Description Summary:
A path traversal vulnerability exists in the NGINX Ingress Controller due to improper validation of the nginx.org/rewrite-target annotation.

Executive Summary:
An authenticated path traversal vulnerability in the F5 NGINX Ingress Controller allows attackers to bypass security controls, posing a significant risk of unauthorized resource access.

Vulnerability Details

CVE-ID: CVE-2025-14727

Affected Software: F5 NGINX Ingress Controller

Affected Versions: 5.3.0 up to (excluding) 5.3.1

Vulnerability: This flaw is classified as a path traversal (CWE-22) residing in the validation logic for the rewrite-target annotation. The CVSS vector (PR:L) indicates that an attacker must possess low-level privileges to successfully trigger this vulnerability.

Business Impact

The vulnerability carries a CVSS score of 8.3, reflecting a high severity due to the potential for significant unauthorized access to system resources. A successful exploit could lead to data compromise or unauthorized modification of backend services, potentially resulting in service disruption or exposure of sensitive infrastructure data.

Remediation Plan

Immediate Action: Upgrade to NGINX Ingress Controller version 5.3.1 or ensure the installation is running on a supported, unaffected version such as 5.2.0, 5.1.0, 5.0.0, or 4.0.0.

Proactive Monitoring: Review ingress controller access logs for suspicious rewrite-target annotation usage or patterns indicative of traversal attempts, such as sequences involving double dots or unexpected file paths.

Compensating Controls: Deploy or tune Web Application Firewall (WAF) rules to inspect and sanitize ingress controller annotations, specifically looking for and blocking attempts to inject directory traversal patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires authenticated access, the ability to traverse paths within the ingress configuration remains a high-risk vector for environment compromise.

Analyst Recommendation

Given the high CVSS score and the nature of the vulnerability, organizations should prioritize patching their NGINX Ingress Controller instances. Administrators must verify their current version against the fixed releases provided by F5 and apply the update immediately to prevent potential exploitation of the rewrite-target annotation.

Description Summary:
The JHENG GAO Student Learning Assessment and Support System contains an exposure of sensitive information flaw, allowing unauthenticated remote attackers to access test credentials via a specific page.

Executive Summary:
An unauthenticated remote information exposure vulnerability in the JHENG GAO Student Learning Assessment and Support System allows attackers to obtain unauthorized access to system credentials.

Vulnerability Details

CVE-ID: CVE-2025-14712

Affected Software: JHENG GAO Student Learning Assessment and Support System

Affected Versions: JHENG GAO Student Learning Assessment and Support System: 0

Vulnerability: The application suffers from an exposure of sensitive information (CWE-497) that permits unauthenticated remote attackers to view a specific page containing test accounts and passwords. This vulnerability is fully automatable, requiring no authentication or user interaction to exploit.

Business Impact

The exposure of valid test credentials presents a high risk to the confidentiality and integrity of the assessment system. With a CVSS score of 7.5, this high-severity flaw could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized data access, grade manipulation, or further exploitation within the institutional environment.

Remediation Plan

Immediate Action: Contact JHENG GAO to confirm the update status of your deployment and apply the necessary security patches. If an update cannot be applied immediately, restrict access to the system by disabling external services and limiting connectivity to the internal network only.

Proactive Monitoring: Review application access logs for unusual requests to sensitive endpoints or unexpected authentication patterns using test credentials.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to sensitive system paths and monitor for reconnaissance activity.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication, making it a prime candidate for automated scanning and exploitation.

Analyst Recommendation

This vulnerability represents a significant security risk due to the ease with which sensitive credentials can be harvested. Security teams should prioritize contacting the vendor to verify their patch status and implement network-level access controls immediately to mitigate the risk of unauthorized access while awaiting formal remediation.

Description Summary:
A time-based blind SQL injection vulnerability exists in the FantasticLBP Hotels Server, allowing unauthenticated remote attackers to manipulate the pickedHotelName parameter.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in the FantasticLBP Hotels Server poses a significant risk to data integrity and system confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14711

Affected Software: FantasticLBP Hotels Server

Affected Versions: master-67b44df162fab26df209bd5d5d542875fcbec1d0

Vulnerability: The application fails to properly sanitize the pickedHotelName parameter within the /controller/api/hotelList.php file, which is directly processed in SQL queries. This allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

Business Impact

Successful exploitation of this flaw can lead to unauthorized database access, sensitive data exfiltration, and potential system compromise. Given the CVSS score of 7.3, this is a high-severity issue that could result in significant business disruption and loss of customer data confidentiality, as the attack vector requires no authentication.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /controller/api/hotelList.php endpoint via network controls or a Web Application Firewall.

Proactive Monitoring: Monitor database query logs for unusual time-based delays or patterns indicative of automated SQL injection tools such as sqlmap.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block malicious SQL injection payloads targeting the pickedHotelName parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the GitHub issue referenced by the CVE record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, a functional proof-of-concept is publicly available, making the exploitation risk credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct injection point.

Analyst Recommendation

Due to the availability of a public exploit and the lack of a vendor-supplied patch, organizations running this software must prioritize the implementation of compensating controls. Immediate action should be taken to block access to the vulnerable API endpoint to prevent unauthorized database manipulation until the vendor provides a formal fix.

Description Summary:
A SQL injection vulnerability exists in the FantasticLBP Hotels Server order list API, allowing unauthenticated remote attackers to manipulate database queries via the telephone parameter.

Executive Summary:
A critical SQL injection vulnerability in the FantasticLBP Hotels Server allows unauthenticated remote attackers to compromise database integrity and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-14710

Affected Software: FantasticLBP Hotels Server

Affected Versions: Up to commit 67b44df162fab26df209bd5d5d542875fcbec1d0

Vulnerability: This is a SQL injection flaw located in the /controller/api/OrderList.php file, where the telephone parameter is processed without proper sanitization. The vulnerability is exploitable by an unauthenticated attacker, as no login or authorization is required to reach the affected endpoint.

Business Impact

Successful exploitation of this vulnerability enables attackers to gain unauthorized access to the underlying database, leading to potential sensitive data leakage, data tampering, or full system compromise. Given the CVSS score of 7.3, this represents a significant risk to business continuity and data privacy, as it allows for the manipulation of order information and unauthorized database interactions.

Remediation Plan

Immediate Action: Since a formal patch is currently unavailable, administrators should restrict access to the /controller/api/OrderList.php endpoint via network controls or a Web Application Firewall.

Proactive Monitoring: Review web server and database access logs for anomalous requests containing SQL syntax patterns or unexpected characters within the telephone parameter.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block SQL injection payloads targeting the specified API endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub issue (https://github.com/navex2/CVE/issues/3).

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, because a functional proof-of-concept is publicly available, the exploitation risk is credible. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability necessitates urgent attention. Security teams should implement strict input validation and restrict public access to the vulnerable API endpoint immediately. As the vendor has not provided a patch, continuous monitoring for malicious activity is essential until a secure version is released.

Description Summary:
A buffer overflow vulnerability in the WIRELESSCFGGET interface of Shiguangwu sgwbox N3 version 2.0.25 allows unauthenticated remote attackers to execute arbitrary code.

Executive Summary:
A critical remote buffer overflow vulnerability in Shiguangwu sgwbox N3 allows unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14709

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: This vulnerability is a buffer overflow (CWE-120) triggered by the manipulation of the params argument within the /usr/sbin/http_eshell_server component. The flaw is remotely exploitable by an unauthenticated attacker, allowing for potential memory corruption and arbitrary code execution.

Business Impact

The CVSS score of 9.8 reflects a critical severity, indicating that this vulnerability poses an immediate threat to the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to full system takeover, unauthorized access to sensitive data, and complete service disruption. Given the lack of vendor response, affected organizations face significant risk of persistent, unpatched exposure.

Remediation Plan

Immediate Action: As no official patch is currently available, immediately isolate affected devices from the public internet or restrict access via strict firewall rules to trusted management networks only.

Proactive Monitoring: Monitor network traffic for unusual payloads directed at the WIRELESSCFGGET interface and review system logs for signs of unauthorized access or service crashes related to the http_eshell_server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and block malformed requests targeting the params argument in this specific interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the referenced exploitation materials.

Analyst Notes: As of Dec 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated nature and the lack of vendor-provided remediation.

Analyst Recommendation

Due to the critical nature of this buffer overflow and the lack of a vendor patch, immediate network segmentation is mandatory. Security teams must prioritize restricting access to the affected devices to prevent remote exploitation. Until a fix is released, treat these systems as high-risk assets and maintain heightened vigilance for any signs of compromise.

