SQL Injection

SQL injection in Campcodes Payroll Management System 1.0 exposes the application's database through the `/ajax.php?action=save_position` endpoint, where unsanitized input to the `ID` parameter is passed directly to backend SQL queries. Unauthenticated remote attackers can read, modify, or delete database records. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS probability remains very low at 0.05% (14th percentile), consistent with the niche footprint of the product.

SQL injection in itsourcecode Insurance Management System up to version 1.0 allows remote attackers to inject arbitrary SQL commands via the agent_id parameter in the /insertAgent.php endpoint. Publicly available exploit code exists, though EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed in CISA KEV. The vulnerability can lead to unauthorized database access and data manipulation.

SQL injection in LifeStyle Store 1.0 allows remote attackers to manipulate database queries via the ID parameter of /cart_add.php. The vulnerability has a publicly available exploit, but no active exploitation has been reported; EPSS predicts very low exploitation probability (0.05%).

SQL injection in Pharmacy Management System's quantity_upd.php allows low-privileged authenticated attackers to extract or modify limited data via unsanitized med_name, med_cat, or ex_date parameters. Public exploit code exists, but a low EPSS score and CVSS 4.0 base score of 2.1 indicate negligible real-world exploitation probability. No versioned patch is available due to the project's rolling release model.

SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /notapprove.php, potentially leading to unauthorized data access or modification. Exploit code is publicly available; no evidence of active exploitation but the low EPSS score suggests limited real-world impact.

Remote SQL injection in Jonnys Liquor 1.0 allows unauthenticated attackers to manipulate the drink parameter of the admin-area.php endpoint, potentially extracting or modifying database contents. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.05%).

SQL injection in code-projects Jonnys Liquor 1.0 allows remote attackers to manipulate database content via the ID parameter in /admin/delete-row.php. The exploit is publicly available and requires no authentication, enabling malicious database actions. No active exploitation has been confirmed, and EPSS indicates very low exploitation probability.

SQL injection in Jonnys Liquor 1.0 allows unauthenticated remote attackers to manipulate database queries via the Search parameter of /browse.php. Exploit code is publicly available; however, the impact is assessed as low (only partial data exposure or modification). No evidence of active exploitation has been identified.

SQL injection in itsourcecode Agri-Trading Online Shopping System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'supplier' parameter in /admin/suppliercontroller.php. Exploit code is publicly available, but no evidence of active exploitation. The vulnerability carries a CVSS 4.0 base score of 5.5 (Medium) with limited impact on confidentiality, integrity, and availability.

SQL injection in Code-projects Student Enrollment System 1.0 allows unauthenticated remote attackers to inject SQL via the Username parameter in login.php, potentially leading to data theft or authentication bypass. Publicly available exploit code exists, but no active exploitation has been confirmed by CISA KEV. The EPSS score is very low, suggesting limited real-world exploitation likelihood.

SQL injection in Chat System 1.0 allows remote attackers to manipulate database queries via the 'msg' parameter of /user/send_message.php. Publicly available exploit code exists, but no active exploitation has been confirmed. The application is a low-footprint, unsupported project, limiting real-world exposure.

SQL injection in code-projects Chat System 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter in /user/addmember.php. Public exploit code is available, but EPSS indicates low exploitation probability and no active exploitation has been confirmed.

SQL injection in Chat System 1.0 through the ID parameter of /user/fetch_member.php allows remote authenticated attackers with low privileges to extract or manipulate limited data from the application's database. Public exploit code is available, but no active exploitation has been reported and the EPSS probability is very low.

SQL injection in code-projects Chat System 1.0 allows authenticated remote attackers to manipulate backend database queries via the ID parameter of /user/fetch_chat.php. Public exploit code is available, and the vulnerability is rated critically by the reporter, but the CVSS 4.0 base impact is limited (low confidentiality, integrity, and availability) and EP

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.

SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to manipulate database queries via the ID parameter in /approve.php. The flaw permits low-impact unauthorized data access, modification, or service disruption. Public exploit code is available, but the software is a small demo project with minimal enterprise presence.

