Description Summary:
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fh parameter, allowing unauthenticated attackers to inject malicious scripts into the admin dashboard.

Executive Summary:
A critical Stored Cross-Site Scripting vulnerability in the SlimStat Analytics plugin for WordPress allows unauthenticated attackers to execute arbitrary web scripts within the administrative interface.

Vulnerability Details

CVE-ID: CVE-2025-15057

Affected Software: Veronalabs SlimStat Analytics

Affected Versions: 0 through 5.3.3

Vulnerability: This vulnerability occurs due to insufficient input sanitization and output escaping of the fingerprint parameter. An unauthenticated attacker can inject malicious JavaScript that executes when an administrator views the Real-time Access Log report.

Business Impact

The ability to execute arbitrary scripts in the context of an administrator session poses a significant risk to organizational integrity. Successful exploitation could lead to account takeover, unauthorized administrative actions, or the theft of sensitive session data, justifying the high CVSS score of 7.2.

Remediation Plan

Immediate Action: Update the SlimStat Analytics plugin to version 5.3.4 or higher immediately to resolve the input sanitization flaw.

Proactive Monitoring: Review administrative access logs for suspicious activity or unauthorized script execution patterns within the WordPress dashboard.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection attempts targeting the fh parameter until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high privilege context in which the payload executes.

Analyst Recommendation

Given the potential for unauthorized administrative access, organizations utilizing the SlimStat Analytics plugin must prioritize this update. Failure to remediate this vulnerability leaves the WordPress management interface exposed to malicious script injection, which could facilitate broader compromise of the application environment.

Description Summary:
The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters, allowing unauthenticated script injection.

Executive Summary:
The SlimStat Analytics plugin for WordPress is susceptible to Stored Cross-Site Scripting, which allows unauthenticated attackers to execute arbitrary scripts within the administrative dashboard.

Vulnerability Details

CVE-ID: CVE-2025-15055

Affected Software: veronalabs SlimStat Analytics

Affected Versions: 0 through 5.3.4

Vulnerability: This vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw caused by insufficient input sanitization and output escaping within the 'notes' and 'resource' parameters. The attack vector is network-based and requires no authentication, allowing malicious scripts to execute when an administrator views the Recent Custom Events report.

Business Impact

The exploitation of this vulnerability could lead to unauthorized actions performed on behalf of an administrator, potentially resulting in full site compromise or data theft. Given the CVSS score of 7.2, this is classified as a High severity issue, as it allows unauthenticated attackers to manipulate the administrative session and access sensitive reporting data.

Remediation Plan

Immediate Action: Update the SlimStat Analytics plugin to the latest version, which includes the necessary input sanitization fixes. If an update is not immediately available, disable or remove the plugin until a secure version is deployed.

Proactive Monitoring: Review administrative audit logs for any unexpected changes to site settings or unusual activity originating from the Recent Custom Events report area.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious script injection patterns in HTTP requests targeting the affected plugin parameters.

Exploitation Status

Public Exploit Available: No confirmed public exploit (Metasploit or ExploitDB) is currently available for this vulnerability.

Analyst Notes: As of January 10, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the high-privilege context in which the malicious scripts execute.

Analyst Recommendation

This vulnerability presents a significant risk to WordPress installations due to the ease of exploitation by unauthenticated actors. Administrators should prioritize updating the SlimStat Analytics plugin immediately to ensure that input sanitization is correctly implemented, thereby preventing potential administrative account takeover or unauthorized data access.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 router firmware allows remote, unauthenticated attackers to execute arbitrary code via a crafted Username parameter in the PPTPDClient HTTP handler.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 firmware version 1.0.0.18 poses a severe risk of remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-15047

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the HTTP request handler for the /goform/PPTPDClient endpoint. An unauthenticated attacker can trigger the flaw by sending a specially crafted HTTP request containing an oversized username parameter, leading to memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected router, which may result in complete compromise of network traffic, unauthorized access to internal resources, and significant data loss. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or authentication to achieve remote code execution.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch for this vulnerability. Users are advised to restrict access to the management interface to trusted networks only and disable remote management features immediately.

Proactive Monitoring: Monitor network traffic for unusual HTTP GET requests targeting the /goform/PPTPDClient endpoint, particularly those containing abnormally long strings in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter and block malicious HTTP requests that attempt to exploit buffer overflow conditions in the router management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided by the security researcher on GitHub.

Analyst Notes: As of December 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional reproduction script significantly lowers the barrier for attackers to weaponize this flaw.

Analyst Recommendation

Given the critical nature of this vulnerability and the public availability of exploit code, organizations utilizing Tenda WH450 routers must prioritize mitigation. Because no vendor patch is currently available, it is essential to isolate these devices from external access to prevent remote exploitation. Monitor vendor communication channels closely for firmware updates and apply them immediately upon release.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 router firmware allows remote attackers to trigger memory corruption and potential code execution via the netmsk parameter in /goform/PPTPClient.

Executive Summary:
The Tenda WH450 router is vulnerable to a critical stack-based buffer overflow that could allow an unauthenticated remote attacker to execute arbitrary code or crash the system.

Vulnerability Details

CVE-ID: CVE-2025-15046

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the HTTP request handler for the /goform/PPTPClient endpoint. An unauthenticated attacker can trigger the flaw by sending a crafted HTTP request containing an excessively long netmsk parameter.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure. Because the flaw allows for remote code execution, an attacker could gain full control over the affected networking hardware, leading to complete compromise of network traffic, unauthorized internal access, or persistent denial of service. The high CVSS score of 9.8 reflects the ease of remote exploitation and the catastrophic potential for system-wide impact.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Administrators should immediately restrict access to the management interface of affected Tenda WH450 routers to trusted internal networks only.

Proactive Monitoring: Monitor network traffic for unusual HTTP GET requests directed at the /goform/PPTPClient endpoint, especially those containing abnormally long parameter strings.

Compensating Controls: Implement a Web Application Firewall or similar inspection tool to filter and drop requests containing malformed or oversized input parameters sent to router management endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced by the CVE record.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of functional exploit code, which demonstrates how to overflow the 20-byte buffer, significantly lowers the barrier for attackers to weaponize this vulnerability.

Analyst Recommendation

Given the critical nature of this buffer overflow and the availability of public proof-of-concept code, immediate action is required to isolate vulnerable devices. Since a manufacturer patch is not currently listed, network segmentation and the strict enforcement of access control lists are the most effective measures to prevent unauthorized remote exploitation.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 /goform/Natlimit endpoint allows remote unauthenticated attackers to achieve arbitrary code execution via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote, unauthenticated attackers to execute arbitrary code and fully compromise the device.

Vulnerability Details

CVE-ID: CVE-2025-15045

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the HTTP request handler for the /goform/Natlimit endpoint. An unauthenticated attacker can trigger this flaw by sending a specially crafted HTTP request containing an excessively long value in the page parameter, leading to memory corruption and potential code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure. Because the flaw allows for remote code execution without authentication, an attacker can gain full control over the affected router, intercept network traffic, or use the device as a pivot point for further lateral movement within the internal network. Given the CVSS score of 9.8, this vulnerability is classified as critical, necessitating immediate attention to prevent unauthorized access and potential data breaches.

Remediation Plan

Immediate Action: There is currently no official vendor patch available for this firmware version. Organizations should immediately restrict access to the web management interface, ensure it is not exposed to the public internet, and isolate affected devices from sensitive network segments.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP requests targeting the /goform/Natlimit URI and review system logs for signs of unexpected process crashes or unauthorized service reboots.

Compensating Controls: Implement a Web Application Firewall (WAF) or an intrusion prevention system (IPS) to filter and block requests containing oversized payloads in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the security researcher.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the simple mechanism required to trigger the overflow.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of a public proof-of-concept, users must prioritize the isolation of Tenda WH450 devices. Ensure that administrative interfaces are strictly protected behind a VPN or internal firewall and not reachable from the internet. Monitor vendor communication channels closely for the release of an official firmware update and apply it immediately upon availability.

Description Summary:
A stack-based buffer overflow vulnerability in the Tenda WH450 router's NatStaticSetting endpoint allows remote attackers to execute arbitrary code via a crafted page parameter.

Executive Summary:
A critical stack-based buffer overflow in Tenda WH450 firmware version 1.0.0.18 poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-15044

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: This vulnerability is a stack-based buffer overflow located in the HTTP request handler for the /goform/NatStaticSetting endpoint. An attacker can trigger the overflow by sending a specially crafted request with an excessively long value in the page parameter, potentially leading to arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain full control over the affected router. This could lead to complete system compromise, interception of network traffic, or the use of the device as a pivot point for further lateral movement within the internal network. Given the CVSS score of 9.8, this vulnerability represents a critical threat to organizational security and infrastructure integrity.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor; users should restrict access to the device management interface to trusted internal networks only. If possible, isolate the affected router from the public internet immediately.

Proactive Monitoring: Security teams should monitor firewall and web access logs for requests directed at the /goform/NatStaticSetting endpoint containing unusually long string values in the page parameter.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System (IPS) rule to inspect and block HTTP requests to the /goform/NatStaticSetting endpoint that contain excessive data lengths in the page parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository by the vulnerability researcher.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements for the vulnerable endpoint.