Description Summary:
A buffer overflow vulnerability in the WIREDCFGGET interface of Shiguangwu sgwbox N3 allows unauthenticated remote attackers to execute arbitrary code via the params argument.

Executive Summary:
A critical buffer overflow vulnerability in Shiguangwu sgwbox N3 allows for unauthenticated remote code execution, posing a severe risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14708

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: The vulnerability exists within the /usr/sbin/http_eshell_server file, specifically in the WIREDCFGGET interface, where improper handling of the params argument leads to a buffer overflow. This flaw is remotely exploitable without authentication, allowing an attacker to trigger memory corruption.

Business Impact

The exploitation of this vulnerability results in full system control, as the buffer overflow allows for unauthorized code execution. Given the CVSS score of 9.8, this represents a critical risk to data confidentiality, system integrity, and availability. Organizations using this device face a high probability of total service disruption or unauthorized data access if left unpatched.

Remediation Plan

Immediate Action: As the vendor has not provided an official patch or responsive communication, administrators should immediately restrict network access to the affected device or isolate it from the public internet.

Proactive Monitoring: Monitor system logs for unusual process crashes or unexpected traffic directed at the http_eshell_server service, which may indicate exploitation attempts.

Compensating Controls: Deploy a network-based intrusion detection system or a Web Application Firewall (WAF) with rules configured to inspect and block malicious payloads targeting the WIREDCFGGET interface.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the technical write-up linked in the vulnerability references.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit write-up significantly lowers the barrier for potential attackers to weaponize this buffer overflow.

Analyst Recommendation

Due to the critical nature of this vulnerability and the lack of a vendor-provided fix, immediate isolation of the affected hardware is the only reliable method to eliminate the risk of remote compromise. Security teams must prioritize network segmentation to prevent external access until a security update or official mitigation guidance is released by the manufacturer.

Description Summary:
A critical command injection vulnerability in Shiguangwu sgwbox N3 2.0.25 allows unauthenticated remote attackers to execute arbitrary commands via manipulation of the params argument.

Executive Summary:
The Shiguangwu sgwbox N3 2.0.25 device is vulnerable to unauthenticated remote command injection, posing a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14707

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: The vulnerability exists within the DOCKER feature, specifically in the /usr/sbin/http_eshell_server file, where improper handling of the params argument allows for remote command injection by an unauthenticated attacker.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation grants an attacker the ability to execute arbitrary system commands, which can lead to unauthorized data access, complete loss of system integrity, and potential use of the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: As there is no vendor-supplied patch currently available, immediately isolate affected sgwbox N3 devices from the public internet to prevent remote exploitation.

Proactive Monitoring: Monitor system logs for unauthorized processes spawned by the http_eshell_server binary and observe network traffic for unusual outbound requests originating from the device.

Compensating Controls: Implement strict firewall rules to restrict access to the web management interface of the sgwbox N3 to trusted IP addresses only, effectively mitigating the remote attack vector.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research write-up.

Analyst Notes: As of Dec 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of the attack details in a public write-up significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the critical nature of this vulnerability and the lack of a vendor-provided fix, users must prioritize network segmentation to neutralize the remote exploit path. Security teams should proactively restrict administrative access to these devices until an official firmware update is released and verified for deployment.

Description Summary:
A command injection vulnerability in the Shiguangwu sgwbox N3 NETREBOOT interface allows remote unauthenticated attackers to execute arbitrary system commands.

Executive Summary:
A critical command injection vulnerability in Shiguangwu sgwbox N3 allows remote, unauthenticated attackers to gain full control of the affected device.

Vulnerability Details

CVE-ID: CVE-2025-14706

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: The vulnerability exists within the /usr/sbin/http_eshell_server file of the NETREBOOT interface. An unauthenticated remote attacker can inject and execute arbitrary system commands due to insufficient input validation.

Business Impact

The ability to execute arbitrary commands remotely poses a severe risk to organizational security, potentially leading to a total compromise of the affected device. Given the CVSS score of 9.8, this vulnerability allows for unauthorized access to sensitive data, potential lateral movement within the network, and complete loss of system integrity.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, restrict network access to the management interface of the affected device to trusted IP addresses only.

Proactive Monitoring: Monitor system logs for unusual process execution or unauthorized shell activity originating from the web server interface.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block suspicious HTTP requests directed at the NETREBOOT interface that contain command injection patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the referenced security research write-up.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the nature of the affected interface.

Analyst Recommendation

Due to the critical nature of this command injection flaw and the lack of a vendor-supplied patch, immediate network isolation of the affected devices is necessary to prevent remote exploitation. Security teams should prioritize blocking access to the vulnerable interface while monitoring for any signs of unauthorized command execution.

Description Summary:
A remote command injection vulnerability exists in the SHARESERVER feature of Shiguangwu sgwbox N3 version 2.0.25, allowing unauthenticated attackers to execute arbitrary commands via the params argument.

Executive Summary:
A critical command injection vulnerability in Shiguangwu sgwbox N3 allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14705

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: This is a command injection flaw (CWE-77) triggered by improper sanitization of the params argument within the SHARESERVER component. The vulnerability is remotely exploitable by an unauthenticated attacker, requiring no prior system access to execute arbitrary commands.

Business Impact

The exploitation of this vulnerability grants an attacker full control over the affected device, leading to complete loss of confidentiality, integrity, and availability. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized data access, lateral movement within the network, or the transformation of the device into a participant in a botnet.

Remediation Plan

Immediate Action: As the vendor has not provided a patch, immediately isolate the affected device from the internet or restrict access to the SHARESERVER feature to trusted internal IP addresses only.

Proactive Monitoring: Review system and application logs for suspicious activity involving the SHARESERVER component, specifically looking for unusual shell commands or unexpected process execution.

Compensating Controls: Implement strict firewall rules to block unsolicited inbound traffic to the ports associated with the SHARESERVER feature and utilize a Web Application Firewall (WAF) to filter malicious input in the params argument.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of Dec 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication requirements and the direct path to command execution.

Analyst Recommendation

This vulnerability presents an extreme risk to the organization, particularly since the vendor has not responded to disclosure efforts. Administrators must prioritize the network isolation of all affected sgwbox N3 units immediately. Until a security update is released, the device should be treated as untrusted and removed from any internet-facing configurations to prevent potential compromise.

Description Summary:
Shiguangwu sgwbox N3 version 2.0.25 contains a path traversal vulnerability in the /eshell API component, allowing remote attackers to access unauthorized files.

Executive Summary:
A remote path traversal vulnerability in Shiguangwu sgwbox N3 version 2.0.25 poses a significant risk of unauthorized file access and information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-14704

Affected Software: Shiguangwu sgwbox N3

Affected Versions: 2.0.25

Vulnerability: This is a path traversal vulnerability (CWE-22) located in the /eshell API component. The flaw is exploitable by an unauthenticated remote attacker through direct manipulation of the affected endpoint.

Business Impact

The ability for an unauthenticated remote attacker to perform path traversal may lead to the unauthorized disclosure of sensitive configuration files, system credentials, or user data stored on the device. With a CVSS score of 7.3, this vulnerability represents a high risk to data confidentiality, potentially facilitating further network compromise or unauthorized administrative control over the affected hardware.

Remediation Plan

Immediate Action: As the vendor has not provided an official patch or responsive communication, administrators should immediately isolate the affected device from public-facing networks or disable the vulnerable /eshell API functionality if business requirements permit.

Proactive Monitoring: Monitor system logs for unusual HTTP requests targeting the /eshell path, particularly those containing directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or an edge security device to block incoming requests containing directory traversal sequences before they reach the sgwbox N3 appliance.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the technical write-up provided by the vulnerability reporter.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the confirmed existence of a public proof-of-concept and the lack of vendor response, organizations utilizing the Shiguangwu sgwbox N3 must prioritize the containment of this device. Restrict network access to the management interface and API endpoints to trusted internal segments only. Until a formal security update is released, the risk of exploitation remains high and should be managed through strict perimeter controls.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the Crafty Controller Server MOTD component allows remote unauthenticated attackers to execute malicious scripts via input manipulation.

Executive Summary:
An unauthenticated stored XSS vulnerability in Crafty Controller allows remote attackers to execute arbitrary scripts in the context of a user session, posing a significant risk to administrative integrity.

Vulnerability Details

CVE-ID: CVE-2025-14701

Affected Software: Arcadia Technology, LLC Crafty Controller

Affected Versions: 0 up to (excluding) 4.6.2

Vulnerability: This is a stored cross-site scripting (XSS) flaw categorized as CWE-79, triggered by insufficient neutralization of user-supplied input within the Server MOTD component. The vulnerability is exploitable by an unauthenticated remote attacker who can inject malicious scripts that execute when a victim views the modified MOTD.

