SQLi
Monthly
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the chkId[] parameter in /admin/view_products.php, potentially leading to data exposure, modification, or service disruption. The vulnerability has publicly available exploit code and a low EPSS score (0.04%), with no indication of active exploitation.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtAreaCode parameter in /admin/add_area.php. A public exploit is available, but no active exploitation in CISA KEV and EPSS probability is very low (0.04%). Attackers can extract or modify database contents with low impact to confidentiality, integrity, and availability per CVSS.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
SQL injection in the open-source PHP exam application onlinemcqexam (by saiftheboss7) allows remote attackers to manipulate database queries via the ans1 and ans2 parameters of the admin question-addition endpoint /admin/quesadd.php. A public exploit has been disclosed via GitHub, meaning exploitation is not theoretical - any internet-exposed instance with an accessible admin panel is at immediate risk of data exfiltration or manipulation. The vendor did not respond to responsible disclosure, and no patch has been released; the product uses a rolling-release model pinned at commit 0e56806.
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
SQL injection in ketr JEPaaS up to version 7.2.8 allows authenticated remote attackers to manipulate the keyWord parameter in the postilService.loadPostils function at /je/postil/postil/loadPostil endpoint, enabling unauthorized data access with low confidentiality and integrity impact. Public exploit code is available, and the vendor has not responded to early disclosure notification despite multiple contact attempts.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database queries via the /customer_details.php endpoint. A public exploit is available, but the EPSS score is low (0.01%) and no active exploitation has been confirmed through CISA KEV.
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Blind SQL injection in CRM Perks Integration for Contact Form 7 HubSpot plugin up to version 1.4.2 allows authenticated, high-privilege attackers to extract sensitive database content. The vulnerability is not currently listed in CISA KEV and no public exploit code has been identified. With an EPSS score of 0.05%, the probability of exploitation is very low, though the CVSS 7.6 rating indicates high potential impact if an attacker already has administrator access.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Blind SQL injection in BeRocket Brands for WooCommerce plugin versions up to and including 3.8.6.3 allows authenticated WordPress users with low privileges to exfiltrate sensitive data from the site's database. The vulnerability has a CVSS base score of 8.5, but no active exploitation or public exploit has been identified, and EPSS indicates
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.
Blind SQL injection in WPBulky WordPress plugin through version 1.1.13 allows high-privileged authenticated attackers to extract database contents and potentially cause limited service disruption. The vulnerability exists in the bulk edit functionality where user-supplied input is improperly sanitized before inclusion in SQL queries. With EPSS score of 0.04% (12th percentile) and no public exploit code identified, immediate mass exploitation appears unlikely, though administrator-level compromise could enable data exfiltration from WordPress databases.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.
SQL injection in DedeCMS up to version 5.7.118 via the orderby parameter in /freelist_main.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability requires valid user authentication (PR:L) to exploit, significantly limiting real-world risk despite network accessibility.
SQL injection in SeaCMS up to version 13.3 via the e_id parameter in admin_video.php allows authenticated high-privilege attackers to execute arbitrary SQL queries and manipulate database content. The vulnerability requires administrative credentials, limiting real-world impact despite public exploit availability. EPSS score of 0.05% reflects the high privilege requirement needed for exploitation.
SQL injection in SeaCMS up to version 13.3 allows unauthenticated remote attackers to manipulate the `page` and `limit` parameters in the DM player component's database abstraction layer (`js/player/dmplayer/dmku/class/mysqli.class.php`), yielding read and write access to the underlying database. The affected component fails to sanitize pagination inputs before constructing SQL queries, exposing database contents including user credentials and site configuration. A public proof-of-concept exploit has been disclosed, though EPSS remains low at 0.05%, reflecting the product's limited global deployment footprint.