SQL injection in code-projects Library System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the Search parameter in /user/teacher/books.php. Exploit code is publicly available, but no active exploitation has been confirmed through CISA KEV, and EPSS scores indicate low weaponization likelihood.

SQL injection in Campcodes Sales and Inventory System 1.0 allows remote unauthenticated attackers to inject malicious SQL via the Customer parameter of /pages/customer_account.php, potentially leading to data exfiltration or modification. Public exploit code is available, but the EPSS score is low (0.06%) and there is no indication of active exploitation at this time.

SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database

SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request.

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiManager Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; FortiAnalyzer 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions; and FortiAnalyzer Cloud 7.4.1 through 7.4.6, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker with high privilege to extract database information via crafted requests.

SQL injection in code-projects Staff Audit System 1.0 allows unauthenticated remote attackers to manipulate login queries via the User parameter in /login.php, potentially leading to unauthorized data access or authentication bypass. A public exploit is available, but EPSS probability is low (0.06%), suggesting limited exploitation pressure. No CISA KEV listing exists.

SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-teacher.php, leading to unauthorized database access and potential data manipulation. A public exploit is available, though no active exploitation has been confirmed. The vulnerability carries a CVSS 4.0 base score of 5.5 and an extremely low EPSS probability (0.06%).

SQL injection in Food Distributor Site 1.0 allows remote attackers to manipulate the Username parameter on the admin login page to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates very low probability of exploitation (0.06%) and it is not listed in CISA KEV. An attacker could bypass authentication or extract sensitive data from the database.

SQL injection in PHPGurukul Car Washing Management System 1.0 allows an authenticated administrator to execute arbitrary SQL commands via the wpid parameter in /admin/editcar-washpoint.php. The vulnerability requires high privileges but can be exploited remotely, leading to low-impact data leakage, modification, or service disruption. Exploit code is publicly available, though EPSS scores remain low and no active exploitation has been reported by CISA.

SQL injection in PHPGurukul Hospital Management System 1.0 allows remote attackers to manipulate the viewid parameter in view-medhistory.php, leading to unauthorized database access. A public proof-of-concept exploit is available, though EPSS indicates a very low probability of widespread exploitation. No vendor patch has been confirmed at this time.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pagina.filter.categoria mensaje in /QuiterGatewayWeb/api/v1/sucesospagina.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the suceso.contenido mensaje in /QMSCliente/Sucesos.action.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo mensaje in /QISClient/api/v1/sucesospaginas.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo id_factura in /<Client>FacturaE/listado_facturas_ficha.jsp.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the campo parameter in/<Client>FacturaE/BusquedasFacturasSesion.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/DescargarFactura.

SQL injection vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to retrieve, create, update and delete databases through the id_concesion parameter in /<Client>FacturaE/VerFacturaPDF.

SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the idn parameter in teacher-issue-book.php, leading to unauthorized database access. An attacker can read, modify, or delete data, potentially compromising the entire application. Public exploit code is available, though active exploitation has not been confirmed.

A vulnerability has been identified in SINEC NMS (All versions < V4.0). The affected devices are vulnerable to SQL injection. This could allow an unauthenticated remote attacker to execute arbitrary SQL queries on the server database.

SQL injection in code-projects Library System 1.0 allows remote attackers to manipulate the Username parameter in /add-student.php, potentially leading to unauthorized database access or modification. Exploit code is publicly available, but CISA KEV does not list it as actively exploited, and EPSS suggests a low 0.06% probability of exploitation.

SQL injection in code-projects Crime Reporting System 1.0 allows remote attackers to inject arbitrary SQL via the email parameter of /headlogin.php. A public exploit exists but active exploitation is not confirmed; the EPSS probability is very low (0.07%). This vulnerability can lead to limited data exposure or manipulation.

SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries via the email parameter of /policelogin.php, potentially leading to authentication bypass and sensitive data exposure. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). EPSS indicates very low risk of widespread exploitation (0.06%, 19th percentile).