Business Impact

Successful exploitation of this vulnerability can lead to session hijacking, unauthorized actions performed on behalf of administrators, or the theft of sensitive session tokens. With a CVSS score of 7.1, this high-severity flaw represents a substantial risk to the security posture of the Crafty Controller environment, potentially leading to a full compromise of the application interface.

Remediation Plan

Immediate Action: Upgrade to Crafty Controller version 4.6.2 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application logs for anomalous MOTD update requests or unusual script tags originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common XSS payloads and restrict access to the MOTD modification endpoint to trusted IP addresses.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the vulnerable endpoint.

Analyst Recommendation

Given the high-severity rating and the potential for unauthorized administrative access, organizations utilizing Crafty Controller should prioritize the update to version 4.6.2. Applying this patch is the only definitive way to neutralize the XSS vector and ensure the ongoing security of the application.

Description Summary:
Crafty Controller is vulnerable to remote code execution via Server Side Template Injection in the Webhook Template component, allowing an authenticated attacker to execute arbitrary system commands.

Executive Summary:
An authenticated remote code execution vulnerability in Crafty Controller version 4.6.1 poses a critical risk to system integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14700

Affected Software: Arcadia Technology, LLC Crafty Controller

Affected Versions: 4.6.1

Vulnerability: This is a Server Side Template Injection (CWE-1336) vulnerability located in the Webhook Template component. It allows a remote attacker with authenticated access to manipulate input fields to achieve remote code execution on the underlying host.

Business Impact

The ability for an authenticated user to execute arbitrary code grants them full control over the application server. Given the CVSS score of 9.9, this vulnerability represents a critical risk of complete system compromise, unauthorized data exfiltration, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade the Crafty Controller installation to version 4.6.2 or higher immediately to resolve the vulnerable template engine implementation.

Proactive Monitoring: Review application access logs for suspicious webhook configuration changes and monitor system processes for anomalous child process execution spawned by the application service.

Compensating Controls: Implement strict network segmentation and ensure the service account running Crafty Controller operates with the principle of least privilege to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Yes, multiple public proofs of concept exist on GitHub.

Analyst Notes: As of Dec 17, 2025, there is no public information indicating active exploitation in the wild, though the existence of public proof-of-concept repositories significantly lowers the barrier for potential attackers. The vulnerability is highly accessible to any user with authenticated access to the Webhook Template component.

Analyst Recommendation

Due to the critical nature of this remote code execution flaw, organizations must prioritize patching to version 4.6.2 immediately. Even though authentication is required, the potential for total system compromise necessitates swift action to prevent unauthorized access and potential data breaches.

Description Summary:
The Meta Box plugin for WordPress is susceptible to arbitrary file deletion via insufficient path validation in the ajax_delete_file function, allowing authenticated attackers to delete system files.

Executive Summary:
The Meta Box plugin for WordPress contains an arbitrary file deletion vulnerability that enables authenticated attackers to compromise server integrity and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-14675

Affected Software: Meta Box (WordPress Plugin)

Affected Versions: 0 through 5.11.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) located in the ajax_delete_file function. It allows authenticated attackers with Contributor-level access or higher to delete arbitrary files on the host server, which can be leveraged to delete critical files like wp-config.php and facilitate remote code execution.

Business Impact

The potential for arbitrary file deletion presents a high risk to business operations, as an attacker could disrupt service availability by deleting configuration files or gain unauthorized control over the WordPress environment. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the significant impact on data integrity and system availability.

Remediation Plan

Immediate Action: Update the Meta Box plugin to version 5.11.2 or later to resolve the path validation flaw.

Proactive Monitoring: Monitor server logs for unusual file deletion activity or unauthorized access attempts targeting the wp-config.php file or other sensitive directory paths.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at plugin-specific AJAX endpoints.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available.

Analyst Notes: As of March 8, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is technically straightforward to trigger for an authenticated user, there is currently no evidence of weaponized exploitation in the wild.

Analyst Recommendation

Given the severity of the potential impact, including the possibility of remote code execution, organizations should prioritize updating the Meta Box plugin immediately. Ensure that user roles are strictly managed, as this vulnerability requires at least Contributor-level access to exploit. Regular updates and adherence to the principle of least privilege remain the most effective defenses against such plugin-based threats.

Description Summary:
A heap-based buffer overflow exists in the snap7-rs client library, specifically within the S7Client::as_ct_write function, allowing for potential remote exploitation.

Executive Summary:
A heap-based buffer overflow vulnerability in the gmg137 snap7-rs library enables unauthenticated remote attackers to trigger memory corruption, posing a significant risk to affected systems.

Vulnerability Details

CVE-ID: CVE-2025-14673

Affected Software: gmg137 snap7-rs

Affected Versions: 1.142.0, 1.142.1

Vulnerability: This vulnerability is a heap-based buffer overflow (CWE-122) triggered within the snap7_rs::client::S7Client::as_ct_write function. The flaw allows an unauthenticated remote attacker to cause memory corruption by manipulating input processed by the library.

Business Impact

Successful exploitation of this memory corruption vulnerability could lead to application crashes or potentially arbitrary code execution, depending on the memory layout. With a CVSS score of 7.3, this issue represents a High severity risk that could lead to service disruption or unauthorized control over the host process.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should monitor the official repository for updates and restrict network access to any applications utilizing this library.

Proactive Monitoring: Security teams should review application logs for abnormal crashes or memory access violations that may indicate exploitation attempts.

Compensating Controls: Deploy network-level traffic filtering to prevent unauthorized or untrusted entities from interacting with services utilizing the vulnerable snap7-rs library.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the vendor issue tracker (https://gitee.com/gmg137/snap7-rs/issues/ID2H74).

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for remote memory corruption without requiring prior authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote execution, this vulnerability requires immediate attention. Organizations should identify all deployments of the snap7-rs library and implement rigorous network segmentation until a verified vendor patch is released and applied.

Description Summary:
A heap-based buffer overflow vulnerability exists in the snap7-rs library, specifically within the TSnap7MicroClient::opWriteArea function, which allows for remote exploitation.

Executive Summary:
A heap-based buffer overflow in the gmg137 snap7-rs library poses a significant risk as it allows for remote exploitation of memory corruption.

Vulnerability Details

CVE-ID: CVE-2025-14672

Affected Software: gmg137 snap7-rs

Affected Versions: 1.142.0, 1.142.1

Vulnerability: The vulnerability is a heap-based buffer overflow (CWE-122) located in the TSnap7MicroClient::opWriteArea function of s7_micro_client.cpp. This flaw can be triggered by an unauthenticated remote attacker to cause memory corruption.

Business Impact

Successful exploitation of this vulnerability can lead to memory corruption, potentially resulting in application instability, denial of service, or arbitrary code execution. Given the CVSS score of 7.3, this is classified as a High severity issue that could compromise the integrity and availability of systems relying on this library.

Remediation Plan

Immediate Action: Monitor the vendor repository for the release of a patched version of the snap7-rs library and update immediately upon availability.

Proactive Monitoring: Review application logs for abnormal crashes or unexpected behavior in processes utilizing the snap7-rs library.

Compensating Controls: Implement network-level access controls to restrict traffic to the affected service, effectively reducing the exposure of the vulnerable TSnap7MicroClient interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced Gitee issue tracker.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it is reachable via remote, unauthenticated network vectors.

Analyst Recommendation

This vulnerability represents a significant risk due to the presence of a published proof-of-concept and the potential for remote memory corruption. Organizations using the gmg137 snap7-rs library should prioritize monitoring the project for a security patch and ensure that network segmentation is applied to limit the attack surface until a fix is deployed.

Description Summary:
Campcodes Advanced Online Examination System 1.0 is vulnerable to unauthenticated SQL injection via the username parameter in the loginExe.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Advanced Online Examination System 1.0 allows unauthenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-14668

Affected Software: Campcodes Advanced Online Examination System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /query/loginExe.php file. An unauthenticated attacker can supply malicious input via the username POST parameter to manipulate backend database queries.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the application database, which may result in sensitive data leakage, data tampering, or total system compromise. Given the CVSS score of 7.3 and the unauthenticated nature of the attack vector, this flaw represents a significant risk to the confidentiality and integrity of student and administrative data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the login portal via network-level controls or disable the application until a secure version is released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to /query/loginExe.php, specifically identifying patterns associated with SQL injection payloads, such as time-based sleep commands or SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it requires no prior authentication to execute.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an elevated risk. Organizations currently utilizing Campcodes Advanced Online Examination System 1.0 must prioritize isolating the affected server from public networks and implementing strict input validation or WAF rules to prevent unauthorized database access while awaiting a vendor-supplied update.

