Refugee Food Management System
Monthly
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Remote SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the `rfid` parameter in the `/home/editrefugee.php` endpoint. Public exploit code is available, but active exploitation has not been confirmed and the EPSS probability is very low (0.04%). Organizations running this application should immediately restrict access or remove the vulnerable endpoint.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.