Analyst Recommendation

Due to the critical severity and the availability of functional exploit code, organizations must prioritize the isolation of vulnerable Tenda WH450 devices. Administrators should ensure these devices are not exposed to the internet and monitor vendor channels closely for the release of a firmware update. Failure to mitigate this risk could result in total device compromise.

Description Summary:
A path traversal vulnerability in MLflow's archive extraction function allows attackers to overwrite arbitrary files and escape sandboxed directories via malicious tar archives.

Executive Summary:
MLflow versions prior to v3.7.0 are vulnerable to a critical path traversal flaw that enables attackers to overwrite system files and potentially escape sandbox environments.

Vulnerability Details

CVE-ID: CVE-2025-15036

Affected Software: MLflow

Affected Versions: Versions before v3.7.0

Vulnerability: The vulnerability resides in the extract_archive_to_dir function within the artifact cache component, which fails to validate member paths during tar extraction. An attacker who can upload or provide a specially crafted tar.gz file can use directory traversal sequences (e.g., ../) to write files outside the intended directory.

Business Impact

Successful exploitation can lead to arbitrary file overwrites, which may result in privilege escalation, system instability, or full sandbox escape in multi-tenant environments. The CVSS score of 9.6 highlights the critical nature of this vulnerability and the high risk of unauthorized data access and system compromise.

Remediation Plan

Immediate Action: Upgrade MLflow to version v3.7.0 or higher to implement proper path validation during archive extraction.

Proactive Monitoring: Scan the file system for unexpected files created outside of the MLflow artifact directories and monitor for suspicious file write operations.

Compensating Controls: Use containerization with restricted file system permissions (read-only where possible) to limit the impact of a successful path traversal attack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is a classic path traversal issue, which is frequently targeted by attackers in shared or multi-tenant cloud environments.

Analyst Recommendation

The ability to overwrite arbitrary files poses a significant risk to the integrity of the MLflow platform. It is strongly recommended that all users update to version v3.7.0 immediately to mitigate the risk of sandbox escapes and unauthorized system modification.

Description Summary:
A SQL injection vulnerability in the Student Management System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the id parameter in record.php.

Executive Summary:
The itsourcecode Student Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated attackers to potentially compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-15034

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability located in the record.php file. An unauthenticated attacker can supply malicious input via the GET parameter id to manipulate backend database queries.

Business Impact

Successful exploitation of this flaw can lead to unauthorized access to sensitive student data, potential data exfiltration, or complete database tampering. Given the CVSS score of 7.3, this represents a high-risk security gap that could result in significant reputational damage and the loss of data integrity for educational institutions relying on this software.

Remediation Plan

Immediate Action: As there is no official vendor patch available, administrators should restrict network access to the application or take the service offline until the vulnerable code in record.php can be manually remediated by implementing prepared statements and parameter binding.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting record.php, specifically searching for SQL syntax characters such as single quotes, sleep functions, or union keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in URL parameters to provide a virtual patch until a formal code update is applied.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to the confidentiality and integrity of the affected systems. Administrators must prioritize the implementation of input validation and parameterized queries to neutralize this threat. If the software cannot be secured through code modification, consider replacing the application with a more secure alternative.

Description Summary:
A UI spoofing vulnerability in the Dia browser on macOS allows attackers to misrepresent the current site by failing to display the about:blank indicator in custom-sized windows.

Executive Summary:
The Dia browser on macOS contains a UI redressing flaw that could allow an attacker to spoof a trusted domain and mislead users regarding the current web page.

Vulnerability Details

CVE-ID: CVE-2025-15032

Affected Software: The Browser Company of New York Dia

Affected Versions: 0 up to 1.9.0

Vulnerability: This vulnerability is classified as an improper restriction of rendered UI layers (CWE-1021), where the browser fails to correctly indicate the origin of a window. The attack requires no authentication but relies on user interaction to facilitate the spoofing of a legitimate domain.

Business Impact

This vulnerability carries a CVSS score of 7.4, indicating high severity due to the potential for significant impact on user trust and data integrity. By spoofing a trusted domain, an attacker could conduct sophisticated phishing campaigns or credential harvesting, leading to potential account compromise and reputational damage for the organization if users are tricked into interacting with malicious content.

Remediation Plan

Immediate Action: Upgrade the Dia browser to version 1.9.0 or later to ensure the about:blank indicator is correctly implemented.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual browser activity or reports from users regarding suspicious pop-up windows.

Compensating Controls: Deploy browser-based security policies that restrict the ability of untrusted sites to spawn custom-sized windows or execute scripts that manipulate window titles.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is primarily an interface-level concern that leverages the browser's failure to maintain context during window rendering.

Analyst Recommendation

Given the potential for high-impact social engineering attacks, organizations should prioritize the update to version 1.9.0 across all macOS workstations running Dia. Failing to patch this vulnerability leaves users susceptible to domain spoofing, which can easily bypass traditional security awareness training by presenting a deceptive but seemingly legitimate interface.

Description Summary:
MLflow is vulnerable to arbitrary file writes via path traversal in the pyfunc extraction process, potentially leading to remote code execution.

Executive Summary:
A critical path traversal vulnerability in MLflow allows unauthenticated attackers to perform arbitrary file writes, posing a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-15031

Affected Software: MLflow

Affected Versions: Unspecified through latest (prior to 3.9.0rc0)

Vulnerability: The flaw exists in the pyfunc extraction process due to improper handling of tar archive entries. By using tarfile.extractall without path validation, an unauthenticated attacker can supply crafted tar.gz files containing directory traversal sequences to overwrite files outside the intended directory.

Business Impact

Successful exploitation of this vulnerability allows an attacker to overwrite critical system files, which can be leveraged to achieve remote code execution. Given the CVSS score of 8.1, this represents a high-severity risk, particularly in multi-tenant environments or systems that ingest untrusted artifacts. Unauthorized access to the underlying host could lead to total compromise of the application environment and sensitive data theft.

Remediation Plan

Immediate Action: Update the MLflow package to version 3.9.0rc0 or later to implement proper path validation for tar archive extraction.

Proactive Monitoring: Monitor application logs for unusual file system write operations or unexpected attempts to access directories outside of designated artifact storage locations.

Compensating Controls: Implement strict input validation for all uploaded artifacts and ensure the application runs with the minimum necessary privileges to limit the impact of a potential file system overwrite.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit or weaponized module; per CISA's SSVC assessment, a proof-of-concept exists).

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The reliance on unsafe archive extraction methods makes this a significant vector for attackers targeting automated machine learning pipelines.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for remote code execution, necessitates immediate attention. Organizations utilizing MLflow to process external artifacts must prioritize upgrading to the patched version. Until updates are applied, restrict artifact ingestion to trusted sources only to mitigate the risk of exploitation.

Description Summary:
The User Profile Builder WordPress plugin prior to version 3.15.2 contains a flawed password reset process that allows unauthenticated attackers to reset the passwords of arbitrary user accounts.

Executive Summary:
A critical vulnerability in the User Profile Builder WordPress plugin allows unauthenticated attackers to hijack administrative accounts by exploiting a broken password reset mechanism.

Vulnerability Details

CVE-ID: CVE-2025-15030

Affected Software: User Profile Builder WordPress plugin

Affected Versions: 1.1.27 up to (excluding) 3.15.2

Vulnerability: The plugin fails to implement proper validation during the password reset flow, allowing an unauthenticated attacker to supply a target username and reset its password. This Improper Privilege Management vulnerability (CWE-269) grants attackers full access to the compromised account, including those with administrative privileges.

Business Impact

The ability for an unauthenticated user to reset any password poses a catastrophic risk to organizational security. Successful exploitation leads to full account takeover, potentially resulting in unauthorized data access, malicious content injection, or complete site compromise. Given the CVSS score of 9.8, this flaw represents a critical threat to business continuity and data integrity.

Remediation Plan

Immediate Action: Update the User Profile Builder WordPress plugin to version 3.15.2 or later immediately to resolve the flawed password reset logic.

Proactive Monitoring: Review web server access logs for anomalous, high-frequency requests targeting password reset endpoints or unexpected account modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns directed at user profile and authentication endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository at https://github.com/Nxploited/CVE-2025-15030.

Analyst Notes: As of February 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication, making it a prime target for automated exploitation tools.

Analyst Recommendation

This vulnerability carries a maximum severity rating and requires immediate attention to prevent unauthorized administrative access. Administrators must prioritize updating the User Profile Builder plugin across all instances. Failure to patch allows attackers to bypass standard authentication, rendering existing user security controls ineffective.

Description Summary:
An SQL injection vulnerability in the Centreon Infra Monitoring Awie export modules allows unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in Centreon Infra Monitoring poses a critical risk of full database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-15029

Affected Software: Centreon Infra Monitoring

Affected Versions: 25.10.0 up to 25.10.2, 24.10.0 up to 24.10.3, 24.04.0 up to 24.04.3

Vulnerability: This vulnerability is an SQL injection (CWE-89) located within the Awie export modules, which fails to properly neutralize special elements in SQL commands, allowing unauthenticated remote attackers to interact directly with the backend database.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical severity and the ease with which it can be exploited by remote, unauthenticated actors. Successful exploitation grants attackers the ability to read, modify, or delete sensitive monitoring data, potentially leading to a total loss of confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Update Centreon Infra Monitoring to the latest patched versions (25.10.2, 24.10.3, or 24.04.3) as specified in the official vendor security bulletin.