Description Summary:
A SQL injection vulnerability in the itsourcecode COVID Tracking System 1.0 allows remote attackers to execute arbitrary SQL commands via the meta_value parameter.

Executive Summary:
The itsourcecode COVID Tracking System 1.0 is vulnerable to unauthenticated SQL injection, posing a critical risk of database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-14667

Affected Software: itsourcecode COVID Tracking System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/?page=system_info endpoint. The application fails to sanitize the meta_value parameter, allowing an unauthenticated remote attacker to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to gain unauthorized access to the underlying database. This can lead to sensitive data leakage, unauthorized data modification or deletion, and potential full system compromise, resulting in significant business disruption and reputational damage. While the CVSS score is 7.3, the ability for unauthenticated remote attackers to manipulate backend queries elevates the urgency of this finding.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative interface immediately.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for time-based blind SQL injection payloads containing sleep commands or unusual characters in the meta_value field.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious SQL injection patterns targeting the /admin/?page=system_info endpoint.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the linked GitHub security issue.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the severity of SQL injection and the public availability of a proof-of-concept, this vulnerability must be treated as a high priority. Organizations using the COVID Tracking System should implement strict access controls and WAF rules immediately, as no vendor-provided patch exists to resolve the underlying code defect.

Description Summary:
A SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the username parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode COVID Tracking System 1.0 poses a critical risk of full database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-14666

Affected Software: itsourcecode COVID Tracking System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) because it fails to properly sanitize the username parameter within the /admin/?page=user endpoint. This flaw allows an unauthenticated remote attacker to manipulate database queries to extract, modify, or delete sensitive information.

Business Impact

Successful exploitation allows an attacker to bypass authentication and gain unauthorized access to the underlying database. This could lead to a complete loss of confidentiality, integrity, and availability for the system, resulting in significant data leakage and potential disruption of critical tracking operations. Given the CVSS score of 7.3, this vulnerability represents a high-severity risk to organizational data security.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the application or take the system offline until the code can be manually hardened.

Proactive Monitoring: Review web server and database access logs for suspicious patterns, such as unexpected time-based delays or anomalous SQL syntax, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication to trigger the malicious payload.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations utilizing the COVID Tracking System 1.0 must prioritize implementing network-level restrictions and WAF filtering to prevent exploitation while awaiting a permanent software update from the vendor.

Description Summary:
A stack-based buffer overflow in the Tenda WH450 router allows remote, unauthenticated attackers to execute arbitrary code or cause a denial of service via the page parameter in /goform/DhcpListClient.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda WH450 firmware version 1.0.0.18 allows unauthenticated remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-14665

Affected Software: Tenda WH450

Affected Versions: 1.0.0.18

Vulnerability: The device suffers from a stack-based buffer overflow in the HTTP request handler for the /goform/DhcpListClient endpoint. By sending a crafted request with an excessively long page parameter, an unauthenticated attacker can corrupt memory to trigger a crash or achieve arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to take full control of the affected networking device. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized access to internal network traffic, lateral movement, or complete loss of router functionality, resulting in significant operational downtime.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict administrative access to the device to trusted management interfaces only and disable remote management features.

Proactive Monitoring: Security teams should monitor network traffic for anomalous HTTP GET requests directed at the /goform/DhcpListClient endpoint, specifically those containing unusually large strings in the page parameter.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System to filter and drop requests containing malformed or oversized parameters sent to the router interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research write-up on GitHub.

Analyst Notes: As of December 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional exploit script significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public exploit, necessitates immediate action to isolate the device from public internet exposure. Until the vendor provides a firmware update to address this buffer overflow, administrators must prioritize the implementation of compensating controls and restrict access to the management interface.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to SQL injection via the chkId[] parameter in /admin/view_unit.php, allowing unauthenticated remote attackers to compromise the database.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated attackers to execute arbitrary database queries, posing a severe risk to data integrity and system confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14664

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the chkId[] parameter within the /admin/view_unit.php file before using it in SQL queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access.

Business Impact

Successful exploitation permits attackers to bypass security controls to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this vulnerability represents a high risk that could lead to full database compromise, unauthorized administrative actions, and significant business disruption.

Remediation Plan

Immediate Action: As no official vendor patch is currently identified, administrators should restrict access to the affected endpoint at the network or web server level. Disable the vulnerable functionality if it is not business-critical until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /admin/view_unit.php, specifically monitoring for anomalous character strings or time-based delay patterns indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters. Additionally, ensure the application connects to the database using an account with the least privilege necessary to limit the potential impact of an exploit.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it requires no authentication and targets a common injection vector.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using Campcodes Supplier Management System should prioritize implementing the suggested compensating controls immediately to prevent unauthorized database access while awaiting further guidance or a patch from the vendor.

Description Summary:
A SQL injection vulnerability exists in the itsourcecode Student Management System version 1.0, specifically within the /advisers.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Student Management System version 1.0 poses a severe risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14661

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection via the 'sy' parameter in the /advisers.php file. The vulnerability is accessible to unauthenticated remote attackers because the application fails to properly sanitize user input before incorporating it into database queries.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the underlying database. This could lead to unauthorized access to sensitive student or administrative data, potential data modification or deletion, and in some configurations, full system compromise. With a CVSS score of 7.3, this issue represents a high-severity risk to confidentiality, integrity, and availability that requires immediate attention.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the affected /advisers.php file if it is not business-critical.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, specifically those containing SQL syntax or unusual characters in the 'sy' GET parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the researcher's technical write-up on GitHub.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability should be treated with high priority. Organizations using the itsourcecode Student Management System must implement the suggested compensating controls immediately, as a vendor patch is not currently available. Continuous monitoring for unauthorized database activity is essential until a formal fix can be applied.

Description Summary:
A command injection vulnerability in the D-Link DIR-860LB1 and DIR-868LB1 DHCP Daemon allows remote attackers to execute arbitrary commands by manipulating the Hostname argument.

Executive Summary:
A remote command injection vulnerability in D-Link routers presents a critical risk, as it allows unauthenticated or low-privileged attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2025-14659

Affected Software: D-Link DIR-860LB1 and DIR-868LB1

Affected Versions: DIR-860LB1 (203b01, 203b03), DIR-868LB1 (203b01, 203b03)

Vulnerability: The flaw exists within the DHCP Daemon component of the affected routers. By injecting malicious input into the Hostname argument, an attacker can achieve remote command execution on the underlying operating system.

Business Impact

Successful exploitation of this vulnerability allows for complete system compromise, potentially leading to unauthorized network access, data exfiltration, or the inclusion of the device in a botnet. With a CVSS score of 8.8, this vulnerability is considered highly severe, as it provides an attacker with the ability to execute arbitrary code remotely without requiring complex interaction.

Remediation Plan

Immediate Action: Since no official patch is currently available, immediately restrict access to the web management interface and disable the DHCP service if it is not strictly required. Monitor for vendor announcements regarding security firmware updates.

Proactive Monitoring: Review system logs for unusual DHCP traffic or unexpected hostname patterns that may indicate exploitation attempts. Monitor outbound network traffic for suspicious connections originating from these devices.

Compensating Controls: Implement firewall rules to block external access to the router management interfaces and the DHCP daemon. Utilize a network-based intrusion detection system to monitor for known command injection signatures targeting these specific D-Link models.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's technical write-up linked in the references.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the DHCP daemon.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for full system compromise, this vulnerability poses a significant risk to network integrity. Organizations should isolate affected D-Link devices from the public internet immediately and maintain a heightened state of vigilance until the vendor provides a security update.

Description Summary:
The Eventin WordPress plugin is vulnerable to unauthorized setting modification and stored cross-site scripting due to missing authorization checks in versions 4.0.51 and below.

Executive Summary:
The Eventin WordPress plugin contains an unauthenticated authorization bypass and script injection flaw that allows attackers to modify plugin settings and execute arbitrary code in victim browsers.

Vulnerability Details

CVE-ID: CVE-2025-14657

Affected Software: Arraytics Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)

Affected Versions: 0 through 4.0.51

Vulnerability: The plugin lacks a capability check on the post_settings function, allowing unauthenticated attackers to modify plugin configurations. Furthermore, the etn_primary_color setting fails to sanitize input, enabling unauthenticated attackers to inject malicious JavaScript that executes when administrative or public pages load the plugin styles.

Business Impact

Successful exploitation allows an unauthenticated attacker to alter site event management settings and inject malicious scripts. This poses a significant risk of site defacement, unauthorized redirection of users, and potential administrative account takeover via session theft. With a CVSS score of 7.2, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized site control.

