Description Summary:
A stack-based buffer overflow exists in the Tenda AC21 router firmware version 16.03.08.16, specifically within the /goform/SetSysTimeCfg endpoint, which may lead to remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda AC21 router, specifically in the time parameter of the SetSysTimeCfg function, poses a risk of remote code execution or denial of service.

Vulnerability Details

CVE-ID: CVE-2025-13446

Affected Software: Tenda AC21

Affected Versions: 16.03.08.16

Vulnerability: This vulnerability is a stack-based buffer overflow occurring in the fromSetSysTime function within the httpd binary. It is triggered via the time parameter of the /goform/SetSysTimeCfg endpoint, and it requires low-level privileges to initiate.

Business Impact

Successful exploitation of this buffer overflow allows an attacker to cause a denial of service or potentially achieve remote code execution on the affected router. Given the CVSS score of 8.8, this vulnerability represents a high risk to network integrity and availability, as it could allow unauthorized control over gateway hardware, leading to lateral movement or total loss of network security.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should restrict access to the web management interface to trusted IP addresses only and disable remote management features.

Proactive Monitoring: Monitor device logs and network traffic for unusual POST requests directed at the /goform/SetSysTimeCfg endpoint, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) or an intrusion detection system (IDS) to filter malicious input strings directed at the vulnerable time parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher write-up published on GitHub.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking on the time argument during the sscanf operation.

Analyst Recommendation

Given the high severity of this vulnerability and the availability of public proof-of-concept code, users should treat this issue with high urgency. If the vendor does not provide a firmware update, consider replacing the affected hardware or isolating it from all untrusted networks to prevent unauthorized remote access.

Description Summary:
A stack-based buffer overflow in the Tenda AC21 router firmware allows remote attackers to trigger a denial-of-service condition via a crafted request to the SetIpMacBind function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC21 routers exposes devices to remote denial-of-service attacks and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-13445

Affected Software: Tenda AC21 Router

Affected Versions: 16.03.08.16

Vulnerability: The vulnerability exists in the fromSetIpMacBind function within the /bin/httpd binary, specifically triggered by the list parameter of the /goform/SetIpMacBind endpoint. Due to the use of strcpy without boundary checks, a specially crafted HTTP POST request exceeding 128 bytes can cause a stack buffer overflow, requiring low-privileged authentication.

Business Impact

Successful exploitation of this vulnerability allows an attacker to crash the router, resulting in a denial-of-service for all connected users and business operations relying on the network. With a CVSS score of 8.8, the high severity reflects the potential for remote exploitation and the critical nature of the affected networking hardware. Compromise of edge devices often serves as a primary entry point for deeper lateral movement within a corporate or home network.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Administrators should immediately restrict access to the router management interface to trusted internal segments or disable remote management until a firmware update is released.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the /goform/SetIpMacBind endpoint, particularly those containing excessively long strings in the list parameter.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with custom rules to drop requests containing oversized parameters directed at the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up provided by the Northwestern Polytechnical University School of Cybersecurity.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a functional proof-of-concept on GitHub demonstrates that the vulnerability is easily reproducible and poses an immediate risk to unpatched devices.

Analyst Recommendation

Given the high CVSS score and the public availability of exploit code, Tenda AC21 users must treat this vulnerability with high priority. Organizations should isolate the management interfaces of these routers from the public internet immediately to prevent remote exploitation. Monitor vendor communication channels closely for the release of a patched firmware version and apply it as soon as it becomes available.

Description Summary:
An OS command injection vulnerability in Progress LoadMaster allows an authenticated user with administrative permissions to execute arbitrary system commands via unsanitized API input.

Executive Summary:
Progress LoadMaster contains a critical OS command injection vulnerability that permits authenticated attackers with administrative privileges to achieve remote code execution on the appliance.