Proactive Monitoring: Review web server and database access logs for suspicious query patterns, such as unexpected SQL syntax or unauthorized access attempts targeting the Awie export modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the unauthenticated nature of the attack vector and the critical impact, the risk of exploitation is high.

Analyst Recommendation

Organizations utilizing Centreon Infra Monitoring must prioritize applying the provided patches immediately. Because this vulnerability allows for unauthenticated remote code execution or full database manipulation, failure to patch leaves the internal monitoring infrastructure exposed to trivial exploitation by external attackers.

Description Summary:
The JAY Login & Register plugin for WordPress allows unauthenticated privilege escalation to administrator by exploiting the 'jay_login_register_ajax_create_final_user' function.

Executive Summary:
Unauthenticated attackers can gain full administrative control over WordPress sites by exploiting a critical privilege escalation vulnerability in the JAY Login & Register plugin.

Vulnerability Details

CVE-ID: CVE-2025-15027

Affected Software: JAY Login & Register (WordPress Plugin)

Affected Versions: Versions up to and including 2.6.03

Vulnerability: This vulnerability exists because the plugin fails to restrict updates to arbitrary user meta within the 'jay_login_register_ajax_create_final_user' function. This flaw allows an unauthenticated attacker to modify their account metadata to grant themselves administrative privileges.

Business Impact

A successful exploit results in a total compromise of the WordPress environment, allowing attackers to access sensitive customer data, modify site content, or deploy malware. The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no authentication and leads to complete loss of confidentiality, integrity, and availability. Failure to remediate could lead to significant legal liability and reputational damage.

Remediation Plan

Immediate Action: Update the JAY Login & Register plugin to the latest patched version immediately. If a patch is unavailable, deactivate and remove the plugin to prevent exploitation.

Proactive Monitoring: Review WordPress user tables for any unauthorized administrator accounts and inspect access logs for unusual requests directed at the 'jay_login_register_ajax_create_final_user' AJAX action.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically designed to block unauthorized metadata update requests and restrict access to WordPress AJAX endpoints where possible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease with which administrative access can be gained, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated; unauthenticated privilege escalation is a "worst-case" scenario for web applications. IT administrators must prioritize the update of this plugin across all managed WordPress instances. Immediate patching is the only effective way to mitigate the risk of full site takeover.

Description Summary:
A missing authentication vulnerability in the Centreon Infra Monitoring Awie import module allows unauthenticated attackers to access functionality without proper ACL enforcement.

Executive Summary:
A critical authentication bypass vulnerability in the Centreon Infra Monitoring Awie import module allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-15026

Affected Software: Centreon Infra Monitoring

Affected Versions: 25.10.0 up to 25.10.2, 24.10.0 up to 24.10.3, 24.04.0 up to 24.04.3

Vulnerability: The vulnerability is a missing authentication for critical function (CWE-306) within the Awie import module. This flaw allows an unauthenticated, remote attacker to interact with sensitive import features that should be restricted by access control lists.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to organizational infrastructure. Successful exploitation allows an attacker to bypass security controls, potentially leading to unauthorized data access, modification of monitoring configurations, or full system takeover. Such an incident would likely result in severe operational disruption and potential compromise of the wider network managed by the monitoring platform.

Remediation Plan

Immediate Action: Upgrade Centreon Infra Monitoring to versions 25.10.2, 24.10.3, 24.04.3, or later to apply the necessary authentication checks.

Proactive Monitoring: Review web server and application access logs for unusual traffic targeting the Awie import module endpoints or unauthorized administrative actions.

Compensating Controls: Implement strict network segmentation or Web Application Firewall (WAF) rules to restrict access to the Centreon management interface to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Given the high CVSS score and the nature of the flaw, however, the lack of authentication makes this a highly attractive target for automated exploitation.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of required authentication for exploitation, necessitates immediate patching. Organizations should prioritize updating their Centreon Infra Monitoring deployments to the fixed versions identified above to eliminate the risk of remote unauthorized access.

Description Summary:
An authorization bypass vulnerability exists in the Yordam Library Automation System due to a user-controlled key, allowing potential unauthorized access.

Executive Summary:
A critical authorization bypass vulnerability in the Yordam Library Automation System could allow unauthenticated attackers to gain unauthorized access to sensitive system functions.

Vulnerability Details

CVE-ID: CVE-2025-15025

Affected Software: Yordam Information Library Automation System

Affected Versions: v.21.6 up to (excluding) v.22.1

Vulnerability: The application suffers from an authorization bypass (CWE-639) where user-controlled keys are not properly validated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that this flaw can be exploited remotely by an unauthenticated attacker, requiring only user interaction.

Business Impact

Successful exploitation allows an attacker to bypass authorization controls, potentially leading to a total compromise of system confidentiality, integrity, and availability. Given the CVSS score of 8.8, this poses a high risk to business operations, as unauthorized parties could manipulate library records or access sensitive user data.

Remediation Plan

Immediate Action: Update the Yordam Library Automation System to version 22.1 or later immediately.

Proactive Monitoring: Review application access logs for suspicious patterns, such as unusual parameter manipulation or unauthorized requests to administrative endpoints.

Compensating Controls: Implement WAF rules to filter and inspect incoming requests for suspicious or malformed keys that may attempt to bypass authorization logic.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on user interaction slightly mitigates the attack vector, but the potential for total impact necessitates urgent patching.

Analyst Recommendation

The severity of this authorization bypass requires immediate attention. Organizations running affected versions of the Yordam Library Automation System should prioritize updating to version 22.1 to prevent potential unauthorized access and data manipulation.

Description Summary:
A code injection vulnerability exists in the Yordam Library Automation System, which may allow an attacker to execute arbitrary code through improper control of generated code.

Executive Summary:
A critical code injection vulnerability in the Yordam Library Automation System allows remote attackers to execute arbitrary code, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-15024

Affected Software: Yordam Information Library Automation System

Affected Versions: v.19.5 up to (excluding) v.22.1

Vulnerability: The application fails to properly sanitize input used in code generation (CWE-94), leading to an injection vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that this is remotely exploitable without authentication, provided the attacker can initiate the required user interaction.

Business Impact

Code injection vulnerabilities represent a severe risk, as they can lead to complete system takeover, data exfiltration, and the installation of malicious software. With a CVSS score of 8.8, this flaw threatens the integrity and security of the entire library infrastructure and stored organizational data.

Remediation Plan

Immediate Action: Update to version 22.1 or later as provided by the vendor.

Proactive Monitoring: Monitor for unexpected server-side processes or unauthorized file modifications that could indicate successful code execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common code injection payloads targeting the application's input fields.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of code injection vulnerabilities makes them highly dangerous, and the lack of a current exploit should not delay patching efforts.

Analyst Recommendation

Given the potential for full system compromise, this vulnerability is of high urgency. Administrators must apply the vendor-supplied patch (version 22.1) immediately to eliminate the risk of arbitrary code execution.

Description Summary:
An incorrect authorization vulnerability in the Yordam Library Automation System may allow unauthorized users to gain elevated privileges or access restricted system resources.

Executive Summary:
A critical authorization flaw in the Yordam Library Automation System could allow unauthenticated attackers to gain unauthorized access to restricted system functionality.

Vulnerability Details

CVE-ID: CVE-2025-15023

Affected Software: Yordam Information Library Automation System

Affected Versions: v.19.5 up to (excluding) v.22.1

Vulnerability: The application incorrectly handles authorization checks (CWE-863), failing to properly restrict access to sensitive functions. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms the vulnerability is remotely exploitable by an unauthenticated actor, subject to user interaction.

Business Impact

This vulnerability allows attackers to bypass intended security boundaries, potentially granting them administrative or unauthorized access to the system. A CVSS score of 8.8 reflects the high severity, as such access could lead to mass data theft or permanent disruption of the library's digital services.

Remediation Plan

Immediate Action: Upgrade the Yordam Library Automation System to version 22.1 or later.

Proactive Monitoring: Review audit logs for unauthorized access attempts or privilege escalation activity within the application.

Compensating Controls: Utilize network segmentation and access control lists (ACLs) to limit exposure of the application interface to untrusted networks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Despite the lack of confirmed exploitation, the potential for privilege escalation makes this a high-priority security issue.

Analyst Recommendation

The identified authorization flaw poses a significant risk to the security of the library system. It is imperative that all affected systems are updated to the latest version (22.1) to ensure proper authorization enforcement and to protect against unauthorized access.

Description Summary:
The Optional Email plugin for WordPress is vulnerable to unauthenticated account takeover via improper password reset key generation, allowing attackers to reset any user password.

Executive Summary:
The Optional Email plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to hijack any user account, including administrative accounts.

Vulnerability Details

CVE-ID: CVE-2025-15018

Affected Software: djanym Optional Email

Affected Versions: 0 through 1.3.11

Vulnerability: This vulnerability is an authorization bypass (CWE-639) where the plugin fails to restrict the random_password filter to registration contexts. This flaw allows an unauthenticated attacker to manipulate password reset key generation, granting them full control over arbitrary user accounts.