We are tasked with producing a JSON object synthesizing data for CVE-2025-14990. CVE ID: CVE-2025-14990 Description: "A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks." Given: CVSS Score: 5.5? Actually the CVSS vector provided is a 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X The score 5.5 is likely the base score from that vector. Let's assume CVSS 4.0 base score 5.5 (low). The vector indicates: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. So it's a network-vector, low attack complexity, no privileges, no user interaction, low impact on vulnerable system (confidentiality, integrity, availability), no impact on subsequent systems. Exploit maturity E:P (proof of concept). Overall, low severity. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection would normally be CWE-89, but here it's CWE-74, maybe a mistake. We'll note it's SQLi but CWE given is 74. Multi-source intel: EPSS Score: 0.05% (percentile 15%) - very low exploitation probability. POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Complete Online Beauty Parlor Management System References: github issue, vuldb entries, campcodes homepage. We need to produce fields: product_name: "Complete Online Beauty Parlor Management System" - but that's long, maybe "Beauty Parlor Management System"? The CPE product name is "complete_online_beauty_parlor_management_system". Short: "Complete Online Beauty Parlor Management System" (still long) but they said 1-3 words ONLY. Could be "Beauty Parlor CMS"? But better: "Beauty Parlor Management". However, the exact name is "Complete Online Beauty Parlor Management System". 1-3 words: "Beauty Parlor System"? That might lose clarity. I'll choose "Beauty Parlor Management" (3 words). Or "Complete Online Beauty Parlor" is 3 words? Actually "Complete Online Beauty" is 3 words. But product name: "Campcodes Complete Online Beauty Parlor Management System". I'll pick "Beauty Parlor Management" as shorthand. But the requirement: "1-3 words ONLY. The specific product or service name affected." I'll use "Beauty Parlor MS" (MS for Management System) but that might be too terse. I'll use "Online Beauty Parlor System". That's 4 words? Online (1) Beauty (2) Parlor (3) System (4) -> 4. I could drop "Online": "Beauty Parlor System" is 3. Or "Beauty Parlor CMS"? The software might not be a CMS. I'll go with "Beauty Parlor Management System"? That's 4 words. Maybe "Beauty Parlor Mgmt" but Mgmt is not a word. The rule says "1-3 words ONLY." So I need a very short product name. The vendor is Campcodes, the product is "Complete Online Beauty Parlor Management System". I could say "Beauty Parlor System" (3 words). Yes, that works. I'll use "Beauty Parlor System". The CPE confirms it's version 1.0. summary: Must be original synthesis, not copy of description. Start with specific impact verb and product. E.g., "SQL injection in Beauty Parlor System 1.0 allows remote attackers to manipulate appointment data via viewid parameter." Include EPSS risk: "EPSS predicts very low exploitation probability (0.05%), but a public exploit is available." Mention CWE and KEV? Not in KEV. So "no known active exploitation." Noted: POC is public. technical_context: Mention that it's a PHP web application, the vulnerability is SQL injection in the /admin/view-appointment.php endpoint through the viewid parameter. CWE-74 indicates injection, though SQLi is typically CWE-89. The CPE specifies the exact product and version. The underlying technology: PHP and likely MySQL. risk_assessment: CVSS 4.0 base score 5.5 Medium (Low impact, network, low attack complexity, no privs needed). EPSS 0.05% suggests very unlikely to be exploited in the wild. Not in KEV. POC exists, so possible targeted attacks. The application is a niche beauty parlor management system, likely limited enterprise deployment, so real-world risk is low. SSVC: Exploitation: PoC (public), Automatable: Yes (network, low complexity), Technical Impact: Partial (low impact on confidentiality, integrity, availability). So priority might be moderate only for organizations using this specific software. Compare signals: high ease of exploitation (remote, no auth) but low impact and low prevalence reduces urgency. affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0, as per CPE cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0. The affected file is /admin/view-appointment.php. No vendor advisory link is provided; references include VulDB entries and a GitHub issue." remediation: No official fix mentioned. Since no vendor advisory is available, suggest: "No vendor patch identified. Mitigation: Disable the affected endpoint /admin/view-appointment.php if not needed, or apply input validation to sanitize the viewid parameter. Restrict network access to the admin panel to trusted IPs. Regularly monitor for SQLi attempts." Since it's a remote unauthenticated injection, the best immediate step is to filter the parameter. Provide specific: "Apply a Web Application Firewall rule to block SQLi patterns on the viewid parameter. Note that the application is from Campcodes, possibly discontinued, so consider replacing the software if it is mission-critical." No patch available. exploit_scenario: "An attacker sends a crafted HTTP GET request to /admin/view-appointment.php?viewid=1' OR '1'='1, exploiting the SQL injection to extract database information, modify appointment records, or potentially gain further access to the underlying server if database privileges allow." exploitation_conditions: From CVSS: AV:N, AC:L, PR:N, UI:N, so no authentication required, remotely exploitable, no user interaction. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Beauty Parlor System 1.0. The /admin/view-appointment.php endpoint is publicly accessible and does not require authentication." No limiting factors beyond maybe the admin interface might be somewhat hidden, but default is often accessible. So "unauthenticated". attack_chain: "Reconnaissance of web application → Send malicious SQL payload in viewid parameter → Backend PHP code concatenates input into SQL query → SQL query executed, data exfiltration or modification." More concisely: "Identify /admin/view-appointment.php endpoint → Inject SQL via viewid → Database executes malicious query → Extract/modify appointment data". That's 4 steps. confidence_notes: What is confirmed: Vulnerability in /admin/view-appointment.php of Campcodes Complete Online Beauty Parlor Management System 1.0, disclosed publicly via VulDB and GitHub. Exploit PoC available. Not confirmed: Active exploitation (no KEV). No vendor advisory found; patch status unknown. The CWE is given as CWE-74, but SQL