SQL injection in the registration form of Code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to manipulate database queries by injecting SQL into the Name parameter. The exploit is publicly available but not currently listed in CISA KEV, and EPSS probability of exploitation remains low (0.06%). Although the vulnerability is trivial to exploit, the intrinsic impact is limited, affecting only the local database with low confidentiality, integrity, and availability repercussions.

SQL injection in code-projects Crime Reporting System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'location' parameter of /complainer_page.php. A public exploit is available, though EPSS indicates extremely low likelihood of widespread exploitation and no active attacks are confirmed.

SQL injection in Crime Reporting System 1.0 allows remote unauthenticated attackers to manipulate database queries via the email parameter on the /userlogin.php page. The vulnerability has been publicly disclosed and exploit code is available, although the EPSS score is low (0.06%) and it is not listed in CISA's Known Exploited Vulnerabilities catalog.

SQL injection in Responsive Blog Site 1.0 allows remote attackers with low-level privileges to manipulate database queries via the 'ID' parameter in category.php, potentially leading to data leakage or modification. Public exploit code is available, though no active exploitation has been confirmed by CISA. The limited impact and low EPSS score (0.06%) reduce its real-world urgency.

SQL injection in code-projects Responsive Blog Site 1.0 allows authenticated remote attackers to manipulate the 'ID' parameter in /single.php to interfere with database queries, leading to data leakage or manipulation. A proof-of-concept exploit is publicly available, but no active exploitation has been reported (EPSS 0.06%).

SQL injection in the forgot-password.php script of PHPGurukul/Campcodes Cyber Cafe Management System 1.0 allows remote, unauthenticated attackers to manipulate the email parameter, leading to database compromise via arbitrary SQL queries. The exploit is publicly disclosed, and while EPSS indicates a low exploitation probability (0.07%), no active exploitation has been confirmed (not in CISA KEV).

SQL injection in Cyber Cafe Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter of /index.php to execute arbitrary SQL commands. A publicly available proof-of-concept exists, and the EPSS score of 0.07% suggests low exploitation probability at time of analysis. No evidence of active exploitation in the wild beyond public disclosure has been found.

SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate the 'cnum' parameter in /admin/add-animals.php, leading to unauthorized database access or data modification. Public exploit code exists but no active exploitation has been confirmed; EPSS score is low at 0.06%.

SQL injection in Zoo Management System 2.1 allows authenticated attackers to manipulate ticket pricing via the cprice parameter in /admin/add-foreigners-ticket.php, potentially altering data in the database. The exploit is publicly available and can be exploited over the network with low attack complexity, though no active exploitation has been confirmed by CISA KEV.

SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers to manipulate database queries via the cprice parameter in /admin/add-normal-ticket.php. This could lead to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported.

SQL injection in the admin login page of PHPGurukul Zoo Management System 2.1 allows remote unauthenticated attackers to extract or modify database contents via the Username parameter. Public exploit code is available, making exploitation straightforward despite the limited confidentiality, integrity, and availability impact. The EPSS score of 1.94% (83rd percentile) indicates a moderate likelihood of exploitation, though no active exploitation is confirmed.

SQL injection in PHPGurukul Zoo Management System 2.1 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the ID parameter in /admin/manage-animals.php. Exploit code is publicly available, though no active exploitation is confirmed and the CVSS 4.0 base score is low (2.1) due to limited impact.

SQL injection in PHPGurukul Zoo Management System 2.1's admin ticket management page (/admin/manage-normal-ticket.php) allows authenticated attackers with low privileges to manipulate the ID parameter, potentially leading to unauthorized data access or modification. Exploit code is publicly available, though no active exploitation has been reported.

SQL injection in Online Note Sharing 1.0 login page allows remote unauthenticated attackers to inject malicious SQL via username/password fields, potentially extracting or modifying database contents. A public proof-of-concept exploit exists, but EPSS indicates very low exploitation probability (0.06%).