Business Impact

Successful exploitation allows an attacker to gain complete control over any account on the WordPress site, including those with administrative privileges. Given the CVSS score of 9.8, this poses a critical threat to data confidentiality, system integrity, and service availability, potentially leading to a total compromise of the web application environment.

Remediation Plan

Immediate Action: There is currently no patched version available for this plugin. Administrators should immediately deactivate and uninstall the Optional Email plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for unauthorized password resets or unexpected changes to administrative profiles. Monitor server access logs for anomalous requests targeting the password reset functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests, although deactivation remains the only guaranteed method to prevent exploitation of this logic flaw.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Jan 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its unauthenticated nature and the ability to target administrative accounts.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent full system compromise. Because the flaw allows for unauthenticated account takeover, administrators must prioritize the immediate removal of the affected plugin from their production environments. Monitor vendor channels closely for the release of a security patch before considering re-enabling the software.

Description Summary:
Ragic Enterprise Cloud Database contains a hard-coded cryptographic key vulnerability, enabling unauthenticated remote attackers to forge credentials and impersonate any user within the system.

Executive Summary:
A critical hard-coded cryptographic key vulnerability in Ragic Enterprise Cloud Database allows unauthenticated remote attackers to gain full unauthorized access to user accounts.

Vulnerability Details

CVE-ID: CVE-2025-15016

Affected Software: Ragic Enterprise Cloud Database

Affected Versions: All versions

Vulnerability: This vulnerability involves the use of a hard-coded cryptographic key (CWE-321), which allows an unauthenticated attacker to generate valid verification data. By exploiting this flaw, an attacker can bypass authentication mechanisms and impersonate any user, including administrative accounts.

Business Impact

The ability to log in as any user presents a severe security risk, as it grants attackers unrestricted access to sensitive data, system configurations, and internal operations. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it allows for full account takeover without requiring any prior authentication. This could lead to significant data breaches, loss of customer trust, and operational disruption.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain and install the necessary security patch to remediate the hard-coded key vulnerability.

Proactive Monitoring: Review system access logs for unusual login patterns, such as multiple successful logins from disparate IP addresses or unauthorized access to high-privilege accounts.

Compensating Controls: Implement network-level restrictions or a Web Application Firewall (WAF) to limit exposure of the database interface to trusted networks only, while awaiting the vendor-provided patch.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Dec 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as a hard-coded key makes it highly exploitable if the key is discovered, necessitating an urgent response.

Analyst Recommendation

Due to the critical severity and the potential for complete system compromise, organizations using the Ragic Enterprise Cloud Database must treat this vulnerability with the highest priority. Contacting the vendor for the official patch is the only definitive way to resolve the underlying flaw. Until the patch is applied, ensure that access to the affected service is restricted to the absolute minimum required by business operations.

Description Summary:
Ragic Enterprise Cloud Database is vulnerable to an arbitrary file read flaw via relative path traversal, allowing unauthenticated remote attackers to download sensitive system files.

Executive Summary:
An unauthenticated remote code execution vulnerability in Ragic Enterprise Cloud Database allows attackers to access sensitive system files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-15015

Affected Software: Ragic Enterprise Cloud Database

Affected Versions: Ragic Enterprise Cloud Database: 0

Vulnerability: The application suffers from a relative path traversal vulnerability (CWE-23) that allows unauthenticated remote attackers to bypass directory restrictions and read arbitrary files from the host system.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive configuration files, credentials, or system data. Given the CVSS score of 7.5, this high-severity flaw could lead to complete compromise of the application environment, resulting in significant data breaches and a loss of operational integrity.

Remediation Plan

Immediate Action: Contact the vendor directly to obtain and install the necessary security patch for the Ragic Enterprise Cloud Database.

Proactive Monitoring: Review web server and application access logs for anomalous requests containing directory traversal patterns, such as sequences of dot-dot-slash characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and normalize path inputs before they reach the application.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, which facilitates automated mass-scanning and exploitation.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for unauthorized file access by unauthenticated parties. Administrators must prioritize communication with the vendor to secure the patch, as the lack of a publicly available version number suggests that all deployments may be at risk until verified by the vendor. Immediate remediation is required to maintain the confidentiality of the database environment.

Description Summary:
A SQL injection vulnerability in the home.php file of the Refugee Food Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the a argument.

Executive Summary:
The Refugee Food Management System 1.0 contains an unauthenticated SQL injection vulnerability that poses a significant risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-15012

Affected Software: code-projects Refugee Food Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the home.php file. An unauthenticated attacker can exploit this remotely by injecting malicious input into the a argument.

Business Impact

The ability to perform unauthorized SQL queries against the system database can lead to data exfiltration, unauthorized modification of records, or potential administrative bypass. Given the CVSS score of 7.3, this high-severity vulnerability represents a substantial risk to data integrity and confidentiality for organizations utilizing this software.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or take it offline until the vendor provides a secure update.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing SQL syntax, such as UNION, SELECT, or comment characters, directed at the home.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns to mitigate exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated attackers to interact directly with the underlying database.

Analyst Recommendation

Due to the presence of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability requires immediate attention. Organizations must implement strict network-level access controls or WAF filtering to prevent exploitation until the vendor releases a secure version of the software.

Description Summary:
A SQL injection vulnerability exists in the logout.php file of Simple Stock System 1.0, allowing unauthenticated remote attackers to manipulate database queries via the uname parameter.

Executive Summary:
Simple Stock System 1.0 contains an unauthenticated SQL injection vulnerability that could allow remote attackers to extract, modify, or delete sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-15011

Affected Software: Code-Projects Simple Stock System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the logout.php file. An unauthenticated attacker can inject malicious SQL commands via the uname parameter, which is processed without proper sanitization.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the database, potentially leading to the leakage of sensitive business information, data tampering, or total system compromise. While the CVSS score of 7.3 reflects a high severity, the ability for unauthenticated remote attackers to execute arbitrary SQL queries represents a significant threat to data integrity and confidentiality.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected web application via network controls and implement input validation routines within the logout.php source code to sanitize the uname parameter.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting logout.php that contain suspicious characters or SQL syntax patterns, such as UNION, SELECT, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP requests targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a security research write-up hosted on GitHub.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application fails to validate user-supplied input before passing it to the database backend.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability poses a clear risk to any environment running Simple Stock System 1.0. Organizations should immediately isolate the affected application from public-facing networks or implement robust WAF protections to mitigate the risk of exploitation.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 router allows remote attackers to execute arbitrary code or cause a denial of service via the page parameter in the /goform/SafeUrlFilter endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 firmware version 1.0.0.18 poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-15010

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring within the /goform/SafeUrlFilter HTTP request handler. An unauthenticated attacker can trigger this vulnerability by sending a crafted HTTP request with an excessively long page parameter, leading to memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows a remote attacker to gain full control over the affected router, which can lead to unauthorized network access, interception of sensitive traffic, and complete system compromise. Given the CVSS score of 9.8, this flaw represents a critical threat to organizational infrastructure, potentially facilitating lateral movement into protected internal networks.

Remediation Plan

Immediate Action: Discontinue use of the affected Tenda WH450 device or isolate it from public-facing network segments until a vendor-supplied firmware update is applied. Verify the Tenda support portal for the latest available firmware release.

Proactive Monitoring: Monitor network traffic for suspicious HTTP requests targeting the /goform/SafeUrlFilter endpoint or unusual router behavior, such as unexpected reboots or crashes.

Compensating Controls: Implement strict ingress filtering on the network perimeter to block unauthorized access to the router management interface. If possible, place the device behind a robust firewall and disable remote management features.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's technical write-up linked in the vulnerability records.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of functional reproduction scripts significantly lowers the barrier for exploitation by malicious actors.

Analyst Recommendation

The critical nature of this buffer overflow, combined with the availability of public proof-of-concept code, necessitates immediate attention. Organizations utilizing Tenda WH450 routers must prioritize patching or isolating these devices to prevent exploitation. Failure to mitigate this vulnerability exposes the network to high-impact remote compromise.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 HTTP request handler allows remote attackers to trigger memory corruption via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 routers allows remote, unauthenticated attackers to execute arbitrary code or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-15008

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The vulnerability exists within the HTTP request handler for the /goform/L7Port endpoint, where a stack-based buffer overflow is triggered by supplying an excessively long value to the page parameter. This flaw allows remote, unauthenticated attackers to perform memory corruption, potentially leading to arbitrary code execution or service disruption.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network infrastructure. Because the device is an edge router, compromise could lead to full loss of confidentiality, integrity, and availability for all traffic passing through the affected hardware. With a CVSS score of 7.3, this represents a high-severity threat that could facilitate unauthorized network access and persistent control over gateway devices.

