SQL Injection

Blind SQL injection in Agile Logix Store Locator WordPress plugin version 1.6.2 and below allows authenticated low-privileged users (e.g., subscriber) to extract sensitive data from the WordPress database

SQL injection in the WordPress plugin Image&Video FullScreen Background through version 1.6.7 allows authenticated attackers with low privileges to extract sensitive information from the database. The vulnerability has a high confidentiality impact but does not permit data modification. No public exploit or active exploitation has been reported, and the EPSS score of 0.05% indicates a low probability of real-world attacks.

Unauthenticated SQL injection in Talent Software UNIS versions prior to 42321 allows remote attackers to manipulate backend database queries over the network without any authentication or user interaction. The vulnerability carries a CVSS 9.8 rating reflecting full compromise potential across confidentiality, integrity, and availability, and was reported by Turkey's national CSIRT (USOM), though no public exploit code or CISA KEV listing has been identified at time of analysis.

SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL queries via the get_dashboard_data endpoint. Unsafe concatenation of user-controlled parameters into dynamic SQL statements enables data exfiltration and database manipulation. Publicly available exploit code exists. With CVSS 8.6 (Network/Low Complexity/Low Privilege Required), this represents a high-severity risk for organizations running the affected version, though no active exploitation (CISA KEV) has been confirmed.

SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers to modify or retrieve database contents via the per_id parameter in edit_personnel.php. Exploit code is publicly available, but no active exploitation has been confirmed.

SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter.

SQL injection in Jshop MiniProgram Mall System 2.9.0 via the cat_id parameter of /index.php/api.html allows low-privileged remote attackers to perform unauthorized database operations, including data extraction or modification. Public exploit code is available

Remote SQL injection in Student Management System 1.0 via the sub parameter in /newsubject.php allows unauthenticated attackers to manipulate database queries. A publicly available proof-of-concept exists, but no active exploitation has been confirmed. Exploitation probability is low (EPSS 0.04%), though the vulnerability is easily triggered over the network without authentication.

SQL injection in Student Management System 1.0 allows remote attackers to manipulate the ID parameter in /newrecord.php, potentially reading or modifying database contents. Exploit code is publicly available, though the EPSS exploitation probability is low (0.04%). No active exploitation has been reported by CISA KEV.

SQL injection in Student Management System 1.0 allows remote attackers to manipulate the 'ID' parameter in /newcurriculm.php, potentially leading to unauthorized database access. Public exploit code exists, but EPSS exploitation probability is negligible (0.04%), and no active exploitation has been reported. The affected product is a niche academic application, limiting real-world impact.

SQL injection in the admin login of Online Ordering System 1.0 allows remote, unauthenticated attackers to manipulate the Username parameter to execute unauthorized SQL commands, potentially leading to data extraction, modification, or authentication bypass. Exploit code is publicly available, but the low EPSS score (0.04%) and lack of CISA KEV listing indicate no active widespread exploitation at this time.

SQL injection in Online Ordering System 1.0 allows remote attackers to extract or modify database contents via the Name parameter in /user_contact.php. Public exploit code is available, but no evidence of active exploitation exists. EPSS is very low (0.04%), indicating minimal real-world impact.

SQL injection in Online Ordering System 1.0 allows remote attackers to inject arbitrary SQL via the product_id parameter of /user_school.php, enabling data extraction or manipulation. Exploit code is publicly available, though no active exploitation has been confirmed by CISA or threat intelligence feeds.

Unauthenticated SQL injection in Simple Shopping Cart 1.0 via the admin_username parameter on /adminlogin.php allows remote attackers to extract sensitive data or bypass authentication. A proof-of-concept exploit is publicly available, though no active exploitation has been reported in CISA KEV. The vulnerability affects code-projects/fabian's PHP-based shopping cart software.

SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate the item_name parameter in /Admin/additems.php, leading to unauthorized database access. Exploit code is publicly available, but no active exploitation has been confirmed, and a low EPSS score (0.04%) indicates minimal immediate risk.

SQL injection in Simple Shopping Cart 1.0 allows authenticated remote attackers to manipulate database queries via the user_id parameter in /Customers/settings.php. While the CVSS 4.0 base score is only 2.1 (Low), public exploit code is available, enabling authenticated attackers to read or modify database contents. The EPSS score of 0.04% and absence from CISA KEV suggest low real-world exploitation probability, but organizations using this product should assess internal risk based on stored data sensitivity.

SQL injection in IdeaCMS up to version 1.8 permits unauthenticated remote attackers to execute arbitrary SQL commands via the params argument in Coupon.php's whereRaw function. A public exploit is available, but the EPSS exploitation probability is low (0.04%), and no active exploitation is confirmed.

SQL injection in Daily Time Recording System 4.5.0 allows remote authenticated (low‑privilege) attackers to inject arbitrary SQL via the detail_Id parameter of /admin/add_payroll.php, enabling limited data disclosure, modification, or service disruption. A public proof‑of‑concept exploit exists, though the EPSS score of 0.04% suggests very low exploitation probability and no active exploitation has been confirmed.

SQL injection in Philipinho Simple-PHP-Blog up to commit 94b5d3e allows low-privileged remote attackers to manipulate SQL queries via the /edit.php endpoint. An exploit is publicly available, but no active exploitation in the wild is reported. EPSS probability is very low (0.04%).

SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to extract or modify database data by manipulating the 'fname' parameter in /edit_user.php. The exploit is publicly available, but no active exploitation has been confirmed, and the EPSS score is very low (0.04%), indicating minimal real-world likelihood.

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.

SQL injection in Simple Leave Manager 1.0 allows remote attackers to manipulate the staff_id parameter in /request.php to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. A public exploit is available but no active exploitation has been confirmed by CISA KEV.

SQL injection in Employee Profile Management System 1.0 enables authenticated remote attackers to inject arbitrary SQL via the per_id parameter in the /print_personnel_report.php endpoint. Public exploit code is available, though active exploitation is not confirmed. The flaw can lead to data leakage or manipulation.

Unsanitized ID parameter in /editotheraccount.php of code-projects Currency Exchange System 1.0 leads to SQL injection, allowing remote unauthenticated attackers to read, modify, or disrupt database contents with low confidentiality, integrity, and availability impact. Public exploit code is available; no active exploitation reported in CISA KEV. EPSS indicates a 0.04% probability of exploitation.

SQL injection in the Currency Exchange System 1.0 application allows unauthenticated remote attackers to manipulate SQL queries via the ID parameter in /edttrns.php. This can lead to unauthorized access to database contents or modification of exchange records. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.

SQL injection in code-projects Currency Exchange System 1.0 allows remote unauthenticated attackers to manipulate database queries by supplying a crafted `ID` parameter to `/viewserial.php`, potentially reading, modifying, or deleting backend database content. The affected product is a hobbyist PHP demo application distributed via code-projects.org; a proof-of-concept exploit has been publicly disclosed on GitHub. No patch has been released and the application appears to be a static demo artifact rather than an actively maintained codebase, making remediation unlikely outside of decommissioning.

SQL injection in Currency Exchange System 1.0 via the ID parameter in /edit.php allows remote attackers to manipulate database queries without authentication. Public exploit code exists, but EPSS probability is very low (0.04%) and no active exploitation is confirmed, indicating limited real-world targeting.

SQL injection in itsourcecode Student Information System 1.0 allows authenticated attackers to manipulate database queries via the ID parameter in the /section_edit1.php script. Proof-of-concept exploit code is publicly available, but exploitation requires low-privilege authentication and EPSS indicates very low likelihood of widespread exploitation.

SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject SQL via the roll_number parameter in /member_search.php. Exploit code is publicly available, but EPSS score is low (0.04%) and no active exploitation has been confirmed by CISA. Attackers may read, modify, or delete database entries depending on database user privileges.

SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to inject malicious SQL via the book_id parameter in /delete_book.php, potentially resulting in unauthorized data access or modification. No authentication is required, and public exploit code is available, as documented by VulDB and NVD.

SQL injection in projectworlds Advanced Library Management System 1.0 allows remote attackers to manipulate the user_id parameter in /delete_member.php, potentially leading to unauthorized database access or data modification. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%), and no active exploitation has been confirmed through CISA KEV.

SQL injection in Campcodes School File Management System 1.0 allows unauthenticated remote attackers to inject SQL via the stud_id parameter in /update_query.php. Exploit code is publicly available, but the EPSS exploitation probability is very low (0.04%) and the CISA KEV catalog does not list it. The vulnerability has a CVSS 4.0 score of 5.5 (Medium), reflecting limited impact on confidentiality, integrity, and availability.

SQL injection in the tushar-2223 Hotel-Management-System PHP project allows remote attackers to manipulate database queries via the `ID` parameter in `/admin/invoiceprint.php`. The affected codebase is pinned to rolling-release commit bb1f3b3, with no versioned patch available. A publicly available exploit report exists on GitHub (yaklang/IRifyScanResult), though EPSS at 0.04% (13th percentile) indicates negligible real-world exploitation activity - consistent with the project's extremely limited production footprint. No confirmed active exploitation (no CISA KEV entry).

SQL injection in code-projects Question Paper Generator 1.0 allows remote authenticated attackers to manipulate the subid parameter in /selectquestionuser.php, leading to limited data disclosure, modification, or service disruption. Exploit code is publicly available, though the EPSS score of 0.04% indicates extremely low probability of widespread exploitation.

SQL injection vulnerability in code-projects Employee Profile Management System 1.0 allows remote attackers with low privileges to manipulate the per_id parameter in /view_personnel.php, potentially leading to unauthorized database access. A public proof-of-concept exploit is available, but EPSS data indicates a low exploitation probability (0.04%) and there is no evidence of active exploitation in the wild. The vulnerability has been assigned CVE-2025-14193 and affects a niche application, limiting widespread risk.

We are to generate a comprehensive analysis based on the provided data, following the strict JSON output format. Let's break down the input: - CVE: CVE-2025-14192 - Description: Vulnerability in RashminDungrani online-banking up to commit hash 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. File /site/dist/auth_login.php, Username argument leads to SQL injection. Remote attack. Exploit public. Rolling releases, no version details. Vendor did not respond. - CVSS Score: 5.5 (this is likely a CVSS v4.0 base score given the vector) - CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (this is a CVSS 4.0 vector, with E:P indicating exploit code maturity is proof-of-concept, and other supplemental metrics as X not defined) - CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')) - EPSS: 0.04% (13th percentile) - very low. - KEV: not mentioned, so not in CISA KEV. - Patch availability: The description says "Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available." Also vendor did not respond. So no clear patch version. However, the vulnerability might be fixed in some later commit? Since rolling releases, the commit hash might be the known affected one, but later commits may have fixed it silently? In remediation, we must note that no official patch version is available, but the GitHub repo might have updates. - Tags: SQLi, PHP - CPE strings: not explicitly given, but affected versions from EUVD: online-banking 2337ad552ea9d385b4e07b90e6f32d011b7c68a2. This suggests the product is a specific GitHub repository. So we can derive product name: "online-banking" by RashminDungrani. - References: a GitHub file showing exploit? The first link is a docx file "online-banking-have-sql.docx" which likely conta

SQL injection in Chanjet TPlus through version 20251121 allows remote unauthenticated attackers to manipulate the currentAccId parameter in the MultiCompanySettingController ASHX handler, leading to limited data tampering, information disclosure, and service disruption. Public exploit code is available; however, no active exploitation has been confirmed (not listed in CISA KEV), and EPSS indicates low probability of widespread attacks.

SQL injection in Chanjet CRM up to version 20251121 allows remote attackers to manipulate database queries via the gblOrgID parameter in /tools/jxf_dump_table_demo.php. Public exploit code is available, enabling practical attacks despite a low EPSS exploitation probability of 0.04%. The vendor has not responded to disclosure, leaving no official patch.

SQL injection in Yonyou U8 Cloud 5.0, 5.0sp, 5.1, and 5.1sp allows authenticated remote attackers to manipulate database queries via the usercode parameter in the AppServletService endpoint. Public exploit code is available, and the vendor has not responded to disclosure, though no active exploitation has been confirmed in the wild. The low CVSS v4.0 base score (2.1) and minimal EPSS (0.04%) indicate a currently low risk, but the ease of exploitation merits prompt attention.

Blind SQL injection in the AI Autotagger with OpenAI WordPress plugin allows authenticated attackers with Contributor-level access and AI metabox permissions to extract sensitive database information via time-based techniques. The vulnerability resides in the AI preview AJAX endpoint's 'existing_terms_orderby' parameter and affects versions up to 3.40.1. No active exploitation has been confirmed at this time, and the EPSS score indicates a very low probability of widespread exploitation.

SQL injection in PHP-Guitar-Shop allows remote, unauthenticated attackers to manipulate the ID parameter of /product.php, compromising the underlying database with low impact. All rolling-release versions up to commit 6ce0868889 are affected, and a public proof-of-concept exploit is available. Despite the network-accessible attack vector, EPSS indicates a very low probability of real-world exploitation.

Authenticated SQL injection in AMTT HiBOS 1.0 allows remote administrators to inject arbitrary SQL via the ID parameter in cardmake_down.php, leading to low-impact data manipulation. Exploit code is publicly available but requires administrative credentials, significantly limiting real-world risk. No active exploitation is reported.

The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the ‘auction_id’ parameter in all versions up to, and including, 3.6.32 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.

Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can use UNION-based injection to extract sensitive information from the users table including usernames and passwords.

dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.

SQL injection in JIZHICMS up to version 2.5.5 allows remote authenticated attackers to execute arbitrary SQL commands via the batch comment deletion functionality, potentially leading to data manipulation or unauthorized access to the database. A public proof-of-concept exploit is available, and the vendor has not released a

SQL injection in JIZHICMS up to 2.5.5 allows remotely authenticated attackers with high privileges to execute arbitrary SQL commands via the 'aid' or 'tid' parameters in the comment administration interface. Successful exploitation could lead to unauthorized reading or modification of database contents. Public exploit code is available, but no active exploitation is confirmed, and EPSS predicts very low exploitation probability.

## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API

The Tag, Category, and Taxonomy Manager - AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database granted they have metabox access for the taxonomy (enabled by default for contributors).

The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in com.wanli.lvzhoucms.service.ContentService#findPage. The parameter is concatenated directly into a dynamic SQL query without sanitization or prepared statements, enabling attackers to read sensitive data from the database.

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically, the username and mobileno parameters accepts unvalidated user input, which is then concatenated directly into a backend SQL query.

SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via crafted dict keys.

code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerability via the 'docid' parameter at /admin/appointment.php.

An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. `FilteredRelation` is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` passed to `QuerySet.annotate()` or `QuerySet.alias()` on PostgreSQL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Stackered for reporting this issue.

SQL injection vulnerability in TCMAN GIM v11 in version 20250304. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a GET request using the 'idmant' parameter in '/PC/frmEPIS.aspx'.

A Blind SQL injection vulnerability has been identified in QuickCMS. Improper neutralization of input provided by a high-privileged user into aFilesDelete allows for Blind SQL Injection attacks. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up to, and including, 1.4.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, and including, 3.11.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Version 3.11.13 raises the minimum user-level for exploitation to administrator. 3.11.14 fully patches the vulnerability.

The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL injection attacks

The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacks

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

Frappe is a full-stack web application framework. Prior to 15.86.0 and 14.99.2, a certain endpoint was vulnerable to error-based SQL injection due to lack of validation of parameters. Some information like version could be retrieved. This vulnerability is fixed in 15.86.0 and 14.99.2.

A blind SQL Injection (SQLi) vulnerability in mJobtime v15.7.2 allows unauthenticated attackers to execute arbitrary SQL statements via a crafted POST request to the /Default.aspx/update_profile_Server endpoint .

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the abs.php component. The application fails to properly sanitize usersupplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the cancel.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the search field, an attacker can bypass authentication and gain unauthorized access to the system.

A SQL injection vulnerability exists in the Blood Bank Management System 1.0 within the receiverLogin.php component. The application fails to properly sanitize user-supplied input in SQL queries, allowing an attacker to inject arbitrary SQL code. By manipulating the remail and rpassword fields, an attacker can bypass authentication and gain unauthorized access to the system.

We are tasked with analyzing CVE-2025-13811 and producing a JSON object with the specified fields. We must synthesize multiple intelligence sources. Here's the data we have: - CVE ID: CVE-2025-13811 - Description: Affects jsnjfz WebStack-Guns 1.0, file PageFactory.java, argument 'sort' leads to SQL injection. Remote attack possible, exploit publicly disclosed, vendor contacted but no response. - CVSS Score: 2.1 (but there is a CVSS v4.0 vector, note: CVSS v4.0 vector doesn't map to a 2.1 score; maybe it's a typo or they provided a vector with base score? CVSS v4.0 vector provided but with all base metrics set to X? Wait, the vector is: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That includes AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The base score for that would be: using CVSS 4.0 calculator, AV:N (network), AC:L (low attack complexity), AT:N (no attack requirements), PR:L (low privileges required), UI:N (no user interaction), VC:L (low impact on confidentiality), VI:L (low impact on integrity), VA:L (low impact on availability), SC:N, SI:N, SA:N. The base score would be 2.3? Actually, let's compute: Base Score = likelihood subscore + impact subscore. Likelihood subscore: [8.1 - (0.0+0.0+0.0+0.2+0.0)] = 7.9? I need to recall CVSS 4.0 formula. Simpler: use the fact that the given score is 2.1, but that might be the CVSS v2 or v3 score. Actually, they provided "CVSS Score: 2.1" but also a CVSS v4.0 vector. It might be that the CVSS v4.0 vector's base score is 2.3, but they approximated as 2.1? Either way, the vector indicates network attack vector with low privileges, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit maturity: P (proof-of-concept). So we'll use this for our assessment. - EPSS Score: 0.04% (percentile 12%) very low probability of exploitation. - POC/Exploit: Publicly available. Tags: SQLi, Java. - KEV: Not mentioned, so NO. - Patch: Not available, vendor unresponsive. - CPE: cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:* - References include GitHub POC, VulDB entries. We need to construct a JSON with the required fields. Each field is a string (paragraph). Let's go through each field: 1. "product_name": "1-3 words ONLY. The specific product or service name affected. Pick primary one: 'WebStack-Guns'" (since jsnjfz is the organization). "WebStack-Guns" is the product name. So product_name: "WebStack-Guns" 2. "summary": 2-3 sentence plain-language summary. Must not copy description. Start with impact verb and product. Exploitation conditions: it's an SQL injection in PageFactory.java 'sort' argument. The vector indicates low privileges required, network exploitation. Exploit available publicly. Vendor unresponsive. EPSS low. So summary: "SQL injection in WebStack-Guns 1.0 allows remote authenticated attackers to manipulate database queries via the 'sort' parameter in PageFactory.java. Exploit code is publicly available, but the vulnerability has low EPSS score and limited real-world impact due to low privilege requirements and low C/I/A impacts. Vendor has not responded to disclosure." 3. "technical_context": Explain technology/library/protocol involved. CWE-74 is improper neutralization of special elements in output used by a downstream component ('Injection'). Since it's Java and SQL injection, likely uses mybatis or JDBC where user input is not parameterized. File: PageFactory.java, constant factory. So we'll mention Java-based web application, likely uses MyBatis or JDBC, argument 'sort' inadvertently concatenated into SQL. Use CPE to identify exact affected product. State that the vulnerability is an SQL injection in the sort parameter of a page factory class. 4. "risk_assessment": CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base score about 2.3. EPSS 0.04% (12%), low probability. POC available, but not in KEV. Low impact on confidentiality, integrity, availability. So real risk is low. Also note that the attack requires low privileges, which limits exploitation to authenticated users. So the risk is low. Mention that the PR:L indicates that an attacker needs some authenticated access, so it's not remote unauthenticated. The vendor hasn't responded, so no patch. Contrast the CVSS severity (Low) with the low EPSS; all signals point to low priority. Include that. 5. "affected_products": List affected products: jsnjfz WebStack-Guns version 1.0. Use CPE string. There is a vendor advisory? VulDB links may serve as advisory. So write: "jsnjfz WebStack-Guns version 1.0 is affected (cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*). The vulnerability is documented in VulDB entry 333821 and a GitHub proof-of-concept report. No official vendor advisory is available." 6. "remediation": No patch available. Suggest compensating controls: Since SQL injection in sort parameter, input validation, use parameterized queries, or deploy a Web Application Firewall to block malicious sort inputs. Also consider restricting access to the affected endpoint if possible. As no fix version, say "No vendor-released patch is available. Mitigations include validating and sanitizing the 'sort' parameter to allow only expected values, using prepared statements, or deploying a WAF rule to block SQL injection attempts. Restrict access to the affected functionality to trusted users only." 7. "exploit_scenario": Attack scenario: Given PR:L, attacker needs authenticated access with low privileges. They send a crafted request to the endpoint that processes the sort parameter, injecting SQL, potentially reading or modifying database contents. Since VC/VI/VA are low, impact is minor. Mention POC available. So: "An authenticated attacker with low privileges sends a malicious HTTP request containing a crafted sort parameter. The injected SQL is executed, leading to potential low-level data leakage or modification." 8. "exploitation_conditions": From description, the unknown code in PageFactory.java and argument sort. The CVSS vector indicates PR:L, so exploitation requires low-level authentication. So conditions: attacker must be authenticated with low privileges and the application must use the unsanitized sort argument in SQL. No other special configuration noted. So: "Exploitation requires authentication as a low-privileged user on WebStack-Guns 1.0. The vulnerable 'sort' parameter must be processed by the PageFactory class without input sanitization." 9. "attack_chain": We need steps separated by arrows. Based on description: network access -> send crafted sort param -> SQL injection -> data manipulation/disclosure. Since PR:L, need to authenticate first. So: "Authenticate to application as low-privileged user → Identify vulnerable PageFactory endpoint → Send HTTP request with malicious sort parameter → SQL injection executes → Read or modify database records (low impact)." 10. "confidence_notes": Data completeness: exploit confirmed by public POC on GitHub, vendor contacted but no response, so no official patch. CVSS vector provided by VulDB, so confidence in the vector is high? But note the CVSS v4.0 vector is from VulDB, and NVD might not have analyzed it yet. The EPSS is from FIRST. So: "Exploit publicly available via GitHub POC. CVSS v4.0 base metrics and impact confirmed by VulDB. No vendor advisory or fix. The low impact ratings (VC:L, VI:L, VA:L) suggest limited severity despite the SQL injection nature." 11. "prevalence": One word. WebStack-Guns is a niche web stack management tool. Not widely known. Likely low adoption. So "low". 12. "prevalence_basis": Short justification: "Niche web management framework, limited adoption." So: "Niche web framework with limited enterprise deployment." 13. "assessed_cvss_vector": Our own independent CVSS 3.1 vector based on description and conditions. Let's map: AV:N (network attack), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U? The description says it's a manipulation of argument sort leading to SQL injection, no mention of scope change. So S:U. C:L/I:L/A:L? The CVSS v4.0 gave VC:L/VI:L/VA:L, so low impact. In CVSS 3.1, low means partial. So C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would be base score 6.3 (medium). But the v4.0 score was low. Actually, in CVSS 4.0 low impact scores lead to low base score because impact is much lower. So in 3.1, the low impacts still give a medium score. But the description might actually allow full database access? The description doesn't specify magnitude, but the v4.0 vector gave low impacts. We'll stick with that. So the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we need to justify: It's a SQL injection with network vector, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality, integrity, availability impact. So rationale: "Requires low privileges (PR:L) and network access; low impact assumed due to limited data exposure." 14. "assessed_cvss_rationale": one sentence. "Network-exploitable with low privileges; low impact assumed from description and similar CVSS scores." Or "SQL injection with low complexity, low privileges; limited to low data impact." So: "Low attack complexity and privileges; limited confidentiality, integrity, and availability impact based on vulnerability report." 15. "assessed_cvss40_vector": We'll use the provided v4.0 vector as base, but we must ensure it's consistent with our 3.1 assessment. The v4.0 vector provided actually has AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's the base vector. That's already the vector we'd use. So we can output that. But if we need to provide our own independent one, it's the same. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now, assemble the JSON. All fields strings, no arrays. Make sure not to copy description, original synthesis. Use the terms as per rules: exploitation conditions, confidence, etc. For prevalence, we said low, basis: "Niche web framework with limited enterprise deployment." Risk assessment: must contrast CVSS score (low base score in v4.0) with EPSS (low). The v4.0 score was 2.3, but v3.1 would be 6.3, but the provided score is 2.1 (likely they computed v4.0 base). So we'll mention that the CVSS v4.0 base score is low (2.3), indicating low severity, EPSS very low, no active exploitation, no KEV. So risk is low. Patch missing but impact limited. Remediation: note that vendor did not respond so no patch, suggest parameterized queries, WAF, restrict access. Also mention that since PR:L, only authenticated users can exploit, so limiting access further reduces risk. Attack chain: I'll structure as: "Authenticate as low-privileged user → Locate vulnerable endpoint → Send crafted HTTP request with malicious sort parameter → SQL injection modifies query logic

A vulnerability has been found in Chanjet CRM up to 20251106. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements.53.1. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in Hive Metastore Server (HMS) when processing delete column statistics requests via the Thrift APIs. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

SIGB PMB v8.0.1.14 was discovered to contain multiple SQL injection vulnerabilities in the /opac_css/ajax_selector.php component via the id and datas parameters. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A SQL injection vulnerability has been identified in bwdpi. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Bookme - Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injection via the `filter[status]` parameter in all versions up to, and including, 4.2. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 0.3.0 due to insufficient escaping on the user supplied. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attribute of the `products` shortcode in all versions up to, and including, 3.6.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.