injection is typically CWE-89 — possible misclassification. prevalence: The software is a niche product for beauty parlors, likely low deployment in enterprise environments. So prevalence: "low". Basis: "niche vertical application for small businesses" (max 12 words). I'll use "low" and basis "small business beauty parlor management software". assessed_cvss_vector: Given CVSS 4.0 vector already provided. But the task says: "Your OWN independent CVSS 3.1 base-metric vector ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we need to assign a 3.1 vector. According to description: network attack vector, low complexity, no privileges (since it seems unauthenticated — the description doesn't mention auth, but CVSS 4.0 gave PR:N), no user interaction. Impact: SQL injection could lead to data leakage and data manipulation, but CVSS 4.0 gave Low for all. For 3.1, we'd have: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N maybe? Or could be C:L/I:L/A:L? SQLi often leads to database compromise, which can affect availability too. I'll assign C:L/I:L/A:L (all low) as it's a database injection, but scope unchanged. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a score of 7.3? Actually CVSS 3.1 with C:L/I:L/A:L and everything else low gets 7.3 (High). But original 4.0 score is 5.5. The difference is that 4.0 has separate vulnerable system impact and subsequent impact, and here it's low impact across all three. In 3.1, low impact on all three with AV:N/AC:L/PR:N/UI:N/S:U yields 7.3. That might be too high. The 4.0 vector gave VC:L/VI:L/VA:L (low). Equivalent 3.1 would be the same: C:L/I:L/A:L. So I'll use that. Rationale: "Remote, unauthenticated SQL injection with low impact to confidentiality, integrity, and availability of the database." assessed_cvss40_vector: We can use the same as provided but we'll justify: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's fine. Rationale: "Attack requires only network access, no privileges; impact is limited to low on the vulnerable component." Now compile into JSON. Ensure all fields are plain text strings, no arrays. product_name: "Beauty Parlor System" summary: "SQL injection in Campcodes Beauty Parlor System 1.0 allows remote attackers to manipulate or exfiltrate appointment data via the viewid parameter in /admin/view-appointment.php. The vulnerability is remotely exploitable with no authentication, has a publicly available exploit, but EPSS predicts very low (0.05%) exploitation probability. There is no evidence of active exploitation in the wild." technical_context: "The vulnerability exists in the PHP-based Campcodes Complete Online Beauty Parlor Management System 1.0. The offending endpoint /admin/view-appointment.php fails to properly sanitize the 'viewid' input, leading to SQL injection (CWE-74, though typically categorized as CWE-89). The CPE identifies the affected application exactly, and the vulnerability is exploitable against the database back-end, likely MySQL." risk_assessment: "CVSS 4.0 base score 5.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, indicating easy remote exploitation but only low impact to confidentiality, integrity, and availability. EPSS gives a 0.05% chance of exploitation in the next 30 days, in the 15th percentile, suggesting almost negligible real-world threat. No CISA KEV entry. A public proof-of-concept (PoC) exists, enabling scripted attacks, but the product is a niche beauty parlor management system with likely minimal enterprise footprint. SSVC assessment: Exploitation (PoC), Automatable (Yes), Technical Impact (Partial). Overall, this is a low-priority issue except for organizations actively using this exact software." affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0 (cpe:2.3:a:campcodes:
SQL injection in Online Beauty Parlor System 1.0 allows remote attackers to manipulate database queries through the /admin/search-invoices.php endpoint. The vulnerability carries a medium CVSS score, but exploit code is publicly available and no authentication is required, making it easy to attack. No active exploitation in the wild has been confirmed, and the EPSS probability remains low.
Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.
SQL injection in FastAdmin up to version 1.7.0.20250506 allows high-privilege authenticated attackers to execute arbitrary SQL queries via manipulation of the custom/searchField parameter in the selectpage function of the Backend Controller. The vulnerability requires administrator-level privileges and has publicly available exploit code, though the low CVSS score (2.0) and minimal EPSS exploitation probability (0.06%) indicate limited real-world risk despite active disclosure.
Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.
SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate the txtCategoryName parameter in /admin/add_category.php, potentially enabling unauthorized data access or modification. The vulnerability is unauthenticated and exploit code is publicly available, though no active exploitation in the wild has been confirmed. EPSS probability is low (0.05%), indicating limited real-world exploitation likelihood.
SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.
SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the ID parameter in /admin/userdelete.php. The vulnerability requires administrator access and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. Publicly available exploit code exists, though EPSS scoring (0.01%, percentile 3%) indicates minimal real-world exploitation probability, suggesting the threat is primarily theoretical despite public disclosure.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to inject malicious SQL via the /admin/stateadd.php endpoint, potentially compromising database integrity and confidentiality. The vulnerability requires administrative privileges to exploit and has a low CVSS score (2.0) due to restricted scope and limited impact, but publicly available exploit code exists. Real-world risk is minimal given the high privilege barrier (PR:H), though organizations running this system should prioritize patching to prevent insider threats.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to execute arbitrary SQL queries via the /admin/userbuilderdelete.php endpoint. The vulnerability requires authenticated administrator access (CVSS PR:H) and affects only confidentiality and integrity with low impact. Publicly available exploit code exists, though exploitation is limited by the requirement for valid high-privilege credentials and carries low real-world risk due to EPSS score of 0.05% and the attacker profile (malicious insiders with admin accounts).
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the /admin/useragentdelete.php endpoint. The vulnerability requires administrator credentials but poses risk to systems where admin accounts may be compromised or where privileged users are untrusted. Publicly available exploit code exists, though EPSS indicates low real-world exploitation probability at 0.05%.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to query, modify, or delete database records via the cmbAreaCode parameter in /admin/add_retailer.php. Public exploit code is available, but the vulnerability is not known to be actively exploited (CISA KEV). The EPSS exploitation probability is very low (0.05%), indicating limited real-world targeting.
Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
SQL injection in the Advance Seat Reservation Management for WooCommerce plugin <=3.1 allows unauthenticated attackers to extract sensitive database contents. The vulnerability carries a CVSS 9.3 score, with network vector, no privileges, and scope change leading to high confidentiality impact and minor availability disruption. No active exploitation or public POC has been confirmed, and EPSS indicates a very low exploitation probability (0.05%).
Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
SQL injection in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761 allows authenticated remote attackers to manipulate the filter parameter in the /dishtrade/dish_trade_detail_get endpoint, resulting in limited confidentiality and integrity impact. Public exploit code exists; however, the CVSS score of 2.1 and EPSS percentile of 16% indicate low real-world exploitation probability despite authenticated network accessibility, suggesting the vulnerability may require specific application knowledge or platform-dependent conditions to achieve meaningful impact.
SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.
SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.
Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.
Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.
Blind SQL injection in the Newsletter plugin for WordPress up to
SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.
Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.
SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
SQL injection in ketr JEPaaS up to version 7.2.8 allows high-privileged remote attackers to manipulate the keyWord argument in the readAllPostil function (/je/postil/postil/readAllPostil), resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS score of 2.0 reflects the requirement for high-level privileges (PR:H), significantly limiting real-world exploitation scope.
SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.
SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to manipulate the meta_value argument in /admin/?page=system_info to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates low exploitation probability, consistent with the product's limited deployment footprint.
SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/?page=user. Exploit code is publicly available, making exploitation straightforward, though no active exploitation has been reported by CISA. The impact is rated low, potentially allowing limited data disclosure or modification.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the chkId[] parameter in /admin/view_products.php, potentially leading to data exposure, modification, or service disruption. The vulnerability has publicly available exploit code and a low EPSS score (0.04%), with no indication of active exploitation.
SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtAreaCode parameter in /admin/add_area.php. A public exploit is available, but no active exploitation in CISA KEV and EPSS probability is very low (0.04%). Attackers can extract or modify database contents with low impact to confidentiality, integrity, and availability per CVSS.
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
SQL injection in code-projects College Notes Uploading System 1.0 allows remote attackers to manipulate the User parameter in /login.php, potentially bypassing authentication or accessing sensitive data. A publicly available exploit exists, but there is no evidence of active exploitation and the product has a small deployment footprint.
SQL injection in code-projects Assessment Management 1.0 allows unauthenticated remote attackers to potentially read, modify, or delete database records via the userid parameter in login.php. Exploit code is publicly available, though EPSS indicates a very low probability (0.01%) of exploitation in the wild.
Unauthenticated SQL injection in Assessment Management 1.0 allows remote attackers to execute arbitrary SQL commands via the linked[] parameter in /admin/add-module.php. A public exploit is available, though real-world exploitation probability is very low (EPSS 0.01%), and no active exploitation has been confirmed.
SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the backend database via the 'a' parameter in /home/addusers.php. The vulnerability is disclosed publicly with a proof-of-concept exploit. EPSS estimates a very low (0.06%) chance of exploitation.
SQL injection in code-projects Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'a' parameter in /home/refugeesreport.php. A publicly available proof-of-concept exploit exists, but the vulnerability has not been actively exploited according to CISA KEV. EPSS score is low (0.04%), suggesting limited exploitation risk.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'a' parameter in /home/refugeesreport2.php. The vulnerability is publicly disclosed with exploit code available, though real-world exploitation is unlikely due to the product's obscure nature and very low EPSS score.
SQL injection in Refugee Food Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'tfid' parameter in /home/viewtakenfd.php. Although exploit code is publicly available, the vulnerability has a low CVSS 4.0 score (5.5) and EPSS predicts very low exploitation probability (0.02%), with no evidence of active exploitation.
SQL injection in the Refugee Food Management System 1.0 allows unauthenticated attackers to extract or modify database contents. The vulnerability, located in /home/served.php, arises from improper sanitization of the `refNo` parameter. Public exploit code is available, and while EPSS indicates low exploitation probability, the attack is remotely executable without credentials.
We are tasked with creating a comprehensive JSON analysis for CVE-2025-15181, synthesizing all input data. The data includes a description, CVSS 4.0 vector, CWE, EPSS, POC status, CPE, tags, and references. We must produce a single JSON with specific fields, each as plain text strings, per the detailed instructions. Let's extract key info: - CVE ID: CVE-2025-15181 - Description: A security flaw in code-projects Refugee Food Management System 1.0. Unknown function in file /home/pagenateRefugeesList.php. Manipulating argument rfid results in SQL injection. Remote exploitation possible. Exploit released to the public. - CVSS Score: 5.5 (but vector is CVSS 4.0, so base score 5.5 medium). Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/... So base metrics: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L, VI:L, VA:L, SC:N, SI:N, SA:N. Exploit maturity E:P (Proof-of-concept). - CWE: CWE-74 (Injection - generic) - EPSS: 0.06% (low), percentile 17%. - POC/Exploit: Publicly available - KEV: not mentioned, so not in KEV. - CPE: cpe:2.3:a:fabian:refugee_food_management_system:1.0:*:*:*:*:*:*:* (note: vendor "fabian" but product "refugee_food_management_system") - Tags: SQLi, PHP, Refugee Food Management System - References: code-projects.org (product site), GitHub issue with exploit, VulDB entries. Now, we must fill the fields. Let's go field by field. product_name: "Refugee Food Management System" (1.0). The description says "code-projects Refugee Food Management System 1.0". The CPE vendor is "fabian", but product is refugee_food_management_system. So product_name: "Refugee Food Management System". That's 3 words exactly. Good. summary: This should be an original synthesis, not a copy. Start with impact verb: "SQL injection in Refugee Food Management System 1.0 allows remote attackers to manipulate the 'rfid' parameter in /home/pagenateRefugeesList.php, potentially leading to unauthorized data access or modification." Mention exploit publicly available. Imp
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /statistical.php endpoint. The vulnerability is unauthenticated and a publicly available exploit exists, yet the EPSS score is only 0.04%, indicating low probability of widespread exploitation despite the POC.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /detailtransac.php, potentially leading to unauthorized database access. A publicly available exploit exists, but no active exploitation has been confirmed. The vulnerability has a low EPSS score (0.04%) and no KEV listing, lowering real-world urgency despite its remote unauthenticated nature.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /updatesupplier.php?action=edit, potentially compromising data confidentiality and integrity. Public exploit code is available, though no active exploitation has been confirmed.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate the ID parameter in /updatecustomer.php?action=edit to execute arbitrary SQL commands against the backend database. The vulnerability affects version 1.0 and has a publicly available proof-of-concept exploit, though EPSS data indicates a low probability of exploitation (0.04%). No authentication is required, making exposed instances trivially exploitable for low-impact data access or modification.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
SQL injection in the open-source PHP exam application onlinemcqexam (by saiftheboss7) allows remote attackers to manipulate database queries via the ans1 and ans2 parameters of the admin question-addition endpoint /admin/quesadd.php. A public exploit has been disclosed via GitHub, meaning exploitation is not theoretical - any internet-exposed instance with an accessible admin panel is at immediate risk of data exfiltration or manipulation. The vendor did not respond to responsible disclosure, and no patch has been released; the product uses a rolling-release model pinned at commit 0e56806.
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
SQL injection in ketr JEPaaS up to version 7.2.8 allows authenticated remote attackers to manipulate the keyWord parameter in the postilService.loadPostils function at /je/postil/postil/loadPostil endpoint, enabling unauthorized data access with low confidentiality and integrity impact. Public exploit code is available, and the vendor has not responded to early disclosure notification despite multiple contact attempts.
SQL injection vulnerability in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL queries via the 'sy' parameter of /list_report.php. Public exploit code exists, but EPSS indicates a very low exploitation probability (0.05%).
SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /form137.php, potentially reading, modifying, or deleting underlying database records. A public proof-of-concept exploit has been disclosed on GitHub, lowering the barrier to exploitation. Despite the public POC, the EPSS score sits at just 0.05% (15th percentile), consistent with a niche product attracting little automated or opportunistic attack activity.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /student_p.php to execute arbitrary SQL queries. A public exploit is available, though no active exploitation has been confirmed by CISA KEV, and the EPSS probability is very low.
SQL injection in itsourcecode Online Frozen Foods Ordering System 1.0 allows remote attackers to manipulate database queries via the /customer_details.php endpoint. A public exploit is available, but the EPSS score is low (0.01%) and no active exploitation has been confirmed through CISA KEV.
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Blind SQL injection in CRM Perks Integration for Contact Form 7 HubSpot plugin up to version 1.4.2 allows authenticated, high-privilege attackers to extract sensitive database content. The vulnerability is not currently listed in CISA KEV and no public exploit code has been identified. With an EPSS score of 0.05%, the probability of exploitation is very low, though the CVSS 7.6 rating indicates high potential impact if an attacker already has administrator access.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Blind SQL injection in BeRocket Brands for WooCommerce plugin versions up to and including 3.8.6.3 allows authenticated WordPress users with low privileges to exfiltrate sensitive data from the site's database. The vulnerability has a CVSS base score of 8.5, but no active exploitation or public exploit has been identified, and EPSS indicates
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
SQL injection in Online Farm System 1.0 allows remote attackers to manipulate database queries through the Username parameter of the /addProduct.php endpoint. Exploit code is publicly available, although the immediate impact is limited to low confidentiality, integrity, and availability effects according to the CVSS assessment. At the time of analysis no active exploitation has been confirmed by CISA KEV, and EPSS indicates a low probability of widespread exploitation.
SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.
Blind SQL injection in WPBulky WordPress plugin through version 1.1.13 allows high-privileged authenticated attackers to extract database contents and potentially cause limited service disruption. The vulnerability exists in the bulk edit functionality where user-supplied input is improperly sanitized before inclusion in SQL queries. With EPSS score of 0.04% (12th percentile) and no public exploit code identified, immediate mass exploitation appears unlikely, though administrator-level compromise could enable data exfiltration from WordPress databases.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter of /record.php. Exploit code is publicly available, though active exploitation has not been reported and the EPSS exploitation probability is low (0.05%).
SQL injection in Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/home.php. This can lead to unauthorized database access or data manipulation. Exploit code is publicly available, but no active exploitation is confirmed.
SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.
SQL injection in DedeCMS up to version 5.7.118 via the orderby parameter in /freelist_main.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability requires valid user authentication (PR:L) to exploit, significantly limiting real-world risk despite network accessibility.
SQL injection in SeaCMS up to version 13.3 via the e_id parameter in admin_video.php allows authenticated high-privilege attackers to execute arbitrary SQL queries and manipulate database content. The vulnerability requires administrative credentials, limiting real-world impact despite public exploit availability. EPSS score of 0.05% reflects the high privilege requirement needed for exploitation.
SQL injection in SeaCMS up to version 13.3 allows unauthenticated remote attackers to manipulate the `page` and `limit` parameters in the DM player component's database abstraction layer (`js/player/dmplayer/dmku/class/mysqli.class.php`), yielding read and write access to the underlying database. The affected component fails to sanitize pagination inputs before constructing SQL queries, exposing database contents including user credentials and site configuration. A public proof-of-concept exploit has been disclosed, though EPSS remains low at 0.05%, reflecting the product's limited global deployment footprint.
We are tasked with producing a JSON object synthesizing data for CVE-2025-14990. CVE ID: CVE-2025-14990 Description: "A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks." Given: CVSS Score: 5.5? Actually the CVSS vector provided is a 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X The score 5.5 is likely the base score from that vector. Let's assume CVSS 4.0 base score 5.5 (low). The vector indicates: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. So it's a network-vector, low attack complexity, no privileges, no user interaction, low impact on vulnerable system (confidentiality, integrity, availability), no impact on subsequent systems. Exploit maturity E:P (proof of concept). Overall, low severity. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection would normally be CWE-89, but here it's CWE-74, maybe a mistake. We'll note it's SQLi but CWE given is 74. Multi-source intel: EPSS Score: 0.05% (percentile 15%) - very low exploitation probability. POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Complete Online Beauty Parlor Management System References: github issue, vuldb entries, campcodes homepage. We need to produce fields: product_name: "Complete Online Beauty Parlor Management System" - but that's long, maybe "Beauty Parlor Management System"? The CPE product name is "complete_online_beauty_parlor_management_system". Short: "Complete Online Beauty Parlor Management System" (still long) but they said 1-3 words ONLY. Could be "Beauty Parlor CMS"? But better: "Beauty Parlor Management". However, the exact name is "Complete Online Beauty Parlor Management System". 1-3 words: "Beauty Parlor System"? That might lose clarity. I'll choose "Beauty Parlor Management" (3 words). Or "Complete Online Beauty Parlor" is 3 words? Actually "Complete Online Beauty" is 3 words. But product name: "Campcodes Complete Online Beauty Parlor Management System". I'll pick "Beauty Parlor Management" as shorthand. But the requirement: "1-3 words ONLY. The specific product or service name affected." I'll use "Beauty Parlor MS" (MS for Management System) but that might be too terse. I'll use "Online Beauty Parlor System". That's 4 words? Online (1) Beauty (2) Parlor (3) System (4) -> 4. I could drop "Online": "Beauty Parlor System" is 3. Or "Beauty Parlor CMS"? The software might not be a CMS. I'll go with "Beauty Parlor Management System"? That's 4 words. Maybe "Beauty Parlor Mgmt" but Mgmt is not a word. The rule says "1-3 words ONLY." So I need a very short product name. The vendor is Campcodes, the product is "Complete Online Beauty Parlor Management System". I could say "Beauty Parlor System" (3 words). Yes, that works. I'll use "Beauty Parlor System". The CPE confirms it's version 1.0. summary: Must be original synthesis, not copy of description. Start with specific impact verb and product. E.g., "SQL injection in Beauty Parlor System 1.0 allows remote attackers to manipulate appointment data via viewid parameter." Include EPSS risk: "EPSS predicts very low exploitation probability (0.05%), but a public exploit is available." Mention CWE and KEV? Not in KEV. So "no known active exploitation." Noted: POC is public. technical_context: Mention that it's a PHP web application, the vulnerability is SQL injection in the /admin/view-appointment.php endpoint through the viewid parameter. CWE-74 indicates injection, though SQLi is typically CWE-89. The CPE specifies the exact product and version. The underlying technology: PHP and likely MySQL. risk_assessment: CVSS 4.0 base score 5.5 Medium (Low impact, network, low attack complexity, no privs needed). EPSS 0.05% suggests very unlikely to be exploited in the wild. Not in KEV. POC exists, so possible targeted attacks. The application is a niche beauty parlor management system, likely limited enterprise deployment, so real-world risk is low. SSVC: Exploitation: PoC (public), Automatable: Yes (network, low complexity), Technical Impact: Partial (low impact on confidentiality, integrity, availability). So priority might be moderate only for organizations using this specific software. Compare signals: high ease of exploitation (remote, no auth) but low impact and low prevalence reduces urgency. affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0, as per CPE cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0. The affected file is /admin/view-appointment.php. No vendor advisory link is provided; references include VulDB entries and a GitHub issue." remediation: No official fix mentioned. Since no vendor advisory is available, suggest: "No vendor patch identified. Mitigation: Disable the affected endpoint /admin/view-appointment.php if not needed, or apply input validation to sanitize the viewid parameter. Restrict network access to the admin panel to trusted IPs. Regularly monitor for SQLi attempts." Since it's a remote unauthenticated injection, the best immediate step is to filter the parameter. Provide specific: "Apply a Web Application Firewall rule to block SQLi patterns on the viewid parameter. Note that the application is from Campcodes, possibly discontinued, so consider replacing the software if it is mission-critical." No patch available. exploit_scenario: "An attacker sends a crafted HTTP GET request to /admin/view-appointment.php?viewid=1' OR '1'='1, exploiting the SQL injection to extract database information, modify appointment records, or potentially gain further access to the underlying server if database privileges allow." exploitation_conditions: From CVSS: AV:N, AC:L, PR:N, UI:N, so no authentication required, remotely exploitable, no user interaction. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Beauty Parlor System 1.0. The /admin/view-appointment.php endpoint is publicly accessible and does not require authentication." No limiting factors beyond maybe the admin interface might be somewhat hidden, but default is often accessible. So "unauthenticated". attack_chain: "Reconnaissance of web application → Send malicious SQL payload in viewid parameter → Backend PHP code concatenates input into SQL query → SQL query executed, data exfiltration or modification." More concisely: "Identify /admin/view-appointment.php endpoint → Inject SQL via viewid → Database executes malicious query → Extract/modify appointment data". That's 4 steps. confidence_notes: What is confirmed: Vulnerability in /admin/view-appointment.php of Campcodes Complete Online Beauty Parlor Management System 1.0, disclosed publicly via VulDB and GitHub. Exploit PoC available. Not confirmed: Active exploitation (no KEV). No vendor advisory found; patch status unknown. The CWE is given as CWE-74, but SQL injection is typically CWE-89 — possible misclassification. prevalence: The software is a niche product for beauty parlors, likely low deployment in enterprise environments. So prevalence: "low". Basis: "niche vertical application for small businesses" (max 12 words). I'll use "low" and basis "small business beauty parlor management software". assessed_cvss_vector: Given CVSS 4.0 vector already provided. But the task says: "Your OWN independent CVSS 3.1 base-metric vector ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we need to assign a 3.1 vector. According to description: network attack vector, low complexity, no privileges (since it seems unauthenticated — the description doesn't mention auth, but CVSS 4.0 gave PR:N), no user interaction. Impact: SQL injection could lead to data leakage and data manipulation, but CVSS 4.0 gave Low for all. For 3.1, we'd have: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N maybe? Or could be C:L/I:L/A:L? SQLi often leads to database compromise, which can affect availability too. I'll assign C:L/I:L/A:L (all low) as it's a database injection, but scope unchanged. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a score of 7.3? Actually CVSS 3.1 with C:L/I:L/A:L and everything else low gets 7.3 (High). But original 4.0 score is 5.5. The difference is that 4.0 has separate vulnerable system impact and subsequent impact, and here it's low impact across all three. In 3.1, low impact on all three with AV:N/AC:L/PR:N/UI:N/S:U yields 7.3. That might be too high. The 4.0 vector gave VC:L/VI:L/VA:L (low). Equivalent 3.1 would be the same: C:L/I:L/A:L. So I'll use that. Rationale: "Remote, unauthenticated SQL injection with low impact to confidentiality, integrity, and availability of the database." assessed_cvss40_vector: We can use the same as provided but we'll justify: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's fine. Rationale: "Attack requires only network access, no privileges; impact is limited to low on the vulnerable component." Now compile into JSON. Ensure all fields are plain text strings, no arrays. product_name: "Beauty Parlor System" summary: "SQL injection in Campcodes Beauty Parlor System 1.0 allows remote attackers to manipulate or exfiltrate appointment data via the viewid parameter in /admin/view-appointment.php. The vulnerability is remotely exploitable with no authentication, has a publicly available exploit, but EPSS predicts very low (0.05%) exploitation probability. There is no evidence of active exploitation in the wild." technical_context: "The vulnerability exists in the PHP-based Campcodes Complete Online Beauty Parlor Management System 1.0. The offending endpoint /admin/view-appointment.php fails to properly sanitize the 'viewid' input, leading to SQL injection (CWE-74, though typically categorized as CWE-89). The CPE identifies the affected application exactly, and the vulnerability is exploitable against the database back-end, likely MySQL." risk_assessment: "CVSS 4.0 base score 5.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, indicating easy remote exploitation but only low impact to confidentiality, integrity, and availability. EPSS gives a 0.05% chance of exploitation in the next 30 days, in the 15th percentile, suggesting almost negligible real-world threat. No CISA KEV entry. A public proof-of-concept (PoC) exists, enabling scripted attacks, but the product is a niche beauty parlor management system with likely minimal enterprise footprint. SSVC assessment: Exploitation (PoC), Automatable (Yes), Technical Impact (Partial). Overall, this is a low-priority issue except for organizations actively using this exact software." affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0 (cpe:2.3:a:campcodes:
SQL injection in Online Beauty Parlor System 1.0 allows remote attackers to manipulate database queries through the /admin/search-invoices.php endpoint. The vulnerability carries a medium CVSS score, but exploit code is publicly available and no authentication is required, making it easy to attack. No active exploitation in the wild has been confirmed, and the EPSS probability remains low.
Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.
SQL injection in FastAdmin up to version 1.7.0.20250506 allows high-privilege authenticated attackers to execute arbitrary SQL queries via manipulation of the custom/searchField parameter in the selectpage function of the Backend Controller. The vulnerability requires administrator-level privileges and has publicly available exploit code, though the low CVSS score (2.0) and minimal EPSS exploitation probability (0.06%) indicate limited real-world risk despite active disclosure.
Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.
SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.
SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate the txtCategoryName parameter in /admin/add_category.php, potentially enabling unauthorized data access or modification. The vulnerability is unauthenticated and exploit code is publicly available, though no active exploitation in the wild has been confirmed. EPSS probability is low (0.05%), indicating limited real-world exploitation likelihood.
SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.
SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.
SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the ID parameter in /admin/userdelete.php. The vulnerability requires administrator access and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. Publicly available exploit code exists, though EPSS scoring (0.01%, percentile 3%) indicates minimal real-world exploitation probability, suggesting the threat is primarily theoretical despite public disclosure.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to inject malicious SQL via the /admin/stateadd.php endpoint, potentially compromising database integrity and confidentiality. The vulnerability requires administrative privileges to exploit and has a low CVSS score (2.0) due to restricted scope and limited impact, but publicly available exploit code exists. Real-world risk is minimal given the high privilege barrier (PR:H), though organizations running this system should prioritize patching to prevent insider threats.
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to execute arbitrary SQL queries via the /admin/userbuilderdelete.php endpoint. The vulnerability requires authenticated administrator access (CVSS PR:H) and affects only confidentiality and integrity with low impact. Publicly available exploit code exists, though exploitation is limited by the requirement for valid high-privilege credentials and carries low real-world risk due to EPSS score of 0.05% and the attacker profile (malicious insiders with admin accounts).
SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the /admin/useragentdelete.php endpoint. The vulnerability requires administrator credentials but poses risk to systems where admin accounts may be compromised or where privileged users are untrusted. Publicly available exploit code exists, though EPSS indicates low real-world exploitation probability at 0.05%.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to query, modify, or delete database records via the cmbAreaCode parameter in /admin/add_retailer.php. Public exploit code is available, but the vulnerability is not known to be actively exploited (CISA KEV). The EPSS exploitation probability is very low (0.05%), indicating limited real-world targeting.
Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
SQL injection in the Advance Seat Reservation Management for WooCommerce plugin <=3.1 allows unauthenticated attackers to extract sensitive database contents. The vulnerability carries a CVSS 9.3 score, with network vector, no privileges, and scope change leading to high confidentiality impact and minor availability disruption. No active exploitation or public POC has been confirmed, and EPSS indicates a very low exploitation probability (0.05%).
Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.
SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.
SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.
SQL injection in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761 allows authenticated remote attackers to manipulate the filter parameter in the /dishtrade/dish_trade_detail_get endpoint, resulting in limited confidentiality and integrity impact. Public exploit code exists; however, the CVSS score of 2.1 and EPSS percentile of 16% indicate low real-world exploitation probability despite authenticated network accessibility, suggesting the vulnerability may require specific application knowledge or platform-dependent conditions to achieve meaningful impact.
SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.
SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.
Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.
Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.
Blind SQL injection in the Newsletter plugin for WordPress up to
SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.
Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.
SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.
Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.
SQL injection in ketr JEPaaS up to version 7.2.8 allows high-privileged remote attackers to manipulate the keyWord argument in the readAllPostil function (/je/postil/postil/readAllPostil), resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS score of 2.0 reflects the requirement for high-level privileges (PR:H), significantly limiting real-world exploitation scope.
SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.
SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to manipulate the meta_value argument in /admin/?page=system_info to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates low exploitation probability, consistent with the product's limited deployment footprint.
SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/?page=user. Exploit code is publicly available, making exploitation straightforward, though no active exploitation has been reported by CISA. The impact is rated low, potentially allowing limited data disclosure or modification.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).