Remediation Plan

Immediate Action: There is currently no vendor-supplied patch available for this device. Administrators should immediately restrict access to the management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests targeting /goform/L7Port, specifically looking for requests containing oversized parameters.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to filter and block requests directed at the /goform/L7Port endpoint from untrusted sources.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical research documentation provided by the vulnerability reporter.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication to reach the vulnerable code path.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the lack of a vendor-provided security update, this vulnerability presents an immediate and elevated risk to Tenda WH450 deployments. Users must prioritize isolating these devices from the public internet and applying the recommended network-level compensating controls until a firmware update is released by the manufacturer.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 HTTP request handler allows remote, unauthenticated attackers to execute arbitrary code or cause a denial of service via the page parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 routers poses a severe risk of remote code execution by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-15007

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The vulnerability is a stack-based buffer overflow (CWE-121) located in the HTTP request handler for the /goform/L7Im endpoint. An unauthenticated attacker can trigger this flaw by sending a crafted HTTP request with an excessively long string in the page parameter.

Business Impact

The ability for an unauthenticated remote attacker to achieve arbitrary code execution on networking infrastructure is a severe security failure. This vulnerability could lead to total compromise of the affected device, potentially allowing an attacker to intercept network traffic, pivot into internal network segments, or render the device unusable, causing significant operational downtime. Given the CVSS score of 9.8, this flaw represents a critical threat to organizational security.

Remediation Plan

Immediate Action: As no specific patch version is currently available, users should immediately restrict access to the web management interface, ensuring it is not exposed to the public internet. If possible, isolate the affected hardware within a restricted management VLAN.

Proactive Monitoring: Security teams should monitor firewall and web access logs for anomalous GET requests directed at the /goform/L7Im endpoint, particularly those containing unusually long string parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures capable of detecting and blocking malformed HTTP requests that target buffer overflow vulnerabilities in embedded web servers.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical write-up on GitHub.

Analyst Notes: As of Dec 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional exploit script significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of public exploit code, immediate mitigation is required. Administrators should treat the affected devices as compromised if they have been exposed to the public internet. Organizations must prioritize the implementation of network-level access controls until the vendor releases a firmware update that addresses the memory corruption issue.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 router allows remote attackers to execute arbitrary code via a crafted ipaddress parameter sent to the /goform/CheckTools HTTP endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 firmware allows unauthenticated remote attackers to achieve arbitrary code execution or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-15006

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The vulnerability is a stack-based buffer overflow located in the HTTP request handler for the /goform/CheckTools endpoint. An unauthenticated attacker can trigger this condition by supplying an excessively long string to the ipaddress parameter, leading to memory corruption.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to organizational infrastructure. Successful exploitation allows an attacker to gain full control over the router, potentially leading to complete compromise of network traffic, unauthorized internal access, or total system unavailability.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should immediately restrict access to the device management interface by placing it behind a firewall or disabling remote management features entirely.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests directed at the /goform/CheckTools path, specifically looking for requests containing unusually long query parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to drop or sanitize incoming requests that contain oversized ipaddress parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept script and reproduction details are available via the security researcher's write-up on GitHub.

Analyst Notes: As of Dec 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the critical severity and the public availability of exploit code, this vulnerability poses a severe risk to any exposed Tenda WH450 device. Organizations should verify if their hardware is reachable from the internet and take immediate steps to isolate these devices from external access until the manufacturer releases a firmware update to resolve the memory corruption flaw.

Description Summary:
A SQL injection vulnerability in SeaCMS versions 13.0 through 13.3 allows remote, unauthenticated attackers to manipulate database queries via the page or limit arguments in mysqli.class.php.

Executive Summary:
SeaCMS versions 13.0 through 13.3 are vulnerable to a remote SQL injection attack, which could allow unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-15002

Affected Software: SeaCMS

Affected Versions: 13.0, 13.1, 13.2, 13.3

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the mysqli.class.php file. An unauthenticated remote attacker can trigger this flaw by sending a crafted request to the application, manipulating the page or limit parameters to execute arbitrary SQL commands.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high-severity risk due to the lack of required authentication. Successful exploitation may lead to unauthorized data access, potential modification of database contents, or unauthorized information disclosure, which can cause significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should restrict access to the vulnerable endpoint or contact the vendor for immediate security guidance.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the page and limit parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads targeting the identified parameters.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of December 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it does not require authentication and utilizes standard, predictable HTTP parameters.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible risk to the integrity of the backend database. Organizations should treat this as a priority and implement stringent input validation or WAF filtering immediately to prevent unauthorized access while awaiting a vendor-provided security update.

Description Summary:
The FS Registration Password plugin for WordPress fails to validate user identity during password updates, allowing unauthenticated attackers to reset passwords for any account, including administrators.

Executive Summary:
A critical vulnerability in the FS Registration Password plugin allows unauthenticated attackers to hijack any WordPress account, including administrator accounts, through unauthorized password resets.

Vulnerability Details

CVE-ID: CVE-2025-15001

Affected Software: fsylum FS Registration Password

Affected Versions: 0 through 1.0.1

Vulnerability: The vulnerability is an authorization bypass (CWE-639) occurring within the plugin authentication logic, which fails to verify user identity before performing password modifications. This flaw allows unauthenticated remote attackers to execute account takeovers by manipulating the password change process.

Business Impact

Successful exploitation grants an attacker full administrative control over the affected WordPress site. This leads to complete compromise of site data, potential malware injection, unauthorized access to user information, and significant reputational damage. Given the CVSS score of 9.8, this vulnerability is classified as critical, as it requires no privileges and permits total system takeover.

Remediation Plan

Immediate Action: Since a specific patched version is not explicitly identified in the provided data, users should immediately deactivate and remove the FS Registration Password plugin until a secure update is verified and released by the vendor.

Proactive Monitoring: Review WordPress user account logs for unexpected password changes or the creation of new administrator accounts. Monitor for anomalous traffic targeting the plugin authentication endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the registration or password reset parameters of the affected plugin.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Jan 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of identity validation, which makes account takeover trivial for an unauthenticated attacker.

Analyst Recommendation

The severity of this vulnerability necessitates immediate action to prevent full site compromise. Administrators must prioritize the removal of the vulnerable plugin to mitigate the risk of unauthorized administrative access until a verified fix is available. Continued vigilance regarding user account activity is essential for detecting potential exploitation attempts.

Description Summary:
The Branda plugin for WordPress allows unauthenticated attackers to reset arbitrary user passwords, including those of administrators, leading to full account takeover.

Executive Summary:
A critical authentication bypass vulnerability in the Branda plugin for WordPress allows unauthenticated remote attackers to perform full account takeover.

Vulnerability Details

CVE-ID: CVE-2025-14998

Affected Software: WPMU DEV Branda

Affected Versions: 0 through 3.4.24

Vulnerability: This vulnerability is an authorization bypass (CWE-639) occurring because the plugin fails to validate user identity during the password update process. An unauthenticated attacker can exploit this flaw to reset the password of any user account on the affected WordPress site.

Business Impact

The ability for an unauthenticated attacker to reset the password of any user, including administrative accounts, represents a total compromise of the affected WordPress site. Given the CVSS score of 9.8, this vulnerability allows for complete data exfiltration, unauthorized administrative actions, and potential lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update the Branda plugin to the latest available version beyond 3.4.24 immediately to patch the authentication logic.

Proactive Monitoring: Review WordPress user account activity logs for suspicious password change events or unauthorized administrative logins.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting the login or password recovery endpoints of the Branda plugin.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of Jan 2, 2026, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept makes this vulnerability highly dangerous. The lack of proper server-side validation for identity during password updates makes this flaw trivial to exploit for any remote attacker.

Analyst Recommendation

The severity of this vulnerability cannot be overstated given that it requires no authentication to facilitate a full site takeover. Administrators should verify their current version of the Branda plugin and apply the vendor-supplied update immediately. If an immediate update is not feasible, consider deactivating the plugin until the patch can be safely applied to prevent unauthorized access.

Description Summary:
The BuddyPress Xprofile Custom Field Types plugin is vulnerable to arbitrary file deletion via insufficient path validation in the delete_field function, allowing authenticated remote code execution.

Executive Summary:
A critical arbitrary file deletion vulnerability in the BuddyPress Xprofile Custom Field Types plugin allows authenticated attackers to potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-14997

Affected Software: BuddyDev BuddyPress Xprofile Custom Field Types

Affected Versions: 0 through 1.2.8

Vulnerability: The plugin fails to properly validate file paths within the delete_field function, which permits authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. Deleting critical system files such as wp-config.php can facilitate full site takeover and remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the integrity and availability of the WordPress environment. By deleting core configuration files, an attacker can force a site re-installation or bypass security controls, leading to total unauthorized control over the web application. Given the CVSS score of 7.2, the potential for remote code execution renders this a high-priority risk for any organization utilizing this plugin.

Remediation Plan

Immediate Action: Since no official patch version is currently confirmed, administrators should immediately deactivate and remove the BuddyPress Xprofile Custom Field Types plugin from their WordPress installation until a secure update is released.

Proactive Monitoring: Monitor server file system access logs for suspicious deletion activity originating from authenticated Subscriber-level user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block path traversal patterns, although complete removal of the vulnerable component remains the only guaranteed mitigation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of January 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on path traversal makes it a highly dangerous primitive that can be chained to achieve full system compromise.