Remediation Plan

Immediate Action: Update the Eventin plugin to the latest available version, which includes the necessary authorization checks and input sanitization, as indicated in the vendor changelog.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugin's API endpoints and monitor for unexpected changes to plugin configuration settings.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized requests to the plugin's configuration endpoints and filter out common script injection patterns in HTTP request parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is technically straightforward due to the lack of authentication, no weaponized exploit code has been identified in public repositories.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication for critical administrative actions. IT administrators should prioritize updating the Eventin plugin across all WordPress instances immediately. If an update cannot be performed promptly, the plugin should be deactivated until a secure version is deployed to eliminate the exposure window.

Description Summary:
A buffer overflow vulnerability exists in the Tenda AC20 router firmware version 16.03.08.12 within the /goform/openSchedWifi function, potentially allowing for remote denial of service or execution.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC20 routers allows authenticated attackers to trigger a denial of service or potentially achieve remote command execution.

Vulnerability Details

CVE-ID: CVE-2025-14656

Affected Software: Tenda AC20

Affected Versions: 16.03.08.12

Vulnerability: The vulnerability resides in the httpd binary within the /goform/openSchedWifi endpoint, where improper handling of the schedStartTime and schedEndTime parameters leads to a heap-based buffer overflow. While the CVSS vector indicates low privilege requirements, the attack is performed remotely by an authenticated user.

Business Impact

Successful exploitation of this flaw can result in a complete denial of service for the affected router, disrupting network connectivity for all dependent users and devices. Furthermore, the potential for remote code execution poses a severe risk of unauthorized system access, data theft, and the establishment of persistent backdoors within the local network, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: As no official patch is currently listed, users should restrict administrative access to the router interface and disable the affected Wi-Fi scheduling feature if it is not strictly required.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed toward the /goform/openSchedWifi endpoint and investigate logs for unexpected router reboots or service crashes.

Compensating Controls: Implement strict firewall rules to ensure the router management interface is not accessible from untrusted networks or the public internet.

Exploitation Status

Public Exploit Available: Yes, a proof of concept is available via the linked research writeup on GitHub.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking in the affected binary.

Analyst Recommendation

Given the availability of a functional proof of concept and the potential for remote code execution, this vulnerability represents a significant security risk. Administrators must prioritize isolating the management interface of affected Tenda devices from external access and monitor for vendor updates to address this memory corruption flaw as soon as they become available.

Description Summary:
A stack-based buffer overflow in the Tenda AC20 router allows remote attackers to trigger denial-of-service or arbitrary code execution via the rebootTime parameter.

Executive Summary:
A high-severity buffer overflow vulnerability in the Tenda AC20 router exposes the device to remote code execution and denial-of-service attacks.

Vulnerability Details

CVE-ID: CVE-2025-14655

Affected Software: Tenda AC20 Router

Affected Versions: 16.03.08.12

Vulnerability: This is a stack-based buffer overflow (CWE-121) located in the formSetRebootTimer function of the /goform/SetSysAutoRebbotCfg endpoint. An authenticated attacker can trigger this memory corruption by sending a crafted rebootTime parameter to the httpd service.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high risk to operational continuity and system integrity. Successful exploitation allows an attacker to execute arbitrary commands on the router, potentially resulting in full system compromise, persistent unauthorized access, or complete denial-of-service of the network infrastructure.

Remediation Plan

Immediate Action: Disconnect the affected Tenda AC20 router from public-facing networks and check the official Tenda support website for firmware updates addressing this memory corruption flaw.

Proactive Monitoring: Review web access logs for POST requests directed at /goform/SetSysAutoRebbotCfg that contain unusually long or malformed rebootTime parameter values.

Compensating Controls: Implement strict access control lists on the management interface to ensure only authorized administrative IP addresses can communicate with the router's web server.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up referenced by the CVE record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, and the vulnerability is inherently exploitable via a simple HTTP POST request. The lack of input validation in the httpd binary makes this an attractive target for automated scanning and exploitation.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the potential for remote code execution, this vulnerability poses a significant threat to internal network security. Administrators must prioritize applying firmware patches as soon as they become available and restrict management access to the device to prevent unauthorized exploitation attempts.

Description Summary:
A stack-based buffer overflow exists in the Tenda AC20 router firmware, specifically within the formSetPPTPUserList function, allowing remote attackers to trigger memory corruption.

Executive Summary:
A remote buffer overflow vulnerability in the Tenda AC20 router can lead to unauthorized command execution and denial of service.

Vulnerability Details

CVE-ID: CVE-2025-14654

Affected Software: Tenda AC20

Affected Versions: 16.03.08.12

Vulnerability: This vulnerability is a stack-based buffer overflow occurring in the formSetPPTPUserList function within the httpd binary. An attacker with low-level privileges can supply a malicious input via the list parameter to the /goform/setPptpUserList endpoint, resulting in memory corruption and potential arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to network integrity and availability. An attacker achieving remote code execution could gain full control over the router, facilitating man-in-the-middle attacks, lateral movement within the internal network, or permanent denial of service. Given the CVSS score of 8.8, this flaw represents a significant threat to organizational security posture.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately isolate the management interface of affected Tenda AC20 routers from the public internet or untrusted networks.

Proactive Monitoring: Monitor device logs for repeated segmentation faults or unusual POST requests directed at the /goform/setPptpUserList endpoint.

Compensating Controls: Implement strict firewall rules or Access Control Lists (ACLs) to restrict access to the web management interface to trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in a technical write-up referenced by the CVE record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the list parameter during the sscanf operation.

Analyst Recommendation

The severity of this memory corruption flaw necessitates immediate defensive action. Organizations relying on the Tenda AC20 router must restrict administrative access to mitigate the risk of remote exploitation until the vendor releases a firmware update. Continuous monitoring of network traffic for exploitation attempts is advised until a vendor-supplied patch is successfully applied.

Description Summary:
The itsourcecode Student Management System 1.0 is vulnerable to SQL injection via the id parameter in addrecord.php, allowing unauthenticated remote attackers to compromise the database.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Student Management System 1.0 allows remote attackers to execute arbitrary database queries, posing a critical risk to data integrity and system availability.

Vulnerability Details

CVE-ID: CVE-2025-14653

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input provided to the id parameter in the /addrecord.php file, resulting in a classic SQL injection vulnerability. This flaw can be exploited by an unauthenticated attacker to manipulate backend database queries.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to perform unauthorized database operations, including data exfiltration, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of student records managed by the system. Failure to address this could lead to major data breaches and potential regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /addrecord.php endpoint via network-level controls or web server configurations until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting addrecord.php, specifically looking for payloads containing SQL syntax characters such as single quotes, UNION statements, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

The presence of a functional proof-of-concept necessitates immediate defensive action. Administrators should prioritize isolating the vulnerable Student Management System from public-facing networks and implement strict input validation or WAF-based filtering to prevent exploitation while awaiting a formal security update from the vendor.

Description Summary:
A critical SQL injection vulnerability in the Online Cake Ordering System allows unauthenticated remote attackers to execute arbitrary SQL commands via the id parameter in admindetail.php.

Executive Summary:
The Online Cake Ordering System is vulnerable to unauthenticated SQL injection, which may allow remote attackers to compromise the underlying database and gain complete control over the application.

Vulnerability Details

CVE-ID: CVE-2025-14652

Affected Software: itsourcecode Online Cake Ordering System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /cakeshop/admindetail.php file. The application fails to sanitize the id parameter during edit actions, allowing an unauthenticated attacker to manipulate database queries via crafted GET requests.

Business Impact

Successful exploitation allows an attacker to bypass authentication, extract sensitive user information, modify or delete database records, and potentially achieve full system compromise. Given the CVSS score of 7.3, this represents a high-risk security flaw that could lead to significant data breaches and total loss of confidentiality, integrity, and availability of the ordering system.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /cakeshop/admindetail.php endpoint or take the application offline until code-level sanitization is implemented.

Proactive Monitoring: Review web server and database logs for anomalous activity, specifically looking for SQL syntax errors or unexpected patterns in GET requests directed at the admindetail.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the id parameter in GET requests.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to trigger, as it requires no authentication and targets a standard parameter via a simple HTTP GET request.

Analyst Recommendation

Due to the ease of exploitation and the lack of a vendor-provided patch, this vulnerability poses a severe threat to any environment running the Online Cake Ordering System. Organizations should prioritize implementing strict input validation or removing the vulnerable component from public access immediately to prevent unauthorized database manipulation.

Description Summary:
A SQL injection vulnerability in itsourcecode Online Cake Ordering System 1.0 allows unauthenticated remote attackers to manipulate the product parameter in product.php to execute malicious queries.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Online Cake Ordering System 1.0 permits unauthenticated attackers to gain unauthorized database access and potentially achieve full system control.