SQL injection in hitsz-ids airda 0.0.3 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the 'question' parameter of the /v1/chat/completions endpoint. A public proof-of-concept is available, but exploitation probability is very low (EPSS 0.03%) and no active attacks have been reported. The vulnerability enables attackers to read or modify database contents with limited scope.

SQL injection in PHPGurukul Online Notes Sharing System 1.0 allows remote attackers to execute arbitrary SQL commands via the sessionid cookie when accessing the /Dashboard endpoint. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed by CISA KEV at this time. The vulnerability's impact is limited to low-confidentiality, low-integrity, and low-availability compromise of the database.

SQL injection in Campcodes Advanced Online Voting System 1.0 allows remote attackers to execute arbitrary SQL commands via the 'ID' parameter in /admin/voters_delete.php. The vulnerability requires low-privilege authentication and has a publicly available proof-of-concept. EPSS exploitation probability is very low (0.06%), and no active exploitation is reported.

SQL injection in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to manipulate the ID parameter in /admin/candidates_delete.php to execute arbitrary SQL commands. A public proof-of-concept exploit is available, but no active exploitation is confirmed and EPSS probability is only 0.06%.

SQL injection in CodeAstro Patient Record Management System 1.0 allows unauthenticated remote attackers to manipulate the login process via the 'uname' parameter in /login.php. Public exploit code is available, but no active exploitation has been reported, and EPSS score indicates low probability of exploitation (0.06%).

SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to inject malicious SQL via the adminname parameter in /panel/admin-profile.php, potentially leading to data leakage or tampering. Despite being publicly disclosed with proof-of-concept code, the actual impact is limited according to CVSS 4.0 (score 2.1), and EPSS predicts a low exploitation probability (0.06%).

SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to execute arbitrary SQL commands via the staff_id parameter in the /panel/s

SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to inject malicious SQL via the ID parameter in /admin/view_vacancy.php, potentially leading to low‑impact data leakage or modification. Public exploit code exists, but

WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.

WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.

SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate or extract database contents via the ID parameter in /admin/ajax.php?action=save_vacancy. Public exploit code is available, but the CVSS 4.0 score of 5.5 indicates only low impact to confidentiality, integrity, and availability. No active exploitation has been reported in CISA KEV, and EPSS probability is low (0.06%).

SQL injection in Campcodes Online Recruitment Management System 1.0 allows remote attackers to manipulate database records via the ID parameter in /admin/ajax.php?action=delete_application. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV; EPSS indicates a low 0.06% probability of widespread attacks.

employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint.

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to read or modify database contents via the ID parameter in /ajax.php?action=save_payroll. The vulnerability is rated critical and has publicly available exploit code, though no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.06%), suggesting low probability of widespread exploitation.

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to inject malicious SQL commands through the employee_id parameter when saving attendance records via /ajax.php?action=save_employee_attendance. Exploit code is publicly available, though EPSS exploitation probability is very low (0.06%). The vulnerability can lead to unauthorized modification of employee data and potential disclosure of database contents.

SQL injection in Campcodes Payroll Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in the delete_payroll Ajax endpoint. Public exploit code is available, though EPSS probability is low (0.06%) and no active exploitation in CISA KEV has been reported.

SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /ajax.php?action=delete_employee_attendance_single endpoint, potentially leading to data exposure or modification. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed.

Unauthenticated SQL injection in Campcodes Payroll Management System 1.0 allows remote attackers to manipulate backend database queries by supplying crafted input to the `ID` parameter of `/ajax.php?action=calculate_payroll`. The vulnerability stems from unsanitized user-controlled input being embedded directly into SQL statements, enabling data extraction or modification. A public proof-of-concept exploit has been disclosed via GitHub, though no active exploitation has been confirmed in CISA KEV.

SQL injection in itsourcecode Employee Management System 1.0 allows authenticated admins to manipulate database queries via the currentpassword parameter in /admin/changepassword.php. Despite classification as critical, the high privilege requirement (PR:H) and low EPSS score (0.06%) indicate limited real-world risk, though public exploit code exists.