Analyst Recommendation

The vulnerability represents a significant security oversight that exposes the underlying server to complete compromise by low-privileged users. Organizations must prioritize the removal of the affected plugin to eliminate the attack surface immediately. Continue to monitor vendor communications for the release of a patched version before considering re-deployment.

Description Summary:
The AS Password Field In Default Registration Form plugin for WordPress allows unauthenticated attackers to perform account takeovers by resetting arbitrary user passwords.

Executive Summary:
A critical privilege escalation vulnerability in the AS Password Field In Default Registration Form plugin allows unauthenticated attackers to hijack administrative accounts and achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14996

Affected Software: Akshar Soft Solutions AS Password Field In Default Registration Form

Affected Versions: 0 through 2.0.0

Vulnerability: The plugin fails to perform necessary identity validation when processing password updates, which allows an unauthenticated attacker to manipulate the password reset mechanism. This authorization bypass effectively grants the attacker full control over any user account, including those with administrative privileges.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level due to the ease of exploitation and the potential for total system compromise. Successful exploitation grants attackers full administrative access, which can result in complete data exfiltration, unauthorized modification of site content, and potential distribution of malware to site visitors.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and uninstall the plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for suspicious password resets or unexpected administrative logins.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block unauthorized requests to password reset endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of authentication required to trigger the password reset process.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path for unauthenticated actors to seize control of WordPress administrative accounts. Organizations currently running the AS Password Field In Default Registration Form plugin must prioritize its immediate removal to prevent account takeover attacks. Please monitor the vendor's official WordPress plugin page for the release of a security patch before considering re-installation.

Description Summary:
A stack-based buffer overflow in the Tenda FH1201 router allows remote attackers to trigger memory corruption via a malformed page parameter in HTTP requests to the /goform/SetIpBind endpoint.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda FH1201 wireless router enables potential remote code execution through the manipulation of the page parameter.

Vulnerability Details

CVE-ID: CVE-2025-14995

Affected Software: Tenda FH1201

Affected Versions: 1.2.0.14(408)

Vulnerability: The vulnerability resides in the sprintf function within the /goform/SetIpBind file, where an overly long input to the page argument triggers a stack-based buffer overflow. While the CVSS vector indicates a requirement for low-level authentication, the flaw is reachable remotely and allows for complete system compromise.

Business Impact

The vulnerability poses a severe risk to network infrastructure, as successful exploitation could lead to arbitrary code execution or a persistent denial of service. Given the CVSS score of 8.8, this represents a high-severity threat that could allow attackers to gain unauthorized control over edge routing equipment, facilitating lateral movement within the local network or interception of traffic.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the management interface to trusted internal segments only and disable remote administration features.

Proactive Monitoring: Monitor network traffic for anomalous HTTP GET requests targeting the /goform/SetIpBind endpoint, specifically looking for unusually large or malformed strings in the page parameter.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with custom rules to inspect and drop HTTP requests containing excessive data strings directed at the vulnerable path.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical research repository provided by the vulnerability reporter.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the simplicity of the attack vector, which requires only a single crafted HTTP request.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently utilizing the Tenda FH1201 should treat this as a high-priority issue and implement strict network-level access controls immediately to prevent remote access to the management interface until a vendor-supplied firmware update is released.

Description Summary:
A stack-based buffer overflow in Tenda FH1201 and FH1206 routers allows remote attackers to trigger memory corruption via the webSiteId parameter in the /goform/webtypelibrary endpoint.

Executive Summary:
A critical stack-based buffer overflow in Tenda FH1201 and FH1206 routers permits remote attackers to execute arbitrary code or cause a denial of service via malformed HTTP requests.

Vulnerability Details

CVE-ID: CVE-2025-14994

Affected Software: Tenda FH1201 and FH1206 Wireless Routers

Affected Versions: 1.2.0.8(8155), 1.2.0.14(408)

Vulnerability: This vulnerability is a stack-based buffer overflow occurring in the strcat function within the HTTP Request Handler. An authenticated user can trigger this memory corruption by sending a crafted HTTP GET request to the /goform/webtypelibrary endpoint with an excessively long webSiteId argument.

Business Impact

The ability for a remote attacker to achieve arbitrary code execution on networking infrastructure poses a severe risk to organizational security. Successful exploitation could lead to full device compromise, unauthorized network traffic interception, or persistent denial of service, severely impacting business operations. With a CVSS score of 8.8, this vulnerability is classified as High and demands immediate attention to prevent lateral movement within the local network.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately restrict access to the web management interface of affected Tenda routers to trusted management IP addresses only.

Proactive Monitoring: Review device logs for unusual HTTP GET requests targeting the /goform/webtypelibrary URI, specifically monitoring for anomalous lengths in the webSiteId parameter.

Compensating Controls: If management interface access cannot be restricted, ensure that the router is not exposed to the public internet and utilize network segmentation to isolate administrative traffic from user-facing segments.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's technical write-up on GitHub.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it only requires a simple HTTP request to trigger the buffer overflow.

Analyst Recommendation

Given the availability of public proof-of-concept code and the critical nature of buffer overflow vulnerabilities in network hardware, the risk is significant. Organizations using these Tenda devices must treat this as a priority, ensuring that administrative interfaces are not exposed to untrusted networks while awaiting official vendor firmware updates.

Description Summary:
A stack-based buffer overflow exists in the Tenda AC18 router firmware due to improper handling of the scanList argument within the SetDlnaCfg function.

Executive Summary:
A critical buffer overflow vulnerability in the Tenda AC18 router allows remote attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2025-14993

Affected Software: Tenda AC18

Affected Versions: 15.03.05.05

Vulnerability: The vulnerability is a stack-based buffer overflow occurring in the HTTP Request Handler when the /goform/SetDlnaCfg endpoint processes the scanList parameter via an unsafe sprintf call. The vulnerability requires the attacker to have low privileges to interact with the configuration endpoint.

Business Impact

Successful exploitation of this memory corruption flaw can lead to full system compromise, allowing an attacker to execute arbitrary code with elevated privileges on the affected networking hardware. Given the CVSS score of 8.8, this poses a severe risk to network infrastructure, potentially enabling lateral movement, traffic interception, or complete denial of service for connected business operations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the router management interface and disable the DLNA configuration features if they are not required.

Proactive Monitoring: Monitor device logs for unusual spikes in traffic directed at the /goform/SetDlnaCfg endpoint or unexpected device reboots that may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to inspect incoming HTTP requests and block payloads containing excessively long strings directed at the vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up provided in the references.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the predictable nature of the buffer overflow in the sprintf operation.

Analyst Recommendation

Due to the severity of this remote code execution flaw and the existence of a public proof-of-concept, users of the Tenda AC18 router must prioritize network-level segmentation to isolate the device. Organizations should verify if their firmware version is vulnerable and monitor vendor channels for the release of an official security patch to remediate this memory corruption issue.

Description Summary:
A stack-based buffer overflow in the Tenda AC18 router allows remote attackers to execute arbitrary code or cause a denial of service via a malformed mac parameter in an HTTP request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC18 routers could allow remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-14992

Affected Software: Tenda AC18

Affected Versions: 15.03.05.05

Vulnerability: The vulnerability exists in the /goform/GetParentControlInfo endpoint, where the strcpy function fails to properly validate the length of the mac argument. This flaw allows an authenticated attacker to trigger a buffer overflow, potentially leading to system compromise.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw, as it allows for potential remote code execution on network infrastructure. Successful exploitation could lead to full device takeover, allowing an attacker to intercept network traffic, pivot into internal segments, or render the device inoperable, causing significant operational downtime.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the management interface to trusted internal networks only. Contact Tenda support or check the official vendor website for firmware updates that address this memory corruption flaw.

Proactive Monitoring: Monitor device logs for unusual HTTP GET requests directed at the /goform/GetParentControlInfo endpoint, specifically those containing abnormally long strings in the mac parameter.

Compensating Controls: Implement a Web Application Firewall or network-based Access Control List to block requests to the vulnerable endpoint from unauthorized IP addresses until a firmware update is applied.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked research write-up by z472421519.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the affected function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe risk to network security. Organizations utilizing Tenda AC18 routers should prioritize isolating these devices from the public internet and verify firmware status with the vendor immediately to prevent unauthorized access.

Description Summary:
Campcodes Complete Online Beauty Parlor Management System 1.0 contains a SQL injection vulnerability in the admin/view-appointment.php file via the viewid argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-14990

Affected Software: Campcodes Complete Online Beauty Parlor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the admin/view-appointment.php file, which fails to properly sanitize the viewid argument. The vulnerability can be exploited by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive data stored within the database, or potentially modify administrative records. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application, which could lead to unauthorized access to customer appointments and personal information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/view-appointment.php, particularly those containing SQL syntax characters like single quotes or comment sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the viewid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up found at the GitHub repository linked in the official CVE references.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger via the vulnerable parameter.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations using this software must restrict access to the affected management interface until an official vendor patch is released and verified. Prioritize the implementation of network-level access controls to mitigate the risk of remote exploitation.

Description Summary:
A SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the search-invoices.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 poses a significant risk of unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2025-14989

Affected Software: Campcodes Complete Online Beauty Parlor Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the search-invoices.php file, which fails to properly sanitize user-supplied input. This flaw is remotely exploitable by an unauthenticated attacker.