Vulnerability Details

CVE-ID: CVE-2025-14650

Affected Software: itsourcecode Online Cake Ordering System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the product parameter in the /cakeshop/product.php file, allowing unauthenticated remote attackers to inject malicious SQL commands. This flaw permits the manipulation of database queries, which can lead to unauthorized data extraction, modification, or deletion.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain direct access to the backend database. This risk includes the potential for sensitive data exfiltration, total loss of data integrity, and service disruption. While the CVSS score is 7.3, the ability for an unauthenticated attacker to perform these actions poses a severe threat to the confidentiality and availability of the organization’s business data.

Remediation Plan

Immediate Action: As no vendor patch is currently available, administrators should restrict network access to the application and implement strict input validation at the Web Application Firewall level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /cakeshop/product.php containing SQL syntax characters, such as single quotes, semicolons, or time-based sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block SQL injection patterns specifically targeting the product parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any environment hosting this software. Organizations should prioritize isolating the affected system from public-facing networks until the vendor provides a secure update or the codebase is remediated by implementing prepared statements and rigorous input filtering.

Description Summary:
A SQL injection vulnerability in the Online Cake Ordering System 1.0 allows unauthenticated attackers to execute arbitrary database queries via the supplier parameter in /cakeshop/supplier.php.

Executive Summary:
The Online Cake Ordering System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-14649

Affected Software: itsourcecode Online Cake Ordering System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /cakeshop/supplier.php file. The application fails to sanitize the supplier POST parameter, allowing an unauthenticated attacker to manipulate database queries.

Business Impact

Successful exploitation of this flaw can lead to unauthorized access to sensitive application data, potential data exfiltration, and full database compromise. Given the CVSS score of 7.3, this vulnerability poses a significant risk to the integrity and confidentiality of the system, potentially resulting in complete service disruption or the exposure of customer information stored in the backend database.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the /cakeshop/supplier.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to /cakeshop/supplier.php, specifically looking for SQL syntax patterns or time-based delay functions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the supplier parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the absence of a vendor-provided patch, users of the Online Cake Ordering System 1.0 must prioritize manual mitigation. Given the availability of public proof-of-concept code and the ease of exploitation, immediate network-level blocking or disabling of the vulnerable component is necessary to prevent potential database compromise.

Description Summary:
A SQL injection vulnerability exists in Computer Book Store 1.0, specifically within the /admin_delete.php file, allowing remote unauthenticated attackers to manipulate the bookisbn argument.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in code-projects Computer Book Store 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-14647

Affected Software: code-projects Computer Book Store

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered via the bookisbn parameter in the /admin_delete.php file. The vulnerability is remotely exploitable without requiring authentication (PR:N).

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database. This could lead to unauthorized data exposure, modification of records, or potential bypass of application logic. Given the CVSS score of 7.3, this represents a high-severity risk to the integrity and confidentiality of the store application.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected /admin_delete.php endpoint or disable the vulnerable component entirely.

Proactive Monitoring: Review web server and database logs for suspicious SQL syntax or patterns indicating injection attempts, such as UNION SELECT statements or unexpected character encoding.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the bookisbn parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its lack of authentication requirements and direct interaction with the database layer.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations should prioritize isolating the affected application from public-facing networks until a vendor-supplied security update is released and applied.

Description Summary:
A SQL injection vulnerability in the Student File Management System 1.0 allows remote attackers to manipulate the stud_id argument in the delete_student.php file.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Student File Management System 1.0 permits unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-14646

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) via the stud_id parameter in the /admin/delete_student.php file, which can be triggered by an unauthenticated remote attacker.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to student records, modification of administrative data, or complete database compromise. With a CVSS score of 7.3, this flaw is categorized as high severity and requires immediate attention to prevent potential data breaches.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and evaluate the necessity of the Student File Management System until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the delete_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger the injection point.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to the affected environment. Organizations currently running version 1.0 of the Student File Management System should isolate the application from the public internet immediately and monitor for unauthorized database activity until a vendor-supplied patch is deployed.

Description Summary:
A SQL injection vulnerability exists in the Student File Management System version 1.0, specifically within the admin delete user function, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Student File Management System 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-14645

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the delete_user.php file within the admin directory. An unauthenticated remote attacker can manipulate the user_id argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject SQL commands poses a severe risk to the confidentiality and integrity of the application data. Successful exploitation could lead to unauthorized access to user records, sensitive information disclosure, or potential administrative account takeover, justifying the CVSS score of 7.3.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the /admin/delete_user.php file, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the researcher's GitHub issue report.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to reach the vulnerable code path.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a significant risk to affected installations. Organizations must prioritize immediate network-level access controls to shield the vulnerable endpoint until a formal security update is released by the developer.

Description Summary:
An unauthenticated SQL injection vulnerability exists in the Student Management System 1.0 via the id parameter in update_subject.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Student Management System 1.0 poses a critical risk of database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-14644

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /update_subject.php file, where the application fails to sanitize the id parameter. An unauthenticated attacker can supply malicious input to this parameter to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to sensitive database information, potentially leading to full data leakage, data tampering, or unauthorized administrative control over the application. With a CVSS score of 7.3, this flaw represents a significant security risk that could lead to complete service disruption and compromise of institutional student records.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /update_subject.php endpoint at the network or web server level.

Proactive Monitoring: Security teams should audit database logs for unusual query patterns, particularly those originating from the /update_subject.php file, and monitor web server logs for suspicious POST requests containing SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub research repository linked in the vulnerability references.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability must be treated with high urgency. Administrators are advised to implement strict input validation or block access to the vulnerable endpoint until a formal vendor update is released and applied.

Description Summary:
A SQL injection vulnerability exists in the Simple Attendance Record System 2.0 due to improper input sanitization in the check.php file.

Executive Summary:
The Simple Attendance Record System 2.0 is vulnerable to an unauthenticated SQL injection attack that could allow unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-14643

Affected Software: code-projects Simple Attendance Record System

Affected Versions: 2.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) located in the check.php file. An unauthenticated attacker can supply a malicious payload via the student parameter, which is concatenated directly into a database query without validation.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. This may lead to the unauthorized disclosure of sensitive student records, modification of attendance data, or potential compromise of the database server. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant data integrity loss and potential system-wide compromise.

Remediation Plan

Immediate Action: As no official patch is available, administrators should immediately restrict access to the affected web application or take it offline until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for anomalous HTTP POST requests to check.php containing SQL-related characters or suspicious string patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in incoming requests to the student parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher write-up published on GitHub.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently easy to exploit as it requires no authentication and targets a simple, unvalidated parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to any deployment of the Simple Attendance Record System 2.0. Organizations should prioritize isolating the affected component and implementing robust input validation or WAF protections to mitigate the risk until an official patch is provided by the vendor.

Description Summary:
The Student File Management System 1.0 contains an SQL injection vulnerability in the save_student.php script, allowing remote attackers to manipulate the stud_no parameter.

Executive Summary:
A remote SQL injection vulnerability in the Student File Management System 1.0 poses a significant risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-14640

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the admin/save_student.php file. An unauthenticated remote attacker can inject malicious SQL commands via the stud_no argument to compromise the backend database.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands could lead to unauthorized data exfiltration, modification of student records, or total compromise of the application database. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential service disruption and loss of sensitive academic data.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the administrative interface and the specific vulnerable script.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/save_student.php, specifically looking for characters indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious SQL syntax within the stud_no parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue (https://github.com/jjjjj-zr/jjjjjzr14/issues/1).

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a credible threat to any deployment of the Student File Management System 1.0. Organizations should prioritize isolating the affected system until a formal security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Student Management System 1.0 /uprec.php file, allowing unauthenticated remote attackers to manipulate the ID parameter and execute unauthorized queries.

Executive Summary:
The itsourcecode Student Management System 1.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14639

Affected Software: itsourcecode Student Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input provided via the id parameter in the /uprec.php file. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Business Impact

Successful exploitation of this SQL injection flaw grants an attacker the ability to perform unauthorized database operations, including data exfiltration, modification, or deletion. Given the nature of a Student Management System, this could result in the exposure of sensitive student records and credentials, severe reputational damage, and potential violation of data privacy regulations. While the CVSS score of 7.3 reflects a high severity, the lack of required authentication makes this an immediate priority for remediation.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /uprec.php endpoint or disable the affected module entirely if it is not business critical.

Proactive Monitoring: Review web server and database logs for anomalous POST requests to /uprec.php, specifically searching for SQL syntax patterns like SLEEP, UNION, or OR 1=1.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to filter and block malicious SQL injection payloads targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's write-up on GitHub.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires zero authentication and targets a standard POST parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any exposed installation of the Student Management System. Administrators must treat this as a high-priority item by implementing WAF filtering or network-level access controls immediately until a secure version or official patch is released by the vendor.

Description Summary:
A SQL injection vulnerability in the Online Pet Shop Management System 1.0 allows unauthenticated remote attackers to execute arbitrary database queries via the id parameter in /pet1/update_cnp.php.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Online Pet Shop Management System 1.0 allows unauthenticated remote attackers to compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-14638

Affected Software: itsourcecode Online Pet Shop Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /pet1/update_cnp.php file. An unauthenticated attacker can supply malicious input to the id parameter, which is processed by the application without sufficient validation, allowing for unauthorized manipulation of backend database queries.

Business Impact

Successful exploitation of this vulnerability poses a severe threat to business operations, as it enables unauthorized access to the underlying database. Attackers could leak sensitive customer or system data, perform unauthorized data modifications, or cause significant service disruption. Given the CVSS score of 7.3, this represents a high-risk security gap that requires immediate attention to maintain data confidentiality and system integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected /pet1/update_cnp.php endpoint or take the application offline until the vendor releases a secure version.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected time-based delays associated with the id parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub research write-up referenced by the CVE record.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it does not require authentication or elevated privileges.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates prompt defensive action. Organizations using the Online Pet Shop Management System should prioritize restricting access to the vulnerable endpoint immediately and seek to replace the software if no vendor-provided security update is forthcoming.

Description Summary:
The itsourcecode Online Pet Shop Management System 1.0 contains a SQL injection vulnerability in the cnpname argument within the /pet1/addcnp.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Online Pet Shop Management System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-14637

Affected Software: itsourcecode Online Pet Shop Management System

Affected Versions: 1.0

Vulnerability: The software is susceptible to SQL injection via the cnpname parameter in the /pet1/addcnp.php file. This vulnerability is accessible to unauthenticated remote attackers who can manipulate the input to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL queries represents a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive pet shop data, database manipulation, or potential exfiltration of user information. With a CVSS score of 7.3, this vulnerability requires immediate attention to prevent unauthorized system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /pet1/addcnp.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /pet1/addcnp.php, specifically looking for characters indicative of SQL injection attempts such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection patterns specifically targeting the cnpname parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the research write-up at https://github.com/sec-dreamer/vulpxnPolm/issues/1.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly dangerous due to its remote, unauthenticated nature and the existence of public exploit code.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation via remote network access, organizations utilizing this software must prioritize mitigation immediately. Since a formal vendor patch is not confirmed, strict input validation or the removal of the vulnerable component is necessary to secure the environment against potential attackers.

Description Summary:
A SQL injection vulnerability exists in the student file management system due to improper sanitization of the stud_id argument within the update_student.php file.

Executive Summary:
The code-projects Student File Management System 1.0 is vulnerable to unauthenticated remote SQL injection, which could allow attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-14623

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) located in the /admin/update_student.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the stud_id argument.

Business Impact

The exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive student records, potential data modification, or the compromise of the underlying database integrity. With a CVSS score of 7.3, this represents a high-severity risk that could lead to significant data exposure and loss of confidentiality within the management system.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns in the stud_id parameter, particularly strings containing SQL keywords or special characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns targeting the update_student.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger the injection.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a credible threat to the integrity of the Student File Management System. Administrators must prioritize limiting exposure by restricting access to the administrative interface and implementing strict input validation or WAF protections until a vendor-supplied patch is released.

Description Summary:
A SQL injection vulnerability exists in the student file management system due to improper input sanitization in the firstname argument of the save_user.php file.

Executive Summary:
A critical SQL injection vulnerability in code-projects Student File Management System 1.0 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-14622

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/save_user.php file. The application fails to properly sanitize the firstname argument, allowing an unauthenticated remote attacker to execute malicious SQL queries against the underlying database.

Business Impact

The ability to perform unauthenticated SQL injection poses a significant risk to data confidentiality, integrity, and availability. An attacker could potentially extract sensitive student data, modify administrative records, or bypass authentication mechanisms. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized access and potential system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory to trusted internal IP addresses only. If the functionality is not business-critical, disable the student file management system until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting /admin/save_user.php, specifically looking for SQL syntax patterns or unexpected character strings in the firstname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in incoming traffic.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher write-up at https://github.com/jjjjj-zr/jjjjjzr5/issues/1.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it does not require authentication and targets a common administrative endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate threat to the confidentiality of stored records. Organizations running version 1.0 must prioritize the implementation of compensating controls, such as WAF filtering or network-level access restrictions, until the vendor provides a remediation patch.

Description Summary:
A SQL injection vulnerability in the Student File Management System 1.0 allows remote, unauthenticated attackers to manipulate the user_id argument in /admin/update_user.php.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Student File Management System 1.0 exposes the application to remote, unauthenticated data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-14621

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the user_id parameter within the /admin/update_user.php script. This flaw permits an unauthenticated remote attacker to inject malicious SQL commands, potentially compromising the integrity of the backend database.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk to organizational data integrity. Successful exploitation could allow an attacker to bypass authentication, extract sensitive information, or modify database records, leading to potential service disruption and unauthorized access to student records.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/update_user.php endpoint or disable the affected module until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected character strings targeting the user_id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts against the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of the flaw makes it highly accessible to automated scanning tools.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability poses a significant risk to affected systems. Organizations should prioritize isolating the vulnerable component from public-facing networks and implement strict input validation via WAF filtering to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability in the Student File Management System 1.0 allows remote, unauthenticated attackers to manipulate the Username argument in the /admin/login_query.php file.

Executive Summary:
The code-projects Student File Management System version 1.0 is vulnerable to an unauthenticated SQL injection attack, posing a significant risk to database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14620

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/login_query.php script. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the Username parameter to interact directly with the backend database.

Business Impact

Successful exploitation of this vulnerability permits unauthorized interaction with the application database, which may lead to data exfiltration, unauthorized administrative access, or complete compromise of the student record system. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant reputational damage and a breach of sensitive user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/login_query.php endpoint and implement strict input validation on all login fields.

Proactive Monitoring: Monitor server access logs for anomalous SQL syntax or unexpected character sequences originating from the login page, and audit database query logs for unauthorized activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login authentication flow.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up found at the provided GitHub reference.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote nature and the ease with which SQL injection can be automated.

Analyst Recommendation

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing this software should immediately restrict access to the affected login interface or move the application behind a robust WAF to prevent potential exploitation until a permanent security update is provided by the vendor.

Description Summary:
The Student File Management System 1.0 is vulnerable to unauthenticated SQL injection via the stud_no parameter in login_query.php, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the Student File Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-14619

Affected Software: code-projects Student File Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection through the stud_no argument in the login_query.php file. This flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized disclosure or manipulation of sensitive student data stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant reputational damage, loss of data integrity, and potential non-compliance with data privacy regulations.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application or take the system offline until a secure version is released.

Proactive Monitoring: Review application and database logs for anomalous input patterns, particularly unusual characters or SQL syntax in the stud_no parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the login_query.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of December 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization in the login process.

Analyst Recommendation

The presence of a public proof-of-concept elevates the urgency of this advisory. Organizations currently running the Student File Management System 1.0 must prioritize the implementation of compensating controls or network isolation to prevent unauthorized database access. Monitor vendor channels closely for the release of a security update and apply it immediately upon availability.

Description Summary:
Gladinet CentreStack and Triofox versions prior to 16.12.10420.56791 contain a hardcoded cryptographic vulnerability that allows unauthenticated attackers to perform local file inclusion.

Executive Summary:
This critical vulnerability in Gladinet CentreStack and Triofox is currently being exploited in the wild and enables unauthenticated attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14611

Affected Software: Gladinet CentreStack and Triofox

Affected Versions: Gladinet CentreStack and TrioFox: 0 up to (excluding) 16.12.10420.56791

Vulnerability: The software utilizes hardcoded values for its AES cryptographic implementation, which allows an unauthenticated attacker to supply specially crafted requests to achieve local file inclusion. This flaw can be chained with other vulnerabilities to facilitate unauthorized system access and full compromise.

Business Impact

Successful exploitation poses a severe risk to organizational security, as it allows unauthenticated remote attackers to read sensitive configuration files and potentially execute arbitrary code. Given the CVSS score of 9.5 and evidence of active exploitation in the wild, this vulnerability presents an immediate threat to data confidentiality, integrity, and availability. Failure to remediate could result in complete system takeover and unauthorized access to protected enterprise data.

Remediation Plan

Immediate Action: Update all instances of CentreStack and Triofox to version 16.12.10420.56791 or later immediately.