SQL injection in itsourcecode Employee Management System 1.0 allows authenticated attackers with low privileges to inject SQL via the AdminName parameter in /admin/adminprofile.php. Public proof-of-concept exploit exists, but EPSS indicates low real-world exploitation probability (0.06%).

SQL injection in itsourcecode Employee Management System up to 1.0 allows authenticated administrators to execute arbitrary SQL queries via the coursepg parameter in /admin/editempeducation.php. A public proof-of-concept exploit exists, but CVSS v4.0 base score is 2.1 (low impact) and EPSS is 0.06%, indicating limited real-world risk. No evidence of active exploitation (not in CISA KEV) and no vendor patch is available.

SQL injection in Campcodes Complaint Management System 1.0 allows authenticated administrators to manipulate cid/uid parameters via /admin/complaint-details.php, enabling arbitrary SQL query execution that can read or modify database records. A public proof-of-concept exploit is available, but the vulnerability requires high privileges and has low exploitation probability (EPSS 0.06%), with no evidence of active attacks.

SQL injection in Complaint Management System 1.0 login form (/admin/index.php) allows remote unauthenticated attackers to execute arbitrary SQL commands. The flaw, located in the Username parameter, enables database manipulation, including data exfiltration or tampering. Public exploit code is available, though EPSS indicates low likelihood of widespread exploitation.

SQL injection in Campcodes Complaint Management System 1.0 allows authenticated remote attackers to manipulate the cid parameter in /users/complaint-details.php, potentially reading or modifying database data. A public proof-of-concept exploit is available, but the vulnerability requires low-privilege user authentication and the impact is limited, as reflected by the low CVSS 4.0 score of 2.1 and EPSS exploitation probability of 0.06%. No active exploitation has been reported via CISA KEV.

SQL injection in Campcodes Complaint Management System 1.0's email parameter in /users/check_availability.php allows remote unauthenticated attackers to manipulate database queries. Public exploit code is available, but there is no evidence of active exploitation and EPSS estimates a low exploitation

SQL injection in Campcodes Complaint Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the Username parameter of /users/index.php, potentially exposing or altering database contents. Exploit code is publicly available, though no active exploitation has been confirmed, and EPSS indicates a low (0.06%) probability of widespread use.

We are tasked with synthesizing a comprehensive analysis for CVE-2025-7102, using all provided data. The output must be a JSON object with specific fields, all plain text strings. We must cross-reference and analyze beyond paraphrasing. I'll go through each field and construct the content. First, review the input data: - CVE ID: CVE-2025-7102 - Description: BoyunCMS up to 1.4.20 has a vulnerability in file application/update/controller/Server.php, manipulation of argument phone leads to SQL injection. Remote attack possible. Exploit disclosed publicly. - CVSS Score: 2.1? But the vector is CVSS:4.0? The vector given: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X That's a CVSS 4.0 vector with low impact (VC:L/VI:L/VA:L), scope unchanged, PR:L (low privileges required), UI:N (no user interaction), AV:N (network). The CVSS score 2.1 is likely a typo or from CVSS 3.1? Actually the vector is 4.0 base metrics: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, which would score higher than 2.1. But we'll use the vector as provided? The vector is given, but the "CVSS Score: 2.1" might be an error. However, for our assessed vectors we'll do our own independent assessment. We'll later produce an assessed CVSS 3.1 and 4.0 vector based on analysis. - CWE: CWE-74, which is "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" – too broad, SQL injection is more specific. But we'll reference the CWE. - EPSS: 0.05%, percentile 14%. Low probability of exploitation. - KEV status: Not mentioned; likely NO (not in KEV). No KEV data in input. So we assume not actively exploited. - POC: "The exploit has been disclosed to the public and may be used." So publicly available exploit exists. - Tags: PHP, SQLi. - no patch info provided explicitly; patch availability is unknown. - Reported by cna@vuldb.com (VulDB). - CPE: cpe:2.3:a:boyuncms_project:boyuncms:*:*:*:*:*:*:*:* (asterisk indicates all versions). EUVD lists many BoyunCMS versions 1.4.0 to 1.4.20, so up to that. - References: note-hxlab.wetolink.com/share/sEjaSsXWRNz1 (likely POC/exploit), vuldb.com entries. No vendor advisory. Only NVD page via EUVD. So the product is BoyunCMS, a content management system. Not widely known, likely low prevalence. The vulnerability is SQL injection via the 'phone' parameter in application/update/controller/Server.php. The description says "manipulation of the argument phone leads to sql injection". So it's an injection in a parameter presumably used in an SQL query without proper sanitization. The attack can be initiated remotely, requires low privileges (PR:L from CVSS 4.0), no user interaction. So authenticated but low-privileged user could exploit it. Risk assessment: CVSS 4.0 vector indicates low impact (low on CIA) but CVSS score provided is 2.1 (which seems inconsistent). If we compute CVSS 4.0 base score manually: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L -> Base score around 4.3 maybe? But VC:L/VI:L/VA:L is low, so it's not critical despite being declared critical. The EPSS is very low (0.05%), POC exists but no active exploitation (KEV absent). So real-world risk is relatively low. However, SQL injection can sometimes lead to greater impact if chained, but as described it's low impact. We'll craft a summary, technical context, etc. Ensure not to copy description verbatim. Start summary with specific impact verb: "SQL injection in BoyunCMS". Then explain: what, who, what attacker can do, mention POC, no active exploitation, low EPSS. Technical context: BoyunCMS is a PHP-based CMS. The vulnerability is in the update controller, file Server.php, specifically the phone argument. Based on CWE-74 (injection), likely a parameter used in SQL query without parameterization. The input is handled unsafely, leading to SQL injection. The product CPE indicates all versions up to 1.4.20 affected. No known patch. Risk assessment: Compare signals. CVSS 4.0 vector shows network attack, low complexity, low privileges, low impact on CIA. EPSS extremely low. No KEV, so not actively exploited. POC exists, so threat actors could potentially use it. But impact is limited per CVSS (only low impacts). So real risk is moderate for systems where an authenticated low-privileged user could be malicious. But overall, it's a low severity vulnerability despite being declared critical by source. Affected products: BoyunCMS versions 1.4.0 through 1.4.20 (assuming all 1.4.x). EUVD lists many specific versions, but effectively all 1.4.x. Mention CPE. No vendor advisory links, just the NVD/EUVD page. So no official advisory. References include exploit notes. Remediation: No patch available. Workarounds: restrict access to the update endpoint, disable update controller if possible, or sanitize input via a WAF/mod_security rule. Recommend upgrading when fix available. But the source doesn't provide fix. So we say no vendor-released patch identified. Suggest monitoring VulDB for updates. Exploit scenario: An authenticated attacker with low privileges sends a crafted request to the update functionality, manipulating the phone parameter to inject SQL commands, potentially extracting or modifying data. Exploitation conditions: The attacker must have low-privileged access (as per PR:L). The vulnerable endpoint is the update controller's server.php, specifically the phone argument. The attack is remote over network. So likely requires that the update feature is enabled and accessible. Since it's BoyunCMS, likely admin area? Update functionality may be restricted. So it's not default anonymous access, needs authentication. So condition: authenticated user with low privileges can access the update functionality in BoyunCMS. Attack chain: Access update controller with low-privilege credentials → Craft SQL injection payload in 'phone' parameter → Send request to update endpoint → Malicious SQL queries executed → Low-impact data disclosure/manipulation. Confidence notes: Confirm that exploit is publically disclosed (via note-hxlab link). No vendor fix confirmed. Vulnerable version range from EUVD (up to 1.4.20). EPSS score low. CVSS vector from VulDB. No KEV listing. No vendor advisory found, so patch status unconfirmed. Prevalence: BoyunCMS is an obscure CMS, likely Chinese? Very niche. So prevalence = rare or low. I'll put "rare". Basis: "niche Chinese CMS, minimal enterprise footprint". Assessed CVSS vector: Our independent assessment. The provided CVSS 4.0 gives AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L. For CVSS 3.1 mapping, we need to assess AV:N (because remote), AC:L (no special conditions beyond authentication), PR:L (low privileges), UI:N, scope unchanged? The injection likely affects same component, no scope change. For impact: VC:L (low confidentiality), VI:L (low integrity), VA:L (low availability). So we'd produce CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we must consider if confidentiality, integrity, availability are all low? The description doesn't specify, but the 4.0 vector gave those. So we'll use same. Rationale: "Low-privileged user can inject SQL via phone parameter; no user interaction, network vector." But we could argue AC might be low because SQL injection might be trivial. So that's fine. CVSS 4.0 vector: The same as given, but we'll output based on our assessment: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. No temporal/environmental modifiers. That's consistent. Now construct the JSON. Fields: product_name: "BoyunCMS" summary: "SQL injection in BoyunCMS up to version 1.4.20 allows authenticated low-privileged attackers to manipulate the 'phone' argument in the update controller, leading to potential unauthorized data access or modification. Exploit code is publicly available, but no evidence of active exploitation in the wild. EPSS probability is very low (0.05%), and impact is limited per CVSS scoring, though the vulnerability is labeled critical by the reporter." (ensure starts with impact verb: "SQL injection in BoyunCMS...") technical_context: "BoyunCMS is a PHP-based content management system. The vulnerability resides in the update module at application/update/controller/Server.php, where user-supplied input for the 'phone' parameter is directly incorporated into an SQL query without proper sanitization, as indicated by CWE-74 (Injection). The affected product (cpe:2.3:a:boyuncms_project:boyuncms) includes all versions up to 1.4.20, as confirmed by EUVD enumeration. This typical SQL injection flaw can be exploited by injecting malicious SQL statements through the input field, enabling database query manipulation." risk_assessment: "The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) indicates a network-accessible flaw requiring low privileges and no user interaction, with only low impact on confidentiality, integrity, and availability. The EPSS score of 0.05% (14th percentile) suggests very low likelihood of exploitation. Despite being tagged critical by the reporter, the actual CVSS base score computed from the 4.0 vector is moderate, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV). Public exploit code exists, but there is no evidence of active exploitation. This combination of signals suggests that while the flaw is real and exploitable, it poses limited immediate risk, especially given its low impact and the need for authenticated access. Defenders should prioritize based on exposure of the CMS's update functionality to low-privileged users." affected_products: "BoyunCMS versions 1.4.0 to 1.4.20 are affected, as detailed by EUVD (e.g., 1.4.0, 1.4.13, 1.4.20, etc.). The CPE designation cpe:2.3:a:boyuncms_project:boyuncms:* confirms all versions prior to a fix are vulnerable. No official vendor advisory has been published; the primary reference is the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-7102 and VulDB at https://vuldb.com/?id.315016." remediation: "No vendor-released patch is currently available. As a temporary mitigation, restrict access to the update endpoint (Server.php) to trusted users only, or disable the update module if not needed. Apply strict input validation for the 'phone' parameter using a web application firewall (WAF) rule to block SQL injection patterns. Monitor the VulDB entry (https://vuldb.com/?id.315016) for a fix and upgrade promptly once a patched version is released. Note that disabling the update feature may break update functionality, so weigh operational needs." exploit_scenario: "A low-privileged authenticated attacker crafts a request to the BoyunCMS update endpoint containing a SQL injection payload in the 'phone' parameter. Successful exploitation could allow extraction of database contents or modification of data within the CMS database, depending on the injected query." exploitation_conditions: "Exploitation requires network access to the BoyunCMS instance and authentication with low privileges (as indicated by CVSS PR:L). The vulnerable endpoint is application/update/controller/Server.php, which must be exposed and accessible. No special configuration beyond the default CMS deployment is needed, but the attacker must have valid credentials with sufficient permission to use the update feature. The attack does not require user interaction."

Unauthenticated SQL injection in the designthemes LMS WordPress theme through version 9.1 allows remote attackers to extract arbitrary data from the database, potentially exposing sensitive user information or causing limited availability impact via scope change. Exploitation requires no user interaction or privileges, but EPSS score of 0.04% indicates low likelihood of future exploitation, and no active exploitation has been confirmed.

Unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin up to version 3.4.1 allows remote attackers to execute arbitrary SQL commands, primarily compromising database confidentiality. While rated Critical (CVSS 9.3) with a network attack vector, the EPSS probability of exploitation is only 0.04%, and no public exploits or active exploitation have been reported.

Unauthenticated SQL injection in the WordPress plugin Video List Manager through version 1.7 allows remote attackers to execute arbitrary SQL commands on the backing database, leading to exposure of sensitive data and potential partial denial of service. No authentication or user interaction is required, and the attack vector is network-accessible, but the EPSS exploitation probability is very low (0.04%), and no active exploitation or public exploit code is known at this time.

Blind SQL injection in bSecure – Your Universal Checkout WordPress plugin allows unauthenticated remote attackers to exfiltrate sensitive database contents, including user credentials and order data, via crafted HTTP requests to the checkout endpoint. The vulnerability affects all plugin versions up to 1.7.9 and requires no user interaction or special privileges. While no active exploitation or public exploit is currently known (EPSS 0.04%, not listed in CISA KEV), the CVSS 9.3 critical score reflects the high ease of exploitation and severe confidentiality impact across a changed scope, making patching a high priority.

Unauthenticated SQL injection in the Cozmoslabs Paid Member Subscriptions WordPress plugin up to version 2.15.1 allows remote attackers with no privileges to execute arbitrary SQL commands via a specially crafted request. Successful exploitation can expose highly sensitive data from the database, with a low but possible impact on availability. The vulnerability carries a CVSS base score of 7.5 (High), an EPSS score of 0.03% indicating very low exploitation likelihood, and no known public exploit or active attacks at the time of analysis.

Authenticated SQL injection in the Simple Link Directory WordPress plugin up to version 14.7.3 allows low-privileged users to exfiltrate sensitive database contents. No public exploit or active exploitation has been confirmed, and the EPSS score of 0.04% indicates a very low likelihood of real-world attacks despite a CVSS 8.5 rating.

SQL injection in the Click & Pledge Connect WordPress plugin allows unauthenticated attackers to escalate privileges and potentially compromise affected sites. The vulnerability exists in versions 25.04010101 through WP6.8 and carries a critical CVSS score due to its full technical impact and easy exploitability, though no public exploit or active exploitation has been observed.

SQL injection in the Printcart Web to Print Product Designer for WooCommerce plugin (versions up to 2.4.0) enables authenticated attackers with low privileges to execute arbitrary SQL commands, potentially exposing sensitive database contents. Exploitation requires no user interaction and carries high confidentiality impact, though no active exploitation (CISA KEV) or public exploit code is known at this time. The low attack complexity and network attack vector make this a serious risk for WooCommerce stores using the vulnerable plugin.

SQL injection in the gopiplus Pixelating image slideshow gallery WordPress plugin (versions ≤ 8.0) allows authenticated attackers with low privileges to execute arbitrary SQL queries, enabling unauthorized extraction of sensitive database information and potential disruption via costly queries. No public

Authenticated SQL injection in iFrame Images Gallery plugin up to version 9.0 allows any user with subscriber-level access to extract sensitive information from the WordPress database, including password hashes. No public exploit or active exploitation has been confirmed, and the EPSS score is extremely low (0.04%), indicating minimal real-world exploitation activity at this time.

Blind SQL injection in the Cool fade popup WordPress plugin allows authenticated low-privilege attackers to extract sensitive data from the database. The vulnerability affects all versions up to 10.1. Exploitation requires only subscriber-level access and no user interaction, making it easily exploitable once authenticated, though EPSS score is low (0.04%) and no public exploit or active exploitation is known.