Business Impact

Successful exploitation allows an adversary to interact directly with the underlying database, potentially leading to the unauthorized disclosure or modification of sensitive customer and business data. Given the CVSS score of 7.3, this vulnerability is classified as High severity and represents a significant risk to the confidentiality and integrity of the application environment.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected administration interface or take the application offline until a secure version is released.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected SQL syntax errors or attempts to extract large volumes of data, which may indicate active exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the search-invoices.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability disclosure (https://github.com/funnnxxx/my-cve/issues/3).

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute malicious database queries.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability necessitates urgent attention. Security teams must treat this as a high-priority risk and implement restrictive access controls or WAF filtering immediately to prevent potential data breaches while awaiting a vendor-supplied security update.

Description Summary:
The Dokan WordPress plugin is vulnerable to Insecure Direct Object Reference (IDOR) in the REST API, allowing authenticated attackers to modify sensitive store settings and divert payments.

Executive Summary:
An Insecure Direct Object Reference vulnerability in the Dokan plugin for WordPress allows authenticated attackers to manipulate sensitive vendor payment information and potentially facilitate financial theft.

Vulnerability Details

CVE-ID: CVE-2025-14977

Affected Software: weDevs Dokan

Affected Versions: 0 through 4.2.4

Vulnerability: This vulnerability exists in the /wp-json/dokan/v1/settings REST API endpoint due to improper access control. Attackers with customer-level permissions or higher can read or modify sensitive vendor data, including bank account details and PayPal addresses, by exploiting missing validation on a user-controlled key.

Business Impact

The ability for an unauthorized user to modify payment routing information poses a critical threat to the financial integrity of the marketplace. An attacker could redirect vendor payouts to their own accounts, leading to direct financial loss, significant reputational damage, and potential legal liability. With a CVSS score of 8.1, the vulnerability is classified as High severity due to the high impact on data integrity and the relative ease of exploitation for authenticated users.

Remediation Plan

Immediate Action: Update the Dokan plugin to version 4.2.5 or later, where this access control flaw has been addressed.

Proactive Monitoring: Monitor REST API access logs for unusual patterns or repeated requests to the /wp-json/dokan/v1/settings endpoint, particularly from accounts with standard customer roles.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access attempts to the vulnerable REST API endpoint if immediate patching is not feasible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows for direct manipulation of financial settlement data without requiring administrative privileges.

Analyst Recommendation

Given the potential for direct financial theft through payment redirection, organizations utilizing the Dokan plugin must prioritize applying the available security update immediately. Administrators should also audit existing vendor settings to ensure that no unauthorized changes have been made to payment information while the site was running a vulnerable version.

Description Summary:
The Custom Login Page Customizer plugin for WordPress contains an improper privilege management vulnerability that allows unauthenticated attackers to reset the passwords of arbitrary user accounts.

Executive Summary:
A critical vulnerability in the Custom Login Page Customizer WordPress plugin allows unauthenticated attackers to hijack user accounts, including administrator accounts, by resetting passwords.

Vulnerability Details

CVE-ID: CVE-2025-14975

Affected Software: WordPress Custom Login Page Customizer

Affected Versions: 2.1.1 up to (excluding) 2.5.4

Vulnerability: This flaw is classified as improper privilege management (CWE-269), where the plugin fails to implement a secure password reset process. An unauthenticated attacker can trigger a password reset for any user, including administrators, simply by knowing the target username.

Business Impact

The ability for an unauthenticated attacker to reset administrative passwords represents a total compromise of the application and its underlying data. This could result in unauthorized access to sensitive user information, full site takeover, and potential injection of malicious content, leading to severe reputational and operational damage. With a CVSS score of 8.1, this is a high-severity risk that requires immediate attention to prevent account takeover incidents.

Remediation Plan

Immediate Action: Update the Custom Login Page Customizer plugin to version 2.5.4 or later immediately to resolve the vulnerable password reset logic.

Proactive Monitoring: Review WordPress user account activity logs for suspicious password resets or unexpected changes to administrative account credentials.

Compensating Controls: If an immediate update is not possible, deactivate the plugin entirely until a patch can be applied, or implement a Web Application Firewall (WAF) rule to block unauthorized requests to the plugin's password reset endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 30, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the lack of authentication makes the flaw highly dangerous, the requirement for specific knowledge of usernames provides a slight barrier to mass automated exploitation.

Analyst Recommendation

Given the potential for complete account takeover, organizations utilizing the Custom Login Page Customizer plugin must prioritize this update. Verify that all administrative accounts are protected by multi-factor authentication, as this provides a critical layer of defense against password reset vulnerabilities. Apply the patch to version 2.5.4 immediately to eliminate the risk of unauthenticated account compromise.

Description Summary:
A SQL injection vulnerability exists in the Simple Stock System 1.0 update.php file, allowing unauthenticated remote attackers to manipulate database queries via the email parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Stock System 1.0 allows for unauthorized database access and potential system compromise by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-14968

Affected Software: code-projects Simple Stock System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection within the update.php file, specifically via the email parameter. Because the software fails to sanitize user input before incorporating it into database queries, an unauthenticated attacker can execute arbitrary SQL commands.

Business Impact

Successful exploitation of this flaw allows attackers to bypass authentication, extract sensitive information, modify database contents, or potentially gain administrative control over the underlying server. Given the CVSS score of 7.3 and the availability of public proof-of-concept code, the risk to data confidentiality and integrity is significant, potentially leading to severe operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected update.php endpoint or disable the vulnerable module entirely.

Proactive Monitoring: Review web server access logs for suspicious GET requests targeting update.php containing SQL syntax characters, such as single quotes or comment indicators, in the email parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing malicious SQL patterns specifically directed at the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it requires no prior authentication or specialized privileges.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the public availability of exploit details, organizations utilizing Simple Stock System 1.0 must prioritize immediate mitigation. Restricting network access to the application and applying rigorous input validation at the WAF level is essential to prevent potential data breaches. If the application is not business-critical, decommissioning or isolating the instance is the most effective security measure until a formal update is released.

Description Summary:
A SQL injection vulnerability in the Student Management System 1.0 allows unauthenticated attackers to execute arbitrary SQL commands via the school_year parameter in /candidates_report.php.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Student Management System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-14967

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the candidates_report.php file. The application fails to properly sanitize the school_year GET parameter, allowing an unauthenticated attacker to manipulate backend database queries.

Business Impact

Successful exploitation allows an attacker to perform unauthorized database operations, including data exfiltration, modification, or potential full system compromise. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, as it does not require any prior user authentication or administrative privileges to trigger.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unavailable, administrators must restrict access to the /candidates_report.php file via network controls or web server configurations until a fix is provided.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting /candidates_report.php, particularly those containing SQL syntax such as UNION, SELECT, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in the school_year query parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up hosted on GitHub.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of public proof-of-concept code and the lack of authentication required for exploitation, this vulnerability presents a high risk. Organizations utilizing this software should immediately restrict external access to the vulnerable endpoint and prioritize implementing strict input validation or migrating to a secure alternative.

Description Summary:
A stack-based buffer overflow in the TOTOLINK T10 router allows unauthenticated remote attackers to execute code by manipulating the loginAuthUrl argument in cgi-bin/cstecgi.cgi.

Executive Summary:
A critical stack-based buffer overflow vulnerability in TOTOLINK T10 routers poses a severe risk of remote code execution for unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-14964

Affected Software: TOTOLINK T10

Affected Versions: 4.1.8cu.5083_B20200521

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) occurring within the sprintf function of the cgi-bin/cstecgi.cgi file. The flaw is triggerable by an unauthenticated remote attacker through the manipulation of the loginAuthUrl parameter.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it allows for full system compromise without requiring any user interaction or authentication. Successful exploitation may result in complete loss of device control, potential lateral movement within the network, and significant disruption to business operations.

Remediation Plan

Immediate Action: Contact the vendor or consult the official TOTOLINK support portal to determine if a firmware update is available for this specific model, and apply it immediately.

Proactive Monitoring: Monitor network traffic for unusual requests directed at cgi-bin/cstecgi.cgi and review system logs for signs of unauthorized configuration changes or crash events.

Compensating Controls: Restrict access to the device management interface to trusted administrative IP addresses and employ a network firewall to block unsolicited traffic originating from untrusted sources.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced by the vulnerability record.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, because the vulnerability is reachable over the network without authentication, the risk of exploitation is high.

Analyst Recommendation

Given the critical nature of this buffer overflow and the availability of public technical details, it is imperative that organizations using the affected TOTOLINK T10 hardware identify and patch these devices immediately. If a patch is not yet available from the vendor, isolate the affected hardware from the public internet to prevent potential exploitation by remote actors.

Description Summary:
The Simple Blood Donor Management System 1.0 contains a SQL injection vulnerability in the editedcampaign.php file via the campaignname parameter, allowing unauthenticated remote attackers to execute code.

Executive Summary:
A critical SQL injection vulnerability in the Simple Blood Donor Management System 1.0 allows unauthenticated remote attackers to manipulate database queries and potentially gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-14961

Affected Software: code-projects Simple Blood Donor Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the editedcampaign.php file. The application fails to sanitize the campaignname parameter before incorporating it into database queries, allowing an unauthenticated attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system. An attacker can perform unauthorized database operations, including data exfiltration, modification, or deletion, which could lead to a total compromise of the application and its underlying data. With a CVSS score of 7.3, this flaw represents a significant risk to business continuity and data protection standards.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or take the application offline until code-level mitigations are implemented.

Proactive Monitoring: Monitor web server logs for suspicious POST requests containing SQL syntax or unusual characters, particularly targeting the editedcampaign.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the campaignname parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue linked by the research write-up.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the absence of required authentication and the direct use of user-supplied input in database queries.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents an immediate risk to any deployment of the Simple Blood Donor Management System. Organizations must treat this as a high-priority issue and apply strict input validation or transition to a more secure management solution immediately to prevent unauthorized database access.

Description Summary:
The Simple Blood Donor Management System 1.0 is vulnerable to unauthenticated SQL injection via the name parameter in /simpleblooddonor/editeddonor.php, allowing remote database manipulation.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Blood Donor Management System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14960

Affected Software: code-projects Simple Blood Donor Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /simpleblooddonor/editeddonor.php file. An unauthenticated attacker can supply malicious input via the name parameter during a POST request to execute arbitrary SQL queries against the backend database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication mechanisms to query, modify, or delete sensitive donor records. Given the CVSS score of 7.3, this flaw presents a high risk to data confidentiality and integrity, potentially leading to unauthorized disclosure of personally identifiable information and complete loss of control over the application database.

Remediation Plan

Immediate Action: As no official vendor patch is available, administrators must restrict access to the /simpleblooddonor/ directory via network-level controls or disable the application until a secure version is released.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to /simpleblooddonor/editeddonor.php, particularly those containing SQL syntax characters such as single quotes, RLIKE, or SLEEP commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the direct inclusion of user-supplied data in database queries.

Analyst Recommendation

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability should be treated with high urgency. Organizations using this software must implement immediate network-level restrictions or WAF-based mitigations to prevent unauthenticated database access until the vendor provides a secure update.

Description Summary:
A SQL injection vulnerability in the Simple Stock System signup.php file allows unauthenticated remote attackers to manipulate SQL queries via the username parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Simple Stock System 1.0 poses a critical risk by allowing remote attackers to potentially gain unauthorized database access and control.

Vulnerability Details

CVE-ID: CVE-2025-14959

Affected Software: code-projects Simple Stock System

Affected Versions: 1.0

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) occurring within the signup.php file. An unauthenticated attacker can inject malicious SQL commands via the username parameter, which is processed by the application without adequate sanitization or parameterization.

Business Impact

Successful exploitation of this flaw can lead to severe consequences, including full unauthorized access to the backend database, exfiltration of sensitive information, data tampering, and potential service disruption. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete system compromise if the database user possesses excessive privileges.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the signup.php endpoint or disable the registration functionality until the vendor provides a secure update.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically looking for SQL syntax characters or suspicious query strings within POST requests directed at the /market/signup.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing SQL injection payloads targeting the username parameter. Additionally, ensure the database service account is configured with the least privilege necessary to perform its functions.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up on GitHub.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept, combined with the ease of exploitation, necessitates immediate attention. Organizations utilizing Simple Stock System 1.0 must prioritize applying the recommended compensating controls to mitigate the risk of unauthorized database interaction while awaiting a formal vendor patch.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to SQL injection in the /admin/add_category.php file via the txtCategoryName parameter, allowing unauthenticated remote attackers to execute queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14952

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the txtCategoryName parameter within the /admin/add_category.php file, allowing unauthenticated remote attackers to inject malicious SQL commands directly into database queries.

Business Impact

Successful exploitation allows an attacker to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of business integrity, and prolonged service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /admin/add_category.php endpoint and implement strict input validation for all POST requests.

Proactive Monitoring: Monitor database query logs for unusual time-based patterns, such as unexpected sleep commands or large-scale data extraction attempts originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the txtCategoryName parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to trigger the flaw.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of automated exploitation by malicious actors. Organizations currently running Campcodes Supplier Management System 1.0 are urged to isolate the application from external networks and prioritize the implementation of robust input sanitization or transition to a more secure alternative until a vendor-supplied patch is released.

Description Summary:
A SQL injection vulnerability in the Scholars Tracking System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the post_content parameter in /sts/home.php.

Executive Summary:
The Scholars Tracking System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14951

Affected Software: code-projects Scholars Tracking System

Affected Versions: 1.0

Vulnerability: The application fails to sanitize the post_content parameter in the /sts/home.php file before including it in SQL queries. This flaw allows an unauthenticated attacker to inject malicious SQL statements, facilitating unauthorized database manipulation and potential data exfiltration.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive institutional data, potential modification or deletion of records, and total compromise of the database layer. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant operational disruption and loss of trust, particularly given that the attack vector requires no authentication.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /sts/home.php endpoint or disable the affected functionality until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or sleep commands originating from the post_content parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block POST requests containing suspicious SQL injection payloads targeting the /sts/home.php file.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub write-up.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the risk of exploitation by automated scanners and malicious actors. Organizations currently utilizing Scholars Tracking System 1.0 must prioritize implementing the aforementioned compensating controls immediately to prevent unauthorized database access, as a vendor-supplied patch is currently unavailable.

Description Summary:
A SQL injection vulnerability exists in the Scholars Tracking System 1.0 delete_post.php file, allowing unauthenticated attackers to manipulate database queries via the id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Scholars Tracking System 1.0 poses a significant risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14950

Affected Software: code-projects Scholars Tracking System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /sts/delete_post.php file. It stems from improper sanitization of the id parameter, which allows an unauthenticated attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, data tampering, or complete database compromise. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it allows remote attackers to bypass application security controls to interact directly with the backend database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /sts/delete_post.php endpoint via network controls or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor web server access logs for anomalous GET requests containing SQL syntax, such as UNION, SELECT, or SLEEP commands, directed at the delete_post.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the researcher's GitHub issue report (https://github.com/gx922/CVE/issues/2).

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents a credible risk to any environment hosting the Scholars Tracking System. Organizations should prioritize isolating the affected application from public-facing networks and implement strict input validation or WAF filtering to mitigate the risk of exploitation until official remediation is provided by the vendor.

Description Summary:
A SQL injection vulnerability in the Scholars Tracking System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL queries via the id parameter in /admin/delete_user.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Scholars Tracking System 1.0 permits unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14940

Affected Software: code-projects Scholars Tracking System

Affected Versions: 1.0

Vulnerability: The application fails to sanitize the id parameter in the /admin/delete_user.php script before incorporating it into database queries. This vulnerability allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized data access or manipulation.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive information, modify or delete database records, and potentially gain full control over the underlying database. While the CVSS score of 7.3 reflects the high impact on data confidentiality and integrity, the ability for an unauthenticated attacker to perform these actions poses an immediate threat to business continuity and data privacy.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and implement strict input validation on all parameters. If the system is not critical, consider taking the application offline until the vendor provides a secure update.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing SQL syntax, such as "SLEEP", "UNION", or comment characters like "#" or "--". Review database query logs for anomalous execution patterns originating from the /admin/delete_user.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable parameter. Ensure that the database user account used by the web application is restricted to the minimum necessary privileges to limit the scope of potential damage.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of December 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no prior authentication or administrative privileges.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability represents a significant risk to any organization hosting the Scholars Tracking System. Organizations must prioritize restricting access to the affected script immediately and remain vigilant for vendor updates, as the lack of an official patch makes proactive defensive measures and network-level filtering essential for protection.

Description Summary:
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the acff parameter, allowing unauthenticated attackers to inject arbitrary web scripts.

Executive Summary:
A critical Stored Cross-Site Scripting vulnerability in the Frontend Admin plugin for WordPress allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

Vulnerability Details

CVE-ID: CVE-2025-14937

Affected Software: DynamiApps Frontend Admin

Affected Versions: 0 through 3.28.23

Vulnerability: The plugin fails to properly sanitize input or escape output for the acff parameter within the frontend_admin/forms/update_field AJAX action. This flaw allows unauthenticated remote attackers to inject malicious JavaScript that executes when a victim views the affected page.

Business Impact

This vulnerability carries a CVSS score of 7.2, reflecting a high-severity risk due to the lack of required authentication. Successful exploitation could lead to session hijacking, unauthorized actions performed on behalf of administrative users, or the redirection of site visitors to malicious domains, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: Since a specific patched version is not confirmed in the provided data, administrators should immediately deactivate and remove the Frontend Admin plugin until an official security update is verified and installed.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting the frontend_admin/forms/update_field AJAX endpoint.

Compensating Controls: Implement a robust Web Application Firewall (WAF) rule to block unauthorized traffic containing scripts within the acff parameter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows unauthenticated interaction with a backend AJAX function, bypassing typical access controls.

Analyst Recommendation

Given the unauthenticated nature of this vulnerability and its potential for widespread impact on site integrity, immediate removal of the plugin is the most effective security measure. Organizations relying on this software must prioritize the identification of alternative solutions or wait for the vendor to release and document a verified patch that addresses the underlying sanitization failures.