Vulnerability Details

CVE-ID: CVE-2025-13444

Affected Software: Progress Software LoadMaster

Affected Versions: Progress Software LoadMaster: 7.2.50 up to (excluding) V7.2.62.2, 7.2.50 up to (excluding) V7.2.54.16; Progress Software Multi Tenant LoadMaster: 7.2.39 up to (excluding) V7.1.35.15

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) located within the API input parameters of the LoadMaster appliance. It requires the attacker to have an existing authenticated session with User Administration capabilities to successfully execute arbitrary commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the underlying service, leading to full system compromise. Given the CVSS score of 8.4, this represents a high risk to organizational security, potentially resulting in data exfiltration, service disruption, or lateral movement within the network.

Remediation Plan

Immediate Action: Review the official Progress Software community security advisories provided in the references to identify and apply the necessary firmware updates or configuration changes for your specific LoadMaster version.

Proactive Monitoring: Monitor system access logs for unauthorized API calls or unusual command execution patterns originating from administrative user accounts.

Compensating Controls: Restrict access to the management API to trusted administrative subnets and implement strict network segmentation to limit the potential blast radius of a compromised appliance.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 15, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation requires administrative credentials, the high impact of remote code execution warrants immediate attention from security teams managing load balancing infrastructure.

Analyst Recommendation

The severity of this vulnerability, combined with its potential for total system compromise, necessitates prompt action. Administrators should verify their current firmware versions against the provided ranges and apply updates as soon as they are made available by the vendor. Prioritize securing administrative accounts to mitigate the risk of this and similar vulnerabilities.

Description Summary:
A command injection vulnerability in the UTT 进取 750W router allows remote unauthenticated attackers to execute arbitrary commands via the policyNames argument in the /goform/formPdbUpConfig endpoint.

Executive Summary:
A critical command injection vulnerability in UTT 进取 750W routers permits remote, unauthenticated attackers to execute arbitrary system commands, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-13442

Affected Software: UTT 进取 750W

Affected Versions: 3.2.2-191225

Vulnerability: The vulnerability is a command injection flaw (CWE-77) triggered by improper sanitization of the policyNames argument within the /goform/formPdbUpConfig function. It allows any unauthenticated remote attacker to inject and execute system commands.

Business Impact

The ability for an unauthenticated attacker to inject commands into a network device poses a high risk of total system compromise, including the potential for lateral movement into the internal network. Given the CVSS score of 7.3, this represents a significant security risk, as the device acts as a gateway for organizational traffic. Compromise of this router could lead to unauthorized data interception, service disruption, or the establishment of persistent backdoors.

Remediation Plan

Immediate Action: As there is no vendor patch available, administrators should restrict access to the management interface to trusted internal segments only or disable the web interface entirely if not required for operations.

Proactive Monitoring: Monitor device logs for suspicious activity targeting the /goform/formPdbUpConfig endpoint and audit system configuration changes for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall or network-based Intrusion Detection System to block requests containing malicious command injection patterns targeting the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the vulnerability references.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require authentication and can be triggered remotely.

Analyst Recommendation

Due to the lack of a vendor-provided patch and the presence of a public proof-of-concept, this vulnerability must be treated with high urgency. Organizations utilizing the UTT 进取 750W should immediately isolate the device from external exposure and implement strict network segmentation until a formal vendor resolution is released.

Description Summary:
MuseHub 2.1.0.1567 contains an unquoted search path vulnerability in the Windows Service component, specifically within the Muse.Updater.exe file, which could allow local privilege escalation.

Executive Summary:
A local unquoted search path vulnerability in Muse Group MuseHub 2.1.0.1567 presents a risk of privilege escalation for attackers with local system access.

Vulnerability Details

CVE-ID: CVE-2025-13433

Affected Software: Muse Group MuseHub

Affected Versions: 2.1.0.1567

Vulnerability: This vulnerability is caused by an unquoted search path in the Muse.Updater.exe component, which runs as a Windows Service. A local attacker with low privileges could exploit this flaw to execute arbitrary code with elevated system permissions by placing a malicious executable in the path.

Business Impact

The exploitation of this flaw could lead to a full compromise of the affected host system. Because the vulnerability resides in a service, successful exploitation grants an attacker local administrative or system-level access, potentially leading to unauthorized data access, the installation of persistent backdoors, or lateral movement within the network. With a CVSS score of 7.0, this represents a high-severity risk that should be addressed to maintain the integrity and security of local workstations.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict local file system permissions on the directories associated with the MuseHub installation to prevent unauthorized binary placement.

