SQL Injection

SQL injection in Simple Stock System 1.0 allows remote attackers to manipulate the uname parameter in /logout.php, potentially bypassing authentication or altering backend data. Public exploit code is available, though no active exploitation has been reported.

SQL injection in DedeCMS up to version 5.7.118 via the orderby parameter in /freelist_main.php allows authenticated remote attackers to execute arbitrary SQL queries with low impact on confidentiality, integrity, and availability. Publicly available exploit code exists and the vulnerability requires valid user authentication (PR:L) to exploit, significantly limiting real-world risk despite network accessibility.

SQL injection in SeaCMS up to version 13.3 via the e_id parameter in admin_video.php allows authenticated high-privilege attackers to execute arbitrary SQL queries and manipulate database content. The vulnerability requires administrative credentials, limiting real-world impact despite public exploit availability. EPSS score of 0.05% reflects the high privilege requirement needed for exploitation.

SQL injection in SeaCMS up to version 13.3 allows unauthenticated remote attackers to manipulate the `page` and `limit` parameters in the DM player component's database abstraction layer (`js/player/dmplayer/dmku/class/mysqli.class.php`), yielding read and write access to the underlying database. The affected component fails to sanitize pagination inputs before constructing SQL queries, exposing database contents including user credentials and site configuration. A public proof-of-concept exploit has been disclosed, though EPSS remains low at 0.05%, reflecting the product's limited global deployment footprint.

We are tasked with producing a JSON object synthesizing data for CVE-2025-14990. CVE ID: CVE-2025-14990 Description: "A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-appointment.php. Performing a manipulation of the argument viewid results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks." Given: CVSS Score: 5.5? Actually the CVSS vector provided is a 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X The score 5.5 is likely the base score from that vector. Let's assume CVSS 4.0 base score 5.5 (low). The vector indicates: AV:N, AC:L, AT:N, PR:N, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. So it's a network-vector, low attack complexity, no privileges, no user interaction, low impact on vulnerable system (confidentiality, integrity, availability), no impact on subsequent systems. Exploit maturity E:P (proof of concept). Overall, low severity. CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')). SQL injection would normally be CWE-89, but here it's CWE-74, maybe a mistake. We'll note it's SQLi but CWE given is 74. Multi-source intel: EPSS Score: 0.05% (percentile 15%) - very low exploitation probability. POC/Exploit: Publicly available Reported by: cna@vuldb.com CPE: cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0:*:*:*:*:*:*:* Tags: PHP, SQLi, Complete Online Beauty Parlor Management System References: github issue, vuldb entries, campcodes homepage. We need to produce fields: product_name: "Complete Online Beauty Parlor Management System" - but that's long, maybe "Beauty Parlor Management System"? The CPE product name is "complete_online_beauty_parlor_management_system". Short: "Complete Online Beauty Parlor Management System" (still long) but they said 1-3 words ONLY. Could be "Beauty Parlor CMS"? But better: "Beauty Parlor Management". However, the exact name is "Complete Online Beauty Parlor Management System". 1-3 words: "Beauty Parlor System"? That might lose clarity. I'll choose "Beauty Parlor Management" (3 words). Or "Complete Online Beauty Parlor" is 3 words? Actually "Complete Online Beauty" is 3 words. But product name: "Campcodes Complete Online Beauty Parlor Management System". I'll pick "Beauty Parlor Management" as shorthand. But the requirement: "1-3 words ONLY. The specific product or service name affected." I'll use "Beauty Parlor MS" (MS for Management System) but that might be too terse. I'll use "Online Beauty Parlor System". That's 4 words? Online (1) Beauty (2) Parlor (3) System (4) -> 4. I could drop "Online": "Beauty Parlor System" is 3. Or "Beauty Parlor CMS"? The software might not be a CMS. I'll go with "Beauty Parlor Management System"? That's 4 words. Maybe "Beauty Parlor Mgmt" but Mgmt is not a word. The rule says "1-3 words ONLY." So I need a very short product name. The vendor is Campcodes, the product is "Complete Online Beauty Parlor Management System". I could say "Beauty Parlor System" (3 words). Yes, that works. I'll use "Beauty Parlor System". The CPE confirms it's version 1.0. summary: Must be original synthesis, not copy of description. Start with specific impact verb and product. E.g., "SQL injection in Beauty Parlor System 1.0 allows remote attackers to manipulate appointment data via viewid parameter." Include EPSS risk: "EPSS predicts very low exploitation probability (0.05%), but a public exploit is available." Mention CWE and KEV? Not in KEV. So "no known active exploitation." Noted: POC is public. technical_context: Mention that it's a PHP web application, the vulnerability is SQL injection in the /admin/view-appointment.php endpoint through the viewid parameter. CWE-74 indicates injection, though SQLi is typically CWE-89. The CPE specifies the exact product and version. The underlying technology: PHP and likely MySQL. risk_assessment: CVSS 4.0 base score 5.5 Medium (Low impact, network, low attack complexity, no privs needed). EPSS 0.05% suggests very unlikely to be exploited in the wild. Not in KEV. POC exists, so possible targeted attacks. The application is a niche beauty parlor management system, likely limited enterprise deployment, so real-world risk is low. SSVC: Exploitation: PoC (public), Automatable: Yes (network, low complexity), Technical Impact: Partial (low impact on confidentiality, integrity, availability). So priority might be moderate only for organizations using this specific software. Compare signals: high ease of exploitation (remote, no auth) but low impact and low prevalence reduces urgency. affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0, as per CPE cpe:2.3:a:campcodes:complete_online_beauty_parlor_management_system:1.0. The affected file is /admin/view-appointment.php. No vendor advisory link is provided; references include VulDB entries and a GitHub issue." remediation: No official fix mentioned. Since no vendor advisory is available, suggest: "No vendor patch identified. Mitigation: Disable the affected endpoint /admin/view-appointment.php if not needed, or apply input validation to sanitize the viewid parameter. Restrict network access to the admin panel to trusted IPs. Regularly monitor for SQLi attempts." Since it's a remote unauthenticated injection, the best immediate step is to filter the parameter. Provide specific: "Apply a Web Application Firewall rule to block SQLi patterns on the viewid parameter. Note that the application is from Campcodes, possibly discontinued, so consider replacing the software if it is mission-critical." No patch available. exploit_scenario: "An attacker sends a crafted HTTP GET request to /admin/view-appointment.php?viewid=1' OR '1'='1, exploiting the SQL injection to extract database information, modify appointment records, or potentially gain further access to the underlying server if database privileges allow." exploitation_conditions: From CVSS: AV:N, AC:L, PR:N, UI:N, so no authentication required, remotely exploitable, no user interaction. So conditions: "No special conditions — remote unauthenticated exploitation against default configurations of Beauty Parlor System 1.0. The /admin/view-appointment.php endpoint is publicly accessible and does not require authentication." No limiting factors beyond maybe the admin interface might be somewhat hidden, but default is often accessible. So "unauthenticated". attack_chain: "Reconnaissance of web application → Send malicious SQL payload in viewid parameter → Backend PHP code concatenates input into SQL query → SQL query executed, data exfiltration or modification." More concisely: "Identify /admin/view-appointment.php endpoint → Inject SQL via viewid → Database executes malicious query → Extract/modify appointment data". That's 4 steps. confidence_notes: What is confirmed: Vulnerability in /admin/view-appointment.php of Campcodes Complete Online Beauty Parlor Management System 1.0, disclosed publicly via VulDB and GitHub. Exploit PoC available. Not confirmed: Active exploitation (no KEV). No vendor advisory found; patch status unknown. The CWE is given as CWE-74, but SQL injection is typically CWE-89 — possible misclassification. prevalence: The software is a niche product for beauty parlors, likely low deployment in enterprise environments. So prevalence: "low". Basis: "niche vertical application for small businesses" (max 12 words). I'll use "low" and basis "small business beauty parlor management software". assessed_cvss_vector: Given CVSS 4.0 vector already provided. But the task says: "Your OWN independent CVSS 3.1 base-metric vector ... grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we need to assign a 3.1 vector. According to description: network attack vector, low complexity, no privileges (since it seems unauthenticated — the description doesn't mention auth, but CVSS 4.0 gave PR:N), no user interaction. Impact: SQL injection could lead to data leakage and data manipulation, but CVSS 4.0 gave Low for all. For 3.1, we'd have: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N maybe? Or could be C:L/I:L/A:L? SQLi often leads to database compromise, which can affect availability too. I'll assign C:L/I:L/A:L (all low) as it's a database injection, but scope unchanged. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That's a score of 7.3? Actually CVSS 3.1 with C:L/I:L/A:L and everything else low gets 7.3 (High). But original 4.0 score is 5.5. The difference is that 4.0 has separate vulnerable system impact and subsequent impact, and here it's low impact across all three. In 3.1, low impact on all three with AV:N/AC:L/PR:N/UI:N/S:U yields 7.3. That might be too high. The 4.0 vector gave VC:L/VI:L/VA:L (low). Equivalent 3.1 would be the same: C:L/I:L/A:L. So I'll use that. Rationale: "Remote, unauthenticated SQL injection with low impact to confidentiality, integrity, and availability of the database." assessed_cvss40_vector: We can use the same as provided but we'll justify: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's fine. Rationale: "Attack requires only network access, no privileges; impact is limited to low on the vulnerable component." Now compile into JSON. Ensure all fields are plain text strings, no arrays. product_name: "Beauty Parlor System" summary: "SQL injection in Campcodes Beauty Parlor System 1.0 allows remote attackers to manipulate or exfiltrate appointment data via the viewid parameter in /admin/view-appointment.php. The vulnerability is remotely exploitable with no authentication, has a publicly available exploit, but EPSS predicts very low (0.05%) exploitation probability. There is no evidence of active exploitation in the wild." technical_context: "The vulnerability exists in the PHP-based Campcodes Complete Online Beauty Parlor Management System 1.0. The offending endpoint /admin/view-appointment.php fails to properly sanitize the 'viewid' input, leading to SQL injection (CWE-74, though typically categorized as CWE-89). The CPE identifies the affected application exactly, and the vulnerability is exploitable against the database back-end, likely MySQL." risk_assessment: "CVSS 4.0 base score 5.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, indicating easy remote exploitation but only low impact to confidentiality, integrity, and availability. EPSS gives a 0.05% chance of exploitation in the next 30 days, in the 15th percentile, suggesting almost negligible real-world threat. No CISA KEV entry. A public proof-of-concept (PoC) exists, enabling scripted attacks, but the product is a niche beauty parlor management system with likely minimal enterprise footprint. SSVC assessment: Exploitation (PoC), Automatable (Yes), Technical Impact (Partial). Overall, this is a low-priority issue except for organizations actively using this exact software." affected_products: "Campcodes Complete Online Beauty Parlor Management System version 1.0 (cpe:2.3:a:campcodes:

SQL injection in Online Beauty Parlor System 1.0 allows remote attackers to manipulate database queries through the /admin/search-invoices.php endpoint. The vulnerability carries a medium CVSS score, but exploit code is publicly available and no authentication is required, making it easy to attack. No active exploitation in the wild has been confirmed, and the EPSS probability remains low.

Remote SQL injection in Simple Stock System 1.0 allows unauthenticated attackers to manipulate SQL queries via the email parameter in /market/update.php. Public exploit code exists, but no active exploitation has been confirmed. The vulnerability affects the code-projects.org stock management application, potentially exposing database contents.

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the school_year parameter in /candidates_report.php. Public exploit code is available, enabling unauthorized data access and potential database compromise, though EPSS probability of exploitation is very low (0.05%). No active exploitation has been reported to CISA KEV at this time.

SQL injection in FastAdmin up to version 1.7.0.20250506 allows high-privilege authenticated attackers to execute arbitrary SQL queries via manipulation of the custom/searchField parameter in the selectpage function of the Backend Controller. The vulnerability requires administrator-level privileges and has publicly available exploit code, though the low CVSS score (2.0) and minimal EPSS exploitation probability (0.06%) indicate limited real-world risk despite active disclosure.

Remote SQL injection in Simple Blood Donor Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the campaignname parameter in /editedcampaign.php. A public exploit exists, though the vulnerability is not listed in CISA KEV and has a 0.05% EPSS score, suggesting low current exploitation likelihood.

SQL injection in code-projects Simple Blood Donor Management System 1.0 allows remote attackers to manipulate database queries via the Name parameter in /editeddonor.php. Exploit code is publicly available, but no active exploitation known; low real-world impact due to limited product footprint.

SQL injection in Simple Stock System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Username field in /market/signup.php. Public exploit code is available, lowering the barrier to exploitation, though EPSS indicates low probability of widespread attacks.

SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate the txtCategoryName parameter in /admin/add_category.php, potentially enabling unauthorized data access or modification. The vulnerability is unauthenticated and exploit code is publicly available, though no active exploitation in the wild has been confirmed. EPSS probability is low (0.05%), indicating limited real-world exploitation likelihood.

SQL injection in Scholars Tracking System 1.0 allows remote attackers to manipulate the post_content parameter in /home.php, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but no active exploitation is confirmed and EPSS indicates low exploitation probability.

SQL injection in code-projects Scholars Tracking System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID parameter of /delete_post.php. A publicly available proof-of-concept exists, but the EPSS score is only 0.05% (15th percentile), indicating a currently low probability of widespread exploitation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

SQL injection in Scholars Tracking System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /admin/delete_user.php. The vulnerability enables limited modification or deletion of database records. A public proof-of-concept exploit exists, but no active exploitation in the wild has been confirmed.

SQL injection in code-projects Online Appointment Booking System 1.0 allows high-privilege remote attackers to manipulate the managername parameter in /admin/deletemanager.php, resulting in limited confidentiality and integrity impact. EPSS score of 0.05% and CVSS 2.0 reflect the high privilege requirement (PR:H), which severely constrains real-world exploitability despite public POC availability.

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the ID parameter in /admin/userdelete.php. The vulnerability requires administrator access and carries low confidentiality, integrity, and availability impact per CVSS 4.0 scoring. Publicly available exploit code exists, though EPSS scoring (0.01%, percentile 3%) indicates minimal real-world exploitation probability, suggesting the threat is primarily theoretical despite public disclosure.

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to inject malicious SQL via the /admin/stateadd.php endpoint, potentially compromising database integrity and confidentiality. The vulnerability requires administrative privileges to exploit and has a low CVSS score (2.0) due to restricted scope and limited impact, but publicly available exploit code exists. Real-world risk is minimal given the high privilege barrier (PR:H), though organizations running this system should prioritize patching to prevent insider threats.

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privilege administrators to execute arbitrary SQL queries via the /admin/userbuilderdelete.php endpoint. The vulnerability requires authenticated administrator access (CVSS PR:H) and affects only confidentiality and integrity with low impact. Publicly available exploit code exists, though exploitation is limited by the requirement for valid high-privilege credentials and carries low real-world risk due to EPSS score of 0.05% and the attacker profile (malicious insiders with admin accounts).

SQL injection in CodeAstro Real Estate Management System 1.0 allows high-privileged administrators to execute arbitrary SQL queries via the /admin/useragentdelete.php endpoint. The vulnerability requires administrator credentials but poses risk to systems where admin accounts may be compromised or where privileged users are untrusted. Publicly available exploit code exists, though EPSS indicates low real-world exploitation probability at 0.05%.

SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to query, modify, or delete database records via the cmbAreaCode parameter in /admin/add_retailer.php. Public exploit code is available, but the vulnerability is not known to be actively exploited (CISA KEV). The EPSS exploitation probability is very low (0.05%), indicating limited real-world targeting.

Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).

Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).

SQL injection in the Advance Seat Reservation Management for WooCommerce plugin <=3.1 allows unauthenticated attackers to extract sensitive database contents. The vulnerability carries a CVSS 9.3 score, with network vector, no privileges, and scope change leading to high confidentiality impact and minor availability disruption. No active exploitation or public POC has been confirmed, and EPSS indicates a very low exploitation probability (0.05%).

Blind SQL injection in the PopupKit WordPress plugin through version 2.1.5 allows authenticated attackers with low privileges to extract sensitive database information without user interaction. The vulnerability, assigned CWE-89, has a high CVSS score but a very low EPSS probability (0.05%), and no known public exploits or active exploitation have been identified at this time.

SQL injection in Simple Stock System 1.0 via the Username parameter in /checkuser.php allows authenticated remote attackers to manipulate database queries with low impact to confidentiality, integrity, and availability. The CVSS 4.0 vector (PR:L) indicates login is required, but an EPSS score of 0.05% and very low CVSS base of 2.1 suggest minimal real-world exploitation risk despite public exploit availability.

SQL injection in code-projects Online Appointment Booking System 1.0 allows remote attackers to manipulate the 'clinic' parameter in /admin/deletemanagerclinic.php, leading to unauthorized data access, modification, or deletion. A public exploit is available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates low (0.04%) exploitation probability.

SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote, unauthenticated attackers to inject arbitrary SQL commands via the ID argument in /updateproduct.php?action=edit. Exploit code is publicly available, but no active exploitation has been reported through CISA KEV.

SQL injection in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761 allows authenticated remote attackers to manipulate the filter parameter in the /dishtrade/dish_trade_detail_get endpoint, resulting in limited confidentiality and integrity impact. Public exploit code exists; however, the CVSS score of 2.1 and EPSS percentile of 16% indicate low real-world exploitation probability despite authenticated network accessibility, suggesting the vulnerability may require specific application knowledge or platform-dependent conditions to achieve meaningful impact.

SQL injection in LBG Zoominoutslider WordPress plugin versions through 5.4.4 allows authenticated attackers with low-level privileges to extract sensitive database information and potentially cause denial of service. The vulnerability enables cross-scope impact, meaning attackers can access resources beyond their authorized privilege level. EPSS probability is low (0.04%, 14th percentile), indicating limited observed exploitation activity, though Patchstack's disclosure suggests active security community awareness.

SQL injection in Themefic Hydra Booking for WordPress allows authenticated attackers to read sensitive database contents. The vulnerability affects versions up to 1.1.32 and is reachable over the network with low-privilege access. No public exploit is known and EPSS indicates low exploitation probability.

Blind SQL injection vulnerability in the LambertGroup CountDown With Image or Video Background WordPress plugin (versions up to 1.5) allows authenticated users with minimal privileges (e.g., subscriber) to extract sensitive database information. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of real‑world attacks.

Blind SQL injection in the xPromoter top_bar_promoter WordPress plugin versions up to 1.3.4 permits authenticated attackers with low privileges to extract sensitive data from the database. Exploitation requires sending crafted requests to a vulnerable plugin endpoint, potentially exposing user credentials and configuration details. No public exploit code or active exploitation has been reported, and EPSS score indicates a low probability of widespread attacks.

Blind SQL injection in the Newsletter plugin for WordPress up to

SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.

Blind SQL injection in the All In One SEO Pack WordPress plugin through version 4.9.1 allows authenticated attackers with subscriber-level access to execute arbitrary SQL queries, potentially extracting sensitive database contents.

SQL injection in FantasticLBP Hotels Server's hotel listing API endpoint allows unauthenticated remote attackers to manipulate backend database queries by supplying malicious values to the pickedHotelName or type parameters in /controller/api/hotelList.php. Impact is limited - the CVSS 4.0 vector assigns low ratings across confidentiality, integrity, and availability - but the attack requires no authentication and no user interaction. A public proof-of-concept exploit exists via GitHub issues, though EPSS at 0.08% (23rd percentile) indicates negligible observed exploitation activity to date. The vendor did not respond to disclosure, and no patch has been issued.

Remote SQL injection in FantasticLBP Hotels Server's /controller/api/OrderList.php endpoint allows unauthenticated attackers to execute arbitrary SQL commands via the telephone parameter, potentially leading to unauthorized data access or modification. Public exploit code exists, but the vulnerability has not been observed in active exploitation.

SQL injection in ketr JEPaaS up to version 7.2.8 allows high-privileged remote attackers to manipulate the keyWord argument in the readAllPostil function (/je/postil/postil/readAllPostil), resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the CVSS score of 2.0 reflects the requirement for high-level privileges (PR:H), significantly limiting real-world exploitation scope.

SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.

SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to manipulate the meta_value argument in /admin/?page=system_info to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates low exploitation probability, consistent with the product's limited deployment footprint.

SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/?page=user. Exploit code is publicly available, making exploitation straightforward, though no active exploitation has been reported by CISA. The impact is rated low, potentially allowing limited data disclosure or modification.

SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.

SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.

SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).

SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.

SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.

SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.

SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.

SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).

SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.

SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.

SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.

SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).

SQL injection in Online Pet Shop Management System 1.0 (by itsourcecode/Facebook Riares) allows unauthenticated remote attackers to manipulate database queries via the `cnpname` parameter in `/pet1/addcnp.php`. A public proof-of-concept exploit exists on GitHub. Despite the PR:N CVSS vector indicating no authentication is required, real-world risk is constrained by the product's negligible deployment footprint - this is a freely distributed PHP student/demo project, not enterprise software. EPSS of 0.05% (15th percentile) reflects the low likelihood of opportunistic exploitation.

SQL injection in Student File Management System 1.0 at /admin/update_student.php via the stud_id parameter allows remote attackers to read or modify database contents without authentication. Exploit code is publicly available, though no active exploitation has been confirmed.

SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the firstname parameter in /admin/save_user.php. Exploit code is publicly available, but no reports of active exploitation exist at this time. The vulnerability has a CVSS 4.0 base score of 5.5 (low impact) and an EPSS score of 0.07%, indicating low exploitation probability.

SQL injection in Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the user_id parameter in /admin/update_user.php. Public exploit code is available on GitHub, but the EPSS score (0.05%) indicates low exploitation probability and no active exploitation is confirmed (not in CISA KEV). The vulnerability is easy to exploit but yields only limited data confidentiality, integrity, and availability impacts.

SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter of /admin/login_query.php. The vulnerability, with publicly available exploit code, enables low-impact data extraction or modification without authentication. At the time of analysis, it is not listed in CISA's KEV, and EPSS indicates low exploitation probability.

SQL injection in code-projects Student File Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the stud_no parameter in login_query.php. A public exploit is available, but EPSS indicates a low probability of widespread exploitation (0.07%); the vulnerability is not listed in CISA KEV.

SQL injection vulnerability in code-projects Prison Management System 2.0 allows remote attackers to manipulate the keyname parameter in /admin/search1.php, potentially leading to low-impact data exposure and modification. The vulnerability is publicly known with exploit code available, but no active exploitation has been reported. EPSS predicts a 0.05% chance of exploitation.

SQL injection in code-projects Prison Management System 2.0 allows authenticated remote attackers to execute arbitrary SQL commands via the keyname parameter in /admin/search.php, with publicly available exploit code but limited real-world impact due to authentication requirement and restricted scope (confidentiality only, CVSS 2.1).

Remote SQL injection in itsourcecode Student Management System 1.0 allows unauthenticated attackers to manipulate database queries via the 'ID' parameter in /update_program.php. Public exploit code is available, though no active exploitation has been confirmed through CISA KEV and EPSS indicates low probability of widespread exploitation.

Unsanitized user input in the 'Name' parameter of /pet1/available.php in itsourcecode Online Pet Shop Management System 1.0 allows remote unauthenticated SQL injection against the backend database. Attackers can exfiltrate or alter database records; exploit code is publicly available. No active exploitation has been reported, and EPSS indicates a very low probability of widespread attacks.

SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID parameter in the admin zone page. Exploit code is publicly available, though no active exploitation is confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and a low EPSS probability (0.07%), indicating limited real-world risk despite the public exploit.

SQL injection in itsourcecode COVID Tracking System 1.0 allows remote attackers to manipulate database queries via the Username parameter of the Admin Login page. A public exploit is available, but the EPSS exploitation probability is very low (0.05%), and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at this time. The flaw can lead to unauthorized data access or authentication bypass.

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via an unsanitized ID parameter in /update_account.php, potentially leading to unauthorized data modification or access. Public exploit code is available, but EPSS indicates low exploitation probability.

SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate database queries via the roll_number parameter in /borrow_book.php. Public exploit code is available, though no active exploitation or vendor patch has been confirmed. The EPSS score indicates a very low probability of widespread exploitation at this time.

SQL injection in Projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the admin_id parameter in /view_admin.php. This can result in low-impact data disclosure, tampering, or denial of service against the backend database. While a public exploit exists, the vulnerability is not known to be actively exploited in the wild and has a very low EPSS score.

SQL injection in haxxorsid Stock-Management-System up to commit fbbbf213e9c93b87183a3891f77e3cc7095f22b0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulation of the employee_id, id, or admin parameters in model/User.php. The vulnerability has a low CVSS score (2.1) due to limited scope and impact, but carries low but non-zero exploitation probability (EPSS 0.05%). Public exploit code exists and the product is no longer maintained, eliminating vendor-supplied patch availability.

Remote SQL injection in kidaze CourseSelectionSystem through an unknown function in /Profilers/SProfile/reg.php allows unauthenticated attackers to manipulate database queries via the USN parameter. A proof-of-concept exploit is publicly available, but EPSS data indicates a low exploitation probability (0.05%); no active exploitation has been reported.

SQL injection in kidaze CourseSelectionSystem allows unauthenticated remote attackers to execute arbitrary SQL commands via the Username parameter in the login endpoint /Profilers/SProfile/login1.php. Public exploit code is available, though EPSS indicates a very low probability of widespread exploitation. The vulnerability has low confidentiality, integrity, and availability impacts according to CVSS v4.0 scoring.

SQL injection in code-projects Class and Exam Timetable Management 1.0 allows remote attackers to manipulate database queries. The vulnerability resides in the /preview7.php endpoint, where the course_year_section or semester parameter can be abused without authentication. Public exploit code is available, but no evidence of active exploitation in the wild or CISA KEV listing exists.

SQL injection vulnerability in the Class and Exam Timetable Management System v1.0 login page allows remote, unauthenticated attackers to inject arbitrary SQL via the username and password fields in /index.php. Exploit code is publicly available, though no active exploitation has been confirmed (not in CISA KEV), and EPSS indicates a low exploitation probability.

Remote SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated attackers to manipulate the 'pid' argument in /admin/admin_running.php, leading to potential data exposure or modification. Exploit code is publicly available but no active exploitation has been confirmed (not in CISA KEV); the EPSS score of 0.05% indicates low probability of widespread exploitation despite the low attack complexity and no authentication requirement.

SQL injection in projectworlds Advanced Library Management System 1.0 allows unauthenticated remote attackers to compromise database integrity, confidentiality, and availability via the book_id parameter in /view_book.php. Public proof-of-concept exploit code exists, but the software's niche deployment footprint and low EPSS exploitation probability (0.05%) suggest limited real-world impact; no active exploitation is confirmed by CISA KEV.

SQL injection in Campcodes Supplier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the txtunitDetails parameter in /admin/add_unit.php. Public exploit code is available, but EPSS indicates low exploitation probability (0.05%) and it is not listed in CISA KEV.

SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to manipulate database queries via the `txtDistributorAddress` parameter in `/admin/add_distributor.php`. Public exploit code is available, though the EPSS score indicates a very low probability of widespread exploitation.

A SQL injection vulnerability exists in LangGraph SQLite Checkpoint, an implementation of LangGraph CheckpointSaver for SQLite databases. The vulnerability affects versions 3.0.0 and below of the langgraph-checkpoint-sqlite Python package, allowing attackers with local access and low privileges to manipulate SQL queries through unvalidated metadata filter keys in checkpoint search operations. A proof-of-concept exploit is publicly available, though the EPSS score of 0.02% (6th percentile) suggests minimal active exploitation in the wild currently.

SQL injection in itsourcecode Student Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the grade parameter in /new_grade.php. Publicly available exploit code exists, but the EPSS score is low (0.05%) and no active exploitation has been reported via CISA KEV, suggesting limited interest or targeting.

SQL injection in itsourcecode Student Management System 1.0's promote.php endpoint allows remote attackers to manipulate the 'sy' parameter to execute arbitrary SQL queries, leading to potential data exposure or modification. A public proof-of-concept exploit exists, but there is no indication of active exploitation. The EPSS score

SQL injection vulnerability in itsourcecode Student Management System version 1.0 allows remote attackers to manipulate database queries via the sy parameter in /new_school_year.php. Exploit code is publicly available, though no active exploitation has been confirmed by CISA KEV. The low EPSS score (0.05%) suggests limited exploitability in practice.

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate the Name parameter in /new_adviser.php to execute arbitrary SQL commands. An exploit is publicly available, though no active exploitation is confirmed (not in CISA KEV); EPSS score is low (0.05%).

Authenticated SQL injection in the Media Library Tools WordPress plugin (≤1.6.15) allows high-privilege attackers to extract sensitive database information, with CVSS 7.6 signaling high confidentiality impact but limited integrity impact; no active exploitation or public exploit code is known, and EPSS indicates very low exploitation probability (0.06%).

SQL injection in the Ninja Tables WordPress plugin (≤5.2.3) enables authenticated administrators to extract sensitive database contents. The flaw allows high-privileged users to perform unauthorized SQL queries, compromising confidentiality with limited availability impact. No active exploitation or public PoC has been reported, and EPSS indicates very low exploitation probability.

Blind SQL injection in LambertGroup Accordion Slider PRO WordPress plugin versions through 1.2 allows authenticated attackers to exfiltrate sensitive database information. An attacker with low-privilege access (such as a subscriber) can execute arbitrary SQL queries via vulnerable plugin parameters, potentially accessing all database contents. No public exploit code or active exploitation has been reported, though the vulnerability carries a high confidentiality impact.

Blind SQL injection in the ArtPlacer Widget WordPress plugin (versions through 2.22.9.2) allows an authenticated low-privilege attacker to extract database contents via crafted requests to a vulnerable endpoint. The vulnerability carries a scope-changed CVSS rating because the WordPress database is shared across plugins and core, meaning successful exploitation can expose credentials, user data, and content belonging to other installed components - not just the ArtPlacer plugin itself. No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score (0.06%, 19th percentile) reflects minimal current attacker interest.