Proactive Monitoring: Review web server and application logs for anomalous traffic patterns, specifically looking for unusual GET or POST requests directed at endpoints that may indicate file inclusion attempts.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to filter and block requests containing suspicious patterns or known exploit signatures associated with this vulnerability while the update process is completed.

Exploitation Status

Public Exploit Available: Yes: A Metasploit module and Nuclei template are publicly available.

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of December 14, 2025. The presence of weaponized exploit code makes this a high-priority target for threat actors, and organizations should assume that any unpatched public-facing instance is at risk of imminent compromise.

Analyst Recommendation

Due to the critical severity and confirmed active exploitation, immediate patching is required for all affected systems. Organizations should prioritize this update above other non-critical maintenance tasks to prevent potential data breaches and system-wide unauthorized access. Ensure all public-facing endpoints are protected and verify that the patch has been applied successfully across the entire environment.

Description Summary:
The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery via the csv_url parameter, allowing authenticated attackers to access internal network resources.

Executive Summary:
The TableMaster for Elementor plugin contains a critical Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests to internal services and read sensitive files.

Vulnerability Details

CVE-ID: CVE-2025-14610

Affected Software: bloompixel TableMaster for Elementor

Affected Versions: 0 through 1.3.6

Vulnerability: The plugin fails to restrict URLs fetched during CSV data imports in the Data Table widget. This allows an authenticated attacker, with Author-level access or higher, to trigger requests to arbitrary locations, including local network services and the host filesystem.

Business Impact

The ability to perform Server-Side Request Forgery (SSRF) presents a significant risk to internal infrastructure. An attacker can leverage this vulnerability to scan internal networks, bypass firewall restrictions, or exfiltrate sensitive configuration files such as wp-config.php, which often contains database credentials. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the potential for severe data compromise and unauthorized access to internal resources.

Remediation Plan

Immediate Action: Update the TableMaster for Elementor plugin to the version containing the security patch, as the vulnerability is resolved by restricting the allowed URL schemes in the CSV import functionality.

Proactive Monitoring: Review web server access logs for anomalous requests to internal IP addresses or local file paths originating from the plugin's data import functionality.

Compensating Controls: Ensure that the web server environment adheres to the principle of least privilege, specifically by restricting the server's ability to initiate outbound network connections to internal segments.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires Author-level authentication, the impact on internal network security remains substantial for compromised accounts.

Analyst Recommendation

Given the potential for sensitive data exposure, it is imperative that administrators update the plugin immediately. Organizations should verify their WordPress user roles to ensure that unauthorized accounts do not possess Author-level privileges, which are required to trigger this flaw.

Description Summary:
A SQL injection vulnerability exists in vsDesk version 11.06.02, allowing unauthenticated attackers to execute malicious database queries via insecure processing of user-supplied parameters.

Executive Summary:
A critical SQL injection vulnerability in vsDesk allows unauthenticated remote attackers to compromise backend data, necessitating an immediate update to version 14.0101 or later.

Vulnerability Details

CVE-ID: CVE-2025-14603

Affected Software: vsDesk vsDesk

Affected Versions: 11.06.02

Vulnerability: This is a SQL injection flaw (CWE-89) stemming from the improper sanitization of user-supplied input before it is processed by the application database. The vulnerability is exploitable by unauthenticated attackers over the network.

Business Impact

Successful exploitation grants an attacker the ability to manipulate database queries, potentially leading to unauthorized data exfiltration or total loss of data integrity. With a CVSS score of 8.8, this flaw represents a high risk to organizational confidentiality and availability, as the attack vector is network-based and requires no prior authentication.

Remediation Plan

Immediate Action: Upgrade vsDesk to version 14.0101 or higher immediately to resolve the vulnerable code path.

Proactive Monitoring: Review database access logs for unusual query patterns, such as unexpected use of SQL keywords or syntax, originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the direct impact on database security.

Analyst Recommendation

The high severity of this vulnerability, combined with the lack of authentication required for exploitation, demands rapid remediation. Administrators should prioritize patching to version 14.0101 to eliminate the SQL injection risk and prevent potential unauthorized access to sensitive backend information.

Description Summary:
An OS command injection vulnerability in vsDesk allows an authenticated administrator to execute arbitrary operating system commands via insufficient input filtering.

Executive Summary:
An authenticated command injection vulnerability in vsDesk could permit an administrative user to execute arbitrary commands on the underlying host operating system.

Vulnerability Details

CVE-ID: CVE-2025-14601

Affected Software: vsDesk vsDesk

Affected Versions: 11.06.02

Vulnerability: This vulnerability is an OS command injection flaw caused by the use of potentially dangerous functions that fail to properly filter user input. It requires the attacker to hold administrative privileges to perform the injection.

Business Impact

Successful exploitation grants an attacker full control over the host operating system, leading to complete system compromise. The CVSS score of 8.6 reflects the critical nature of command injection, which can result in total loss of confidentiality, integrity, and availability of the affected server and its associated data.

Remediation Plan

Immediate Action: Upgrade vsDesk to version 14.0101 or later to remediate the vulnerability.

Proactive Monitoring: Monitor system logs for unauthorized command execution or the spawning of unexpected child processes from the vsDesk application.

Compensating Controls: Ensure the application runs with the least privilege necessary, and use internal network segmentation to isolate the vsDesk server from critical infrastructure.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for administrative privileges naturally limits the attack surface, but the potential for full system compromise remains severe.

Analyst Recommendation

Administrators must treat this vulnerability with high urgency due to the potential for total system takeover. Patching to the fixed version 14.0101 is required to eliminate the command injection vector and secure the application environment.

Description Summary:
BeeS Software Solutions BET ePortal is affected by an SQL injection vulnerability in the login module, allowing unauthenticated attackers to execute arbitrary commands on the backend database.

Executive Summary:
An unauthenticated SQL injection vulnerability in the BeeS Software Solutions BET ePortal allows attackers to execute arbitrary database commands, posing a critical risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2025-14598

Affected Software: BeeS Software Solutions BET ePortal

Affected Versions: 0 up to (excluding) Secure Build (October 2025)

Vulnerability: The application fails to properly neutralize special elements used in SQL commands within the login functionality. This flaw allows an unauthenticated attacker to manipulate database queries to achieve unauthorized data access or modification.

Business Impact

The CVSS score of 9.8 reflects the high severity of this vulnerability, which facilitates full database compromise without requiring authentication. Successful exploitation could lead to the theft of sensitive user credentials, exposure of confidential business data, or total loss of integrity and availability for the affected system.

Remediation Plan

Immediate Action: Update the BeeS Software Solutions BET ePortal to the Secure Build (October 2025) or the latest available version provided by the vendor.

Proactive Monitoring: Review database logs for suspicious query patterns, such as unexpected syntax errors or unusual input structures appearing in authentication requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeted at authentication endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of Jan 9, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to its presence in the login interface and the lack of authentication requirements.

Analyst Recommendation

Given the critical nature of this SQL injection flaw and the existence of a public proof-of-concept, immediate remediation is required. Organizations should prioritize updating their BET ePortal instances to the October 2025 secure build to eliminate the attack vector and secure the backend database against unauthorized access.

Description Summary:
A crafted CATPART file can cause an Out-of-Bounds Read in Autodesk Shared Components, potentially leading to a crash, information disclosure, or arbitrary code execution.

Executive Summary:
Autodesk Shared Components contains an out-of-bounds read vulnerability that allows a local attacker to execute arbitrary code or access sensitive information via a malicious CATPART file.

Vulnerability Details

CVE-ID: CVE-2025-14593

Affected Software: Autodesk Shared Components

Affected Versions: 1.8.0.7 up to (excluding) 1.9.0.7

Vulnerability: This vulnerability is an out-of-bounds read occurring during the parsing of CATPART files. It requires user interaction to open the malicious file and can be triggered by an unauthenticated local user.

Business Impact

The vulnerability carries a CVSS score of 7.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to execute code with the permissions of the user running the Autodesk software, leading to unauthorized access to sensitive design data or system compromise.

Remediation Plan

Immediate Action: Update Autodesk Shared Components to version 1.9.0.7 or later as specified in the official Autodesk security advisory.

Proactive Monitoring: Review system logs for unexpected application crashes or anomalous process behavior when handling CAD file formats.

Compensating Controls: Implement strict file access controls and ensure that users do not open untrusted or unexpected CATPART files from external sources.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of December 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the potential for arbitrary code execution necessitates prompt remediation.

Analyst Recommendation

Given the high CVSS score and the potential for arbitrary code execution, this vulnerability poses a significant risk to engineering and design environments. Administrators must prioritize the deployment of the vendor-provided updates to all systems utilizing the affected Autodesk Shared Components to eliminate the attack vector.