Proactive Monitoring: Review Windows System and Security logs for unauthorized service installations or execution events originating from the MuseHub application directory.

Compensating Controls: Implement strict Application Control or Endpoint Detection and Response (EDR) policies to monitor for and block the execution of unsigned or unexpected binaries within the application path.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires local access and high complexity to execute, but it remains a significant risk for systems where untrusted local users are present.

Analyst Recommendation

Given the potential for privilege escalation, security teams should treat this vulnerability with high priority despite the requirement for local access. Organizations should monitor vendor communications for a formal patch and ensure that least privilege principles are applied to all user accounts on systems where MuseHub is installed.

Description Summary:
A SQL injection vulnerability in the Sports Club Management System allows remote, unauthenticated attackers to manipulate database queries via the login_id argument.

Executive Summary:
The Sports Club Management System version 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13422

Affected Software: freeprojectscodes Sports Club Management System

Affected Versions: 1.0

Vulnerability: The flaw exists in the /dashboard/admin/change_s_pwd.php file, where the login_id parameter fails to properly sanitize user input. This allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Business Impact

Successful exploitation of this SQL injection vulnerability can lead to unauthorized data exposure, modification, or deletion of sensitive club management records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and availability, potentially resulting in total compromise of the application database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the management dashboard or take the application offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in the login_id parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the /dashboard/admin/change_s_pwd.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at the provided GitHub reference.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of authentication requirements for the vulnerable endpoint.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the presence of a public proof-of-concept, this vulnerability poses an immediate threat to any exposed instance of the Sports Club Management System. Organizations must prioritize restricting access to the affected interface and implement strict input validation via WAF rules until the developer provides a permanent fix.

Description Summary:
A SQL injection vulnerability in the Human Resource Management System allows remote, unauthenticated attackers to manipulate the noticeDesc argument in NoticeStore.php.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode Human Resource Management System 1.0 poses a severe risk of unauthorized database manipulation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-13421

Affected Software: itsourcecode Human Resource Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the noticeDesc parameter within the /src/store/NoticeStore.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to significant data compromise or loss of database integrity. Successful exploitation allows attackers to bypass application logic and interact directly with the backend database, which may result in unauthorized exposure of sensitive HR information or administrative data.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict network access to the application and monitor for suspicious traffic targeting the /src/store/NoticeStore.php endpoint.

Proactive Monitoring: Security teams should review web server access logs for anomalous SQL syntax or unexpected character patterns in the noticeDesc parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to inspect and block malicious SQL injection payloads directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists as documented in the research writeup hosted at https://github.com/f14g-orz/CVE/issues/9.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated access to the backend database.

Analyst Recommendation

Given the availability of a public proof of concept and the lack of an official patch, administrators should prioritize isolating the affected system from public networks immediately. Organizations must implement strict input validation at the WAF level and prepare for a transition to a secure version of the software as soon as the vendor provides a remediation.

Description Summary:
A SQL injection vulnerability exists in the Human Resource Management System 1.0, specifically within the /src/store/EventStore.php file, allowing remote attackers to manipulate the eventSubject parameter.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode Human Resource Management System 1.0 allows for remote unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-13420

Affected Software: itsourcecode Human Resource Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command within the eventSubject argument in /src/store/EventStore.php. The attack is remotely exploitable and does not require authentication.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive database information, potential data modification, or service disruption. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of human resource records stored within the application.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected application and implement input validation rules to sanitize the eventSubject parameter.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected SQL syntax or unauthorized access attempts originating from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up located at the referenced GitHub repository.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation over a network without requiring authentication.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability significantly elevates the risk of exploitation. Organizations utilizing this software must prioritize implementing defensive measures, such as WAF filtering, and actively seek confirmation from the vendor regarding a permanent security update to remediate the underlying code flaw.

Description Summary:
The Plugin Organizer WordPress plugin contains a SQL injection vulnerability due to improper sanitization of user-supplied input.

Executive Summary:
A high-severity SQL injection vulnerability in the Plugin Organizer WordPress plugin allows unauthenticated attackers to potentially exfiltrate sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-13417

Affected Software: WordPress Plugin Organizer

Affected Versions: 0 up to (excluding) 10.2.4

Vulnerability: The vulnerability exists because the plugin fails to sanitize or escape parameters before including them in SQL queries. This allows an unauthenticated attacker to inject malicious SQL commands to compromise database integrity or confidentiality.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data stored within the WordPress database, including user credentials, configuration details, or customer information. Given the CVSS score of 8.6, this flaw poses a significant risk to the confidentiality of the application, potentially resulting in severe regulatory and reputational damage.

Remediation Plan

Immediate Action: Update the Plugin Organizer WordPress plugin to version 10.2.4 or later immediately.

Proactive Monitoring: Review database error logs and query logs for unusual SQL syntax or unexpected patterns that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection patterns to provide temporary protection while the update is scheduled.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 30, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable as it does not require authentication to trigger the flawed SQL statement.

Analyst Recommendation

This vulnerability represents a critical risk to the security of the WordPress installation due to the lack of required authentication for exploitation. Administrators must prioritize updating the Plugin Organizer plugin to version 10.2.4 or later to remediate this flaw. Failure to patch allows attackers to potentially bypass security controls and access the backend database, making immediate action necessary to maintain the security posture of the environment.

Description Summary:
Campcodes Retro Basketball Shoes Online Store 1.0 is vulnerable to unauthenticated remote SQL injection via the tid argument in the admin/receipt.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13410

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the tid argument of the admin/receipt.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially exposing sensitive database information.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the compromise of customer data or administrative credentials. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to the confidentiality and integrity of the application. Failure to address this issue may lead to data breaches and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /admin/receipt.php file or disable the vulnerable component entirely until a fix is provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the admin/receipt.php endpoint, specifically looking for unusual patterns in the tid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to any deployment of Campcodes Retro Basketball Shoes Online Store 1.0. Organizations should prioritize isolating the affected application from the internet and monitor for signs of unauthorized database interaction until the vendor releases a security update.

Description Summary:
A buffer overflow vulnerability in the Tenda CH22 router allows remote attackers to trigger memory corruption via the formWrlExtraGet function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda CH22 firmware (version 1.0.0.1) allows remote attackers to compromise device integrity.

Vulnerability Details

CVE-ID: CVE-2025-13400

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: This vulnerability is a buffer overflow (CWE-120) triggered by manipulating the chkHz argument within the formWrlExtraGet function of the /goform/WrlExtraGet endpoint. The attack requires low privileges and can be executed remotely.

Business Impact

Successful exploitation allows an attacker to cause memory corruption, which can lead to a complete compromise of the affected device. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk to network infrastructure, potentially leading to unauthorized system control or denial of service for connected users.

Remediation Plan

Immediate Action: Monitor official Tenda support channels for firmware updates and apply them as soon as they become available.

Proactive Monitoring: Review device access logs for unusual traffic directed at the /goform/WrlExtraGet endpoint and monitor for unexpected device reboots.

Compensating Controls: Restrict management access to the device to trusted IP addresses only and disable remote administration features if they are not strictly required for operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the ease of triggering a buffer overflow via network-accessible parameters.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution or system instability, organizations using Tenda CH22 devices must prioritize this issue. Administrators should isolate these devices from the public internet until a vendor-supplied firmware patch is applied to mitigate the risk of exploitation.

Description Summary:
A SQL injection vulnerability in the Login function of codehub666 94list allows remote attackers to execute arbitrary database queries.

Executive Summary:
The 94list application by codehub666 is vulnerable to remote SQL injection, which could allow unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13395

Affected Software: codehub666 94list

Affected Versions: codehub666 94list up to 5831c8240e99a72b7d3508c79ef46ae4b96befe8

Vulnerability: This is a SQL injection flaw (CWE-89) located within the Login function of the /function.php file. The vulnerability is exploitable by unauthenticated remote attackers who can manipulate input to execute unauthorized database commands.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection represents a significant risk to data confidentiality and integrity. Given the CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized access to sensitive user credentials or application data, potentially resulting in full database compromise and subsequent service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the login endpoint via network-level controls or consider disabling the affected functionality until a permanent fix is issued by the vendor.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, such as unexpected syntax errors or suspicious SQL keywords originating from the login endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch for the vulnerable input fields.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept has been released via the vendor GitHub repository, meaning the risk of exploitation is credible and elevated. The lack of formal versioning in this product makes it difficult for users to track their specific exposure, necessitating a manual review of the current source code commit.

Analyst Recommendation

Due to the high severity of this SQL injection vulnerability and the availability of a public proof-of-concept, immediate action is required to secure the environment. Organizations currently utilizing the 94list software should prioritize restricting network access to the login interface and monitor for any signs of unauthorized interaction with the underlying database.

Description Summary:
The WP Directory Kit plugin for WordPress is vulnerable to unauthenticated authentication bypass, allowing attackers to gain administrative access via predictable tokens in the auto-login function.

Executive Summary:
The WP Directory Kit plugin for WordPress contains a critical authentication bypass vulnerability that permits unauthenticated attackers to achieve full site takeover.

Vulnerability Details

CVE-ID: CVE-2025-13390

Affected Software: ListingThemes WP Directory Kit

Affected Versions: 1.4.0 through 1.4.4

Vulnerability: This vulnerability, identified as an incorrect implementation of an authentication algorithm (CWE-303), exists within the wdk_generate_auto_login_link function. Due to a cryptographically weak token generation mechanism, unauthenticated attackers can craft predictable tokens to bypass authentication and assume administrative privileges.

Business Impact

The severity of this flaw is rated at 10.0 (Critical), reflecting the potential for total system compromise. A successful exploit grants an attacker full administrative control over the WordPress site, which could result in complete data exfiltration, unauthorized modification of site content, and potential injection of malicious scripts into the environment.

Remediation Plan

Immediate Action: Update the WP Directory Kit plugin to the latest available version that addresses this authentication flaw. If an update is not immediately possible, deactivate the plugin until the patch is applied.

Proactive Monitoring: Review web server and WordPress access logs for suspicious requests targeting the auto-login endpoint or unusual administrative activity originating from unauthorized IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the vulnerable auto-login endpoint and monitor for traffic patterns consistent with automated token guessing attempts.

Exploitation Status

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Analyst Notes: As of December 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ease of automating the predictable token generation process.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, organizations using the WP Directory Kit plugin must prioritize remediation. Administrative access is a primary target for attackers, and the current exploitability of this plugin necessitates immediate patching to prevent unauthorized site takeover.

Description Summary:
The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name field due to insufficient input sanitization.

Executive Summary:
An unauthenticated Stored Cross-Site Scripting vulnerability in the Kadence WooCommerce Email Designer plugin allows attackers to inject malicious scripts that execute in the context of administrative sessions.

Vulnerability Details

CVE-ID: CVE-2025-13387

Affected Software: StellarWP Kadence WooCommerce Email Designer

Affected Versions: 0 through 1.5.17

Vulnerability: This vulnerability involves improper neutralization of input during web page generation, specifically within the customer name field. Because the plugin fails to properly sanitize input or escape output, unauthenticated attackers can inject arbitrary scripts that execute when a user views the compromised page.

Business Impact

The CVSS score of 7.2 reflects a high severity rating due to the ability of unauthenticated attackers to execute arbitrary code within the browser of a victim, typically an administrator. Successful exploitation could lead to unauthorized actions, session hijacking, or the redirection of users to malicious websites, resulting in potential data theft or further compromise of the WordPress environment.

Remediation Plan

Immediate Action: Update the Kadence WooCommerce Email Designer plugin to the latest available version beyond 1.5.17, as per the vendor security advisory.

Proactive Monitoring: Monitor WordPress administrative logs for suspicious script execution or unexpected changes to user profiles and email templates.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common cross-site scripting patterns in incoming POST requests.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of 2025-12-02, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high given that it requires no authentication to inject payloads into the application.

Analