limited data via unsanitized med_name, med_cat, or ex_date parameters. Public exploit code exists, but a low EPSS score and CVSS 4.0 base score of 2.1 indicate negligible real-world exploitation probability. No versioned patch is available due to the project's rolling release model.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
Remote SQL injection in Jonnys Liquor 1.0 allows unauthenticated attackers to manipulate the drink parameter of the admin-area.php endpoint, potentially extracting or modifying database contents. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.05%).
SQL injection in code-projects Jonnys Liquor 1.0 allows remote attackers to manipulate database content via the ID parameter in /admin/delete-row.php. The exploit is publicly available and requires no authentication, enabling malicious database actions. No active exploitation has been confirmed, and EPSS indicates very low exploitation probability.
SQL injection in Jonnys Liquor 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search parameter of /browse.php. Exploit code is publicly available; however, the impact is assessed as low (only partial data exposure or modification). No evidence of active exploitation has been identified.
SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.
SQL injection in Code-projects Student Enrollment System 1.0 allows unauthenticated remote attackers to inject SQL via the Username parameter in login.php, potentially leading to data theft or authentication bypass. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The EPSS score is very low, suggesting limited real-world exploitation likelihood.
Unrestricted file upload in Library Management System 2.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/student_edit_photo.php, potentially leading to remote code execution. The vulnerability is publicly disclosed with proof-of-concept exploits available. No active exploitation has been reported through CISA KEV.
SQL injection in Chat System 1.0 allows remote attackers to manipulate database queries via the 'msg' parameter of /user/send_message.php. Publicly available exploit code exists, but no active exploitation has been confirmed. The application is a low-footprint, unsupported project, limiting real-world exposure.
SQL injection in code-projects Chat System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /user/addmember.php. Public exploit code is available, but EPSS indicates low exploitation probability and no active exploitation has been confirmed.
SQL injection in Chat System 1.0 through the ID parameter of /user/fetch_member.php allows remote authenticated attackers with low privileges to extract or manipulate limited data from the application's database. Public exploit code is available, but no active exploitation has been reported and the EPSS probability is very low.
SQL injection in code-projects Chat System 1.0 allows authenticated remote attackers to manipulate backend database queries via the ID parameter of /user/fetch_chat.php. Public exploit code is available, and the vulnerability is rated critically by the reporter, but the CVSS 4.0 base impact is limited (low confidentiality, integrity, and availability) and EP
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the Customer parameter of /pages/customer_account.php, potentially leading to data exfiltration or modification. Public exploit code is available, but the EPSS score is low (0.06%) and there is no indication of active exploitation at this time.
Cross-site scripting vulnerability in itsourcecode Student Transcript Processing System 1.0 allows remote attackers to inject arbitrary web script into the 'pre' parameter of the /admin/modules/subject/edit.php endpoint. An attacker can craft a malicious URL that, when visited by an authenticated administrator, executes attacker-controlled JavaScript in the admin's browser. The exploit is publicly available, though no active exploitation has been confirmed.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
SQL injection in code-projects Staff Audit System 1.0 allows unauthenticated remote attackers to manipulate login queries via the User parameter in /login.php, potentially leading to unauthorized data access or authentication bypass. A public exploit is available, but EPSS probability is low (0.06%), suggesting limited exploitation pressure. No CISA KEV listing exists.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in Food Distributor Site 1.0 allows remote attackers to manipulate the Username parameter on the admin login page to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates very low probability of exploitation (0.06%) and it is not listed in CISA KEV. An attacker could bypass authentication or extract sensitive data from the database.
SQL injection in PHPGurukul Car Washing Management System 1.0 allows an authenticated administrator to execute arbitrary SQL commands via the wpid parameter in /admin/editcar-washpoint.php. The vulnerability requires high privileges but can be exploited remotely, leading to low-impact data leakage, modification, or service disruption. Exploit code is publicly available, though EPSS scores remain low and no active exploitation has been reported by CISA.
SQL injection in PHPGurukul Hospital Management System 1.0 allows remote attackers to manipulate the viewid parameter in view-medhistory.php, leading to unauthorized database access. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation. No vendor patch has been confirmed at this time.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
SQL injection in code-projects Crime Reporting System 1.0 allows remote attackers to inject arbitrary SQL via the email parameter of /headlogin.php. A public exploit exists but active exploitation is not confirmed; the EPSS probability is very low (0.07%). This vulnerability can lead to limited data exposure or manipulation.
The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter of /policelogin.php, potentially leading to authentication bypass and sensitive data exposure. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). EPSS indicates very low risk of widespread exploitation (0.06%, 19th percentile).
SQL injection in the registration form of Code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries by injecting SQL into the Name parameter. The exploit is publicly available but not currently listed in CISA KEV, and EPSS probability of exploitation remains low (0.06%). Although the vulnerability is trivial to exploit, the intrinsic impact is limited, affecting only the local database with low confidentiality, integrity, and availability repercussions.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'location' parameter of /complainer_page.php. A public exploit is available, though EPSS indicates extremely low likelihood of widespread exploitation and no active attacks are confirmed.
SQL injection in Crime Reporting System 1.0 allows remote unauthenticated attackers to manipulate database queries via the email parameter on the /userlogin.php page. The vulnerability has been publicly disclosed and exploit code is available, although the EPSS score is low (0.06%) and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Responsive Blog Site 1.0 allows remote attackers with low-level privileges to manipulate database queries via the 'ID' parameter in category.php, potentially leading to data leakage or modification. Public exploit code is available, though no active exploitation has been confirmed by CISA. The limited impact and low EPSS score (0.06%) reduce its real-world urgency.
SQL injection in code-projects Responsive Blog Site 1.0 allows authenticated remote attackers to manipulate the 'ID' parameter in /single.php to interfere with database queries, leading to data leakage or manipulation. A proof-of-concept exploit is publicly available, but no active exploitation has been reported (EPSS 0.06%).
The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
SQL injection in the forgot-password.php script of PHPGurukul/Campcodes Cyber Cafe Management System 1.0 allows remote, unauthenticated attackers to manipulate the email parameter, leading to database compromise via arbitrary SQL queries. The exploit is publicly disclosed, and while EPSS indicates a low exploitation probability (0.07%), no active exploitation has been confirmed (not in CISA KEV).
SQL injection in Cyber Cafe Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, and the EPSS score of 0.07% suggests low exploitation probability at time of analysis. No evidence of active exploitation in the wild beyond public disclosure has been found.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate the 'cnum' parameter in /admin/add-animals.php, leading to unauthorized database access or data modification. Public exploit code exists but no active exploitation has been confirmed; EPSS score is low at 0.06%.
SQL injection in Zoo Management System 2.1 allows authenticated attackers to manipulate ticket pricing via the cprice parameter in /admin/add-foreigners-ticket.php, potentially altering data in the database. The exploit is publicly available and can be exploited over the network with low attack complexity, though no active exploitation has been confirmed by CISA KEV.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The Lightbox & Modal Popup WordPress Plugin - FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate database queries via the cprice parameter in /admin/add-normal-ticket.php. This could lead to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported.
SQL injection in the admin login page of PHPGurukul Zoo Management System 2.1 allows remote unauthenticated attackers to extract or modify database contents via the Username parameter. Public exploit code is available, making exploitation straightforward despite the limited confidentiality, integrity, and availability impact. The EPSS score of 1.94% (83rd percentile) indicates a moderate likelihood of exploitation, though no active exploitation is confirmed.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/manage-animals.php. Exploit code is publicly available, though no active exploitation is confirmed and the CVSS 4.0 base score is low (2.1) due to limited impact.
SQL injection in PHPGurukul Zoo Management System 2.1's admin ticket management page (/admin/manage-normal-ticket.php) allows authenticated attackers with low privileges to manipulate the ID parameter, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported.
SQL injection in Online Note Sharing 1.0 login page allows remote unauthenticated attackers to inject malicious SQL via username/password fields, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but EPSS indicates very low exploitation probability (0.06%).
The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versions up to, and including, 6.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'rp_user_data' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data from user meta like hashed passwords, usernames, and more.
The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery - Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'upload[1][title]' parameter in all versions up to, and including, 26.0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The GB Forms DB plugin for WordPress contains a critical unauthenticated Remote Code Execution vulnerability in the gbfdb_talk_to_front() function, affecting all versions up to 1.0.2. The vulnerability stems from unsanitized user input passed directly to call_user_func(), allowing attackers to execute arbitrary PHP code without authentication. This can be leveraged to inject backdoors, create administrative accounts, or achieve full server compromise.
The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
A security vulnerability in Order Delivery Date WordPress (CVSS 4.3). Risk factors: public PoC available.
The Premium Age Verification / Restriction for WordPress plugin contains an insufficiently protected remote support functionality in remote_tunnel.php that allows unauthenticated attackers to read from or write to arbitrary files on affected servers. This critical vulnerability (CVSS 9.8) affects all versions up to and including 3.0.2, potentially enabling sensitive information disclosure or remote code execution without authentication. Given the critical CVSS score and network-accessible attack vector, this vulnerability should be treated as high priority pending confirmation of KEV status and active exploitation.
CVE-2025-7436 is a critical SQL injection vulnerability in Campcodes Online Recruitment Management System version 1.0, affecting the /admin/ajax.php?action=delete_vacancy endpoint where the ID parameter is insufficiently sanitized. An unauthenticated remote attacker can exploit this to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or system compromise. A proof-of-concept exploit has been publicly disclosed, increasing real-world exploitation risk.
We are tasked with producing a comprehensive JSON analysis for CVE-2025-7413. The analysis must synthesize data from multiple intelligence sources. We'll go through each field carefully. First, understand the CVE: It's a critical vulnerability in "code-projects Library System 1.0", specifically in /user/teacher/profile.php where manipulation of the argument "image" leads to unrestricted upload. It is remotely exploitable. The exploit is publicly disclosed. The CVSS Score is 2.1 (sounds very low, but the vector is 4.0: AV:N, AC:L, AT:N, PR:L, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N, E:P). That suggests low impact, but the description says "critical". Might be a discrepancy. CWE-284 is "Improper Access Control". Multi-source intelligence: EPSS 0.07% (percentile 21%), so low exploitation probability. POC/Exploit: Publicly available (from the description and tags). KEV status not mentioned, so assume not in KEV. Tags: File Upload, PHP, Authentication Bypass. CPE: code-projects:library_system:1.0. The product is "Library System 1.0" by code-projects (likely a PHP web app). References: - code-projects.org (probably the product site) - https://github.com/rom4j/cve/issues/16 (exploit reference) - vuldb.com links (including one with id.315873) - nvd link for CVE-2025-7413 We need to output fields as plain text strings, no arrays. So each field will be a paragraph. We'll follow the instructions precisely. product_name: "Library System" (but it's "Library System 1.0", so maybe "Library System" or "code-projects Library System"? The rule: "1-3 words ONLY. The specific product or service name affected." So "Library System" is appropriate, but to be specific, "code-projects Library System" might be 3 words. I'll use "Library System" as the vendor is "code-projects" and that is implied. But I'll go with "code-projects Library System" to be specific, but it's 3 words. I'll keep it simple: "Library System". It's better to specify "Library System" as the product, vendor known from CPE. I'll output: "Library System". summary: 2-3 sentence plain-language synthesis. Must not copy description, original. Start with impact and product. Example: "Remote code execution in Apache Tomcat 9.x allows..." But here it's unrestricted file upload, which could lead to code execution, but the CVSS impact is low (L:L:L). Description says "critical" though. The impact is "unrestricted upload leads to ..." Possibly webshell upload, leading to code execution. Since it's a PHP file upload, likely you can upload a PHP script and execute it. But the CVSS says VC:L/VI:L/VA:L, so low impact on confidentiality, integrity, availability. Might be that the uploaded image is only accessible within the teacher profile and can't be executed as code? But typical unrestricted upload in PHP allows code execution if the file is accessible. I'll note that: "Unrestricted file upload in code-projects Library System 1.0 via /user/teacher/profile.php allows authenticated remote attackers to upload arbitrary files, potentially leading to remote code execution. The vulnerability is due to improper access control (CWE-284) on the image upload parameter, and exploit code is publicly available." No active exploitation indicated, EPSS low. So summary: "Unrestricted file upload in code-projects Library System 1.0 allows authenticated attackers to upload arbitrary files via the 'image' parameter in /user/teacher/profile.php. Exploit code is publicly available, but the EPSS exploitation probability is low (0.07%), and no active exploitation has been reported in threat intelligence feeds." Note: CVSS vector gives PR:L, so authenticated as a low-privileged user (teacher). So "authenticated remote attacker" is appropriate. I'll mention the conditions: requires authentication as a teacher (or low privilege) and access to the profile page. Now technical_context: Explain the underlying technology. It's a PHP application, so file upload vulnerability. CWE-284, improper access control, likely missing checks on file type or permissions. CPE indicates "code-projects:library_system:1.0". The code-projects Library System is a PHP-based web application. The affected component is /user/teacher/profile.php, likely handling teacher profile updates including an image upload. The vulnerability arises because the application does not properly restrict what files can be uploaded, allowing an attacker to upload a malicious script (e.g., PHP webshell) that can be executed on the server. This could lead to further compromise. Reference CWE-284: improper access control, so maybe the file upload feature lacks proper authorization or validation, but the description says "unrestricted upload", more like CWE-434 (unrestricted upload of file with dangerous type), but they classified as CWE-284. I'll mention that. Underlying technology: PHP, web server (Apache/Nginx), typical LAMP stack. The upload endpoint likely stores uploaded files in a web-accessible directory, allowing direct execution of uploaded PHP files. So the root cause is insufficient file validation and lack of access control on the upload directory. This is a classic unrestricted file upload leading to remote code execution. risk_assessment: Use CVSS vector and EPSS to assess real risk. CVSS:4.0 vector shows AV:N (network), AC:L, AT:N, PR:L (low privileges required), UI:N, with low impact on all three aspects. The EPSS is low (0.07%), implying low probability of exploitation in the wild. No KEV listing, but POC available. So even though the vulnerability allows file upload, the real-world risk might be moderate because exploitation requires authentication as a teacher (PR:L) and the application is not widely deployed (we'll gauge prevalence). The CVSS score of 2.1 seems inconsistent with the description of "critical", but the numeric score given is likely for the exact impact (low). I'll mention this discrepancy: "CVSS:4.0 base score of 2.1 suggests low overall severity due to limited impact (VC:L/VI:L/VA:L) despite network attack vector and low attack complexity. However, unrestricted file upload in PHP can often lead to full code execution, so the actual impact may be higher depending on server configuration. The EPSS score is very low, indicating that widespread exploitation is unlikely. The availability of a POC does not currently translate into active exploitation." Also note PR:L means an attacker must first obtain teacher-level credentials. So risk is low for most organizations unless the Library System is exposed. Then "If any key data is missing or conflicting, STATE IT EXPLICITLY." Here, the CVSS vector suggests low impact while description says critical, and typical unrestricted upload can lead to code execution. I'll explicitly state: "The assigned CVSS:4.0 vector indicates low impact (VC:L, VI:L, VA:L) which contradicts the typical severity of unrestricted file upload vulnerabilities in PHP. This may be due to a misassessment or the specific deployment default configuration limiting impact. Organizations should verify whether the uploaded files are executed as PHP scripts in the affected version." affected_products: "code-projects Library System version 1.0, as identified by CPE cpe:2.3:a:code-projects:library_system:1.0:*:*:*:*:*:*:*. The vulnerable file is /user/teacher/profile.php. The product source is available from code-projects.org. No vendor advisory has been published; the vulnerability was reported through VulDB and EUVD, and an exploit is available on GitHub (rom4j/cve issues/16)." remediation: "No official vendor patch has been released as of analysis. As a workaround, restrict access to the upload directory by configuring the web server to deny execution of scripts from the upload location (e.g., using .htaccess ‘php_flag engine off’ or equivalent), or disable the teacher profile image upload feature entirely if not required. Additionally, implement strict file type validation on the server side to only allow image file extensions. However, these mitigations may break intended functionality. Monitor for any upcoming patches from the vendor via the VulDB advisory (https://vuldb.com/?id.315873)." Note: I'm not sure if a patch exists, but from the references, no advisory with a fix version. So I'll say "No vendor-released patch identified". I'll avoid saying "no patch exists". Suggest compensating controls. exploit_scenario: "An attacker with low-privileged teacher credentials (e.g., gained through phishing or default credentials) accesses the /user/teacher/profile.php page and uploads a malicious PHP webshell via the image upload field. The uploaded file is stored in a web-accessible directory, and the attacker navigates to it to execute arbitrary commands on the server, potentially taking full control of the web application and underlying host." Note: POC available from GitHub. exploitation_conditions: Must extract specific prerequisites. The description: "manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely." It doesn't mention authentication explicitly, but CVSS vector says PR:L, so low privileges required. The affected file is /user/teacher/profile.php, implying a teacher user must be logged in to access this endpoint. So conditions: "Exploitation requires authentication as a teacher-level user on the Library System application, with access to the profile image upload feature. No additional non-default configuration is needed—the vulnerability exists in the default installation of Library System 1.0. The attack is remotely exploitable over a network, but low privileges are mandatory." So I'll state: "Requires teacher-level authentication (PR:L) and access to the /user/teacher/profile.php upload form. No other special conditions; the default configuration is vulnerable." The instruction forbids generic phrases like "Network access required." So I'll be specific. I'll also note what limits it: authentication. So: "The vulnerability is limited to authenticated teacher users; unauthenticated attackers cannot exploit it directly unless they obtain valid credentials." That's good. attack_chain: A realistic chain: "Obtain teacher credentials → Access teacher profile page → Upload PHP webshell via image parameter → Locate uploaded file in web root → Execute webshell to achieve code execution → Escalate privileges or maintain persistence." But the chain should be concise, 3-7 steps separated by arrows. Starting from access: "Access with teacher credentials" is access. Then "Send malicious file via image upload" → "Web server stores file in public directory" → "Attacker requests uploaded PHP file" → "Server executes script" → "Attacker gains command execution". I'll combine into steps: "Authenticate as teacher → Upload PHP webshell via profile image parameter → Access uploaded file via direct URL → Execute arbitrary code on server". That's 4 steps. But maybe include persistence: "Authenticate → Upload → Access → Execute code → Install backdoor". But I'll keep it simple: "Authenticate as low-privileged teacher → Craft HTTP POST request with malicious PHP file to /user/teacher/profile.php → Server stores file in web-accessible directory → Attacker requests the file URL → PHP code executes, delivering a webshell → Attacker interacts with webshell for full remote control." That's 6 steps. Short steps: "Obtain teacher credentials (phishing/default) → Upload PHP shell via profile image upload → Determine file storage path → Execute webshell via HTTP request → Gain command execution → Maintain access." I'd like to follow kill chain phases. I'll produce: "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". That's 6 steps. I'll use exactly that as a string with arrows. No numbering. "Authenticate as teacher → Upload malicious PHP via image parameter → Identify file location → Request uploaded file URL → Execute code as web server user → Achieve remote command execution". Good. confidence_notes: "The vulnerability is confirmed by VulDB and EUVD, with a publicly available exploit on GitHub. The CWE classification (CWE-284) and CVSS vector (4.0) are provided by the VulDB submitter; the low impact scores may not reflect the full potential of the flaw if uploaded PHP files are executable. No vendor advisory or patch has been published, and the exact behavior of file execution is not independently verified. EPSS data indicates very low exploitation probability, consistent with the product's niche deployment." prevalence: The product is "Library System", a project from code-projects.org. It's a free, likely small-scale library management system used by small institutions or for learning purposes. Not widely deployed like major enterprise software. So prevalence is "low" or "rare". I'll go with "low". Justification: "free open-source PHP app with limited enterprise footprint". Will output "low". prevalence_basis:
Unrestricted file upload in code-projects Library System 1.0 enables remote attackers to upload arbitrary files via the image parameter of /user/student/profile.php, potentially leading to full server compromise if combined with authentication bypass. Public exploit code is available, though EPSS indicates low exploitation probability (0.07%) and no active exploitation is recorded in CISA KEV. The CVSS 4.0 rating of 2.1 (Low) conflicts with the 'critical' classification in the disclosure, likely due to the authentication bypass tag increasing real-world impact.
A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.
CVE-2025-7411 is a critical SQL injection vulnerability in code-projects LifeStyle Store 1.0 affecting the /success.php endpoint's ID parameter, allowing unauthenticated remote attackers to execute arbitrary SQL queries and potentially read/modify sensitive data. Public exploit code is available and the vulnerability is likely actively exploited in the wild, making this a high-priority remediation target despite the moderate CVSS 7.3 score which reflects limited immediate system impact rather than true severity.
A security vulnerability in DynamicPageList3 extension (CVSS 8.7). High severity vulnerability requiring prompt remediation.
A denial of service vulnerability in DiscordNotifications (CVSS 9.1) that allows sending requests. Critical severity with potential for significant impact on affected systems.
CVE-2025-7410 is a critical SQL injection vulnerability in code-projects LifeStyle Store version 1.0, affecting the /cart_remove.php file's ID parameter. An unauthenticated remote attacker can exploit this vulnerability over the network to execute arbitrary SQL queries, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has been publicly disclosed with exploit code available, increasing real-world exploitation risk.
CVE-2025-7409 is a critical SQL injection vulnerability in code-projects Mobile Shop 1.0 affecting the /LoginAsAdmin.php endpoint, where the 'email' parameter is improperly sanitized, allowing unauthenticated remote attackers to inject arbitrary SQL commands. The vulnerability has been publicly disclosed with exploits available, making it actively exploitable in the wild. With a CVSS score of 7.3 and network-accessible attack vector, this poses significant risk to confidentiality, integrity, and availability of affected systems.
Cross-site scripting (XSS) in SourceCodester Zoo Management System 1.0 allows authenticated remote attackers to inject arbitrary web script via the 'msg' argument of the animal form template. Exploit code is publicly available, but no active exploitation has been confirmed and the EPSS score indicates very low exploitation probability.
The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with administrator-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ parameter in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter.
ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By header, which attackers could exploit to fingerprint the server and identify potential weaknesses. WorkaroundsThe mitigation requires changing the expose_php variable from "On" to "Off" in the file located at /usr/local/etc/php/php.ini.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate the 'ID' parameter via /ajax.php?action=save_deductions, enabling arbitrary database queries and potential data leakage or modification. The vulnerability is publicly known with exploit code available, though no active exploitation has been confirmed via CISA KEV. EPSS indicates low exploitation probability (0.05%).
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /ajax.php?action=delete_allowances. Public exploit code is available, but EPSS exploitation probability is low (0.05%) and no active exploitation (CISA KEV) is identified.
SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject SQL via the ID parameter in /ajax.php?action=delete_position. A publicly available exploit exists, and the vulnerability can be triggered with no authentication. The impact is limited to low-confidentiality, low-integrity, and low-availability effects per the assessed CVSS.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
The SureForms - Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
SQL injection in Campcodes Payroll Management System 1.0 exposes the application's database through the `/ajax.php?action=save_position` endpoint, where unsanitized input to the `ID` parameter is passed directly to backend SQL queries. Unauthenticated remote attackers can read, modify, or delete database records. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS probability remains very low at 0.05% (14th percentile), consistent with the niche footprint of the product.
Unsafe deserialization in Aidigu up to 1.8.2 permits remote unauthenticated attackers to inject malicious serialized PHP objects via the rememberMe cookie in the checkUserCookie function, potentially leading to remote code execution. Public proof-of-concept exploit code has
The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
SQL injection in itsourcecode Insurance Management System up to version 1.0 allows remote attackers to inject arbitrary SQL commands via the agent_id parameter in the /insertAgent.php endpoint. Publicly available exploit code exists, though EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed in CISA KEV. The vulnerability can lead to unauthorized database access and data manipulation.
SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).
Arbitrary file upload in the admin/profile_update.php script of Fabian Ros Library Management System 2.0 permits remote authenticated attackers to upload files without type or extension restrictions, potentially leading to remote code execution. Exploit code is publicly available, though EPSS exploitation probability is low (0.08%) and no active exploitation has been reported. The vulnerability is considered critical due to the ease of exploitation combined with the possibility of full system compromise.
The Gutenberg Blocks with AI by Kadence WP - Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ parameter in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sb_encryption() function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization and execute arbitrary AJAX actions defined in the sb_ajax_execute() function. An attacker can use this vulnerability to exploit CVE-2025-4828 and various other functions unauthenticated.
The Support Board plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the sb_file_delete function in all versions up to, and including, 3.8.0. This makes it possible for attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can leverage CVE-2025-4855 vulnerability to exploit this vulnerability unauthenticated.
The WCFM - Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfm_redirect_to_setup function in all versions up to, and including, 6.7.16. This makes it possible for unauthenticated attackers to view and modify the plugin settings, including payment details and API keys
SQL injection in Pharmacy Management System's quantity_upd.php allows low-privileged authenticated attackers to extract or modify limited data via unsanitized med_name, med_cat, or ex_date parameters. Public exploit code exists, but a low EPSS score and CVSS 4.0 base score of 2.1 indicate negligible real-world exploitation probability. No versioned patch is available due to the project's rolling release model.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.
Remote SQL injection in Jonnys Liquor 1.0 allows unauthenticated attackers to manipulate the drink parameter of the admin-area.php endpoint, potentially extracting or modifying database contents. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.05%).
SQL injection in code-projects Jonnys Liquor 1.0 allows remote attackers to manipulate database content via the ID parameter in /admin/delete-row.php. The exploit is publicly available and requires no authentication, enabling malicious database actions. No active exploitation has been confirmed, and EPSS indicates very low exploitation probability.
SQL injection in Jonnys Liquor 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search parameter of /browse.php. Exploit code is publicly available; however, the impact is assessed as low (only partial data exposure or modification). No evidence of active exploitation has been identified.
SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.
SQL injection in Code-projects Student Enrollment System 1.0 allows unauthenticated remote attackers to inject SQL via the Username parameter in login.php, potentially leading to data theft or authentication bypass. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The EPSS score is very low, suggesting limited real-world exploitation likelihood.
Unrestricted file upload in Library Management System 2.0 allows authenticated remote attackers to upload arbitrary files via the photo parameter in /admin/student_edit_photo.php, potentially leading to remote code execution. The vulnerability is publicly disclosed with proof-of-concept exploits available. No active exploitation has been reported through CISA KEV.
SQL injection in Chat System 1.0 allows remote attackers to manipulate database queries via the 'msg' parameter of /user/send_message.php. Publicly available exploit code exists, but no active exploitation has been confirmed. The application is a low-footprint, unsupported project, limiting real-world exposure.
SQL injection in code-projects Chat System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /user/addmember.php. Public exploit code is available, but EPSS indicates low exploitation probability and no active exploitation has been confirmed.
SQL injection in Chat System 1.0 through the ID parameter of /user/fetch_member.php allows remote authenticated attackers with low privileges to extract or manipulate limited data from the application's database. Public exploit code is available, but no active exploitation has been reported and the EPSS probability is very low.
SQL injection in code-projects Chat System 1.0 allows authenticated remote attackers to manipulate backend database queries via the ID parameter of /user/fetch_chat.php. Public exploit code is available, and the vulnerability is rated critically by the reporter, but the CVSS 4.0 base impact is limited (low confidentiality, integrity, and availability) and EP
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.
SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.
SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the Customer parameter of /pages/customer_account.php, potentially leading to data exfiltration or modification. Public exploit code is available, but the EPSS score is low (0.06%) and there is no indication of active exploitation at this time.
Cross-site scripting vulnerability in itsourcecode Student Transcript Processing System 1.0 allows remote attackers to inject arbitrary web script into the 'pre' parameter of the /admin/modules/subject/edit.php endpoint. An attacker can craft a malicious URL that, when visited by an authenticated administrator, executes attacker-controlled JavaScript in the admin's browser. The exploit is publicly available, though no active exploitation has been confirmed.
Unrestricted file upload in Staff Audit System 1.0 allows remote attackers to upload arbitrary files via the /test.php endpoint, leading to potential remote code execution. Exploit code is publicly available, but no active exploitation or KEV listing has been confirmed. The vulnerability is critical as it may bypass authentication entirely.
SQL injection in code-projects Staff Audit System 1.0 allows unauthenticated remote attackers to manipulate login queries via the User parameter in /login.php, potentially leading to unauthorized data access or authentication bypass. A public exploit is available, but EPSS probability is low (0.06%), suggesting limited exploitation pressure. No CISA KEV listing exists.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).
SQL injection in Food Distributor Site 1.0 allows remote attackers to manipulate the Username parameter on the admin login page to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates very low probability of exploitation (0.06%) and it is not listed in CISA KEV. An attacker could bypass authentication or extract sensitive data from the database.
SQL injection in PHPGurukul Car Washing Management System 1.0 allows an authenticated administrator to execute arbitrary SQL commands via the wpid parameter in /admin/editcar-washpoint.php. The vulnerability requires high privileges but can be exploited remotely, leading to low-impact data leakage, modification, or service disruption. Exploit code is publicly available, though EPSS scores remain low and no active exploitation has been reported by CISA.
SQL injection in PHPGurukul Hospital Management System 1.0 allows remote attackers to manipulate the viewid parameter in view-medhistory.php, leading to unauthorized database access. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation. No vendor patch has been confirmed at this time.
Unrestricted file upload in code-projects E-Commerce Site 1.0 allows authenticated attackers to upload arbitrary PHP files via the photo parameter in /admin/users_photo.php, potentially leading to remote code execution on the server. Public exploit code is available, increasing immediate risk for instances where the admin panel is exposed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.
SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.
SQL injection in code-projects Crime Reporting System 1.0 allows remote attackers to inject arbitrary SQL via the email parameter of /headlogin.php. A public exploit exists but active exploitation is not confirmed; the EPSS probability is very low (0.07%). This vulnerability can lead to limited data exposure or manipulation.
The The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.2.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode through the woodmart_get_products_shortcode() function. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter of /policelogin.php, potentially leading to authentication bypass and sensitive data exposure. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). EPSS indicates very low risk of widespread exploitation (0.06%, 19th percentile).
SQL injection in the registration form of Code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries by injecting SQL into the Name parameter. The exploit is publicly available but not currently listed in CISA KEV, and EPSS probability of exploitation remains low (0.06%). Although the vulnerability is trivial to exploit, the intrinsic impact is limited, affecting only the local database with low confidentiality, integrity, and availability repercussions.
SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'location' parameter of /complainer_page.php. A public exploit is available, though EPSS indicates extremely low likelihood of widespread exploitation and no active attacks are confirmed.
SQL injection in Crime Reporting System 1.0 allows remote unauthenticated attackers to manipulate database queries via the email parameter on the /userlogin.php page. The vulnerability has been publicly disclosed and exploit code is available, although the EPSS score is low (0.06%) and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Responsive Blog Site 1.0 allows remote attackers with low-level privileges to manipulate database queries via the 'ID' parameter in category.php, potentially leading to data leakage or modification. Public exploit code is available, though no active exploitation has been confirmed by CISA. The limited impact and low EPSS score (0.06%) reduce its real-world urgency.
SQL injection in code-projects Responsive Blog Site 1.0 allows authenticated remote attackers to manipulate the 'ID' parameter in /single.php to interfere with database queries, leading to data leakage or manipulation. A proof-of-concept exploit is publicly available, but no active exploitation has been reported (EPSS 0.06%).
The WoodMart plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.2.3 via the 'layout' attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php files can be uploaded and included.
The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and including, 8.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via the layout parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This is limited to just PHP files.
SQL injection in the forgot-password.php script of PHPGurukul/Campcodes Cyber Cafe Management System 1.0 allows remote, unauthenticated attackers to manipulate the email parameter, leading to database compromise via arbitrary SQL queries. The exploit is publicly disclosed, and while EPSS indicates a low exploitation probability (0.07%), no active exploitation has been confirmed (not in CISA KEV).
SQL injection in Cyber Cafe Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, and the EPSS score of 0.07% suggests low exploitation probability at time of analysis. No evidence of active exploitation in the wild beyond public disclosure has been found.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate the 'cnum' parameter in /admin/add-animals.php, leading to unauthorized database access or data modification. Public exploit code exists but no active exploitation has been confirmed; EPSS score is low at 0.06%.
SQL injection in Zoo Management System 2.1 allows authenticated attackers to manipulate ticket pricing via the cprice parameter in /admin/add-foreigners-ticket.php, potentially altering data in the database. The exploit is publicly available and can be exploited over the network with low attack complexity, though no active exploitation has been confirmed by CISA KEV.
A security vulnerability in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
The Lightbox & Modal Popup WordPress Plugin - FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versions up to, and including, 2.7.34 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate database queries via the cprice parameter in /admin/add-normal-ticket.php. This could lead to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported.
SQL injection in the admin login page of PHPGurukul Zoo Management System 2.1 allows remote unauthenticated attackers to extract or modify database contents via the Username parameter. Public exploit code is available, making exploitation straightforward despite the limited confidentiality, integrity, and availability impact. The EPSS score of 1.94% (83rd percentile) indicates a moderate likelihood of exploitation, though no active exploitation is confirmed.
SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/manage-animals.php. Exploit code is publicly available, though no active exploitation is confirmed and the CVSS 4.0 base score is low (2.1) due to limited impact.
SQL injection in PHPGurukul Zoo Management System 2.1's admin ticket management page (/admin/manage-normal-ticket.php) allows authenticated attackers with low privileges to manipulate the ID parameter, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported.
SQL injection in Online Note Sharing 1.0 login page allows remote unauthenticated attackers to inject malicious SQL via username/password fields, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but EPSS indicates very low exploitation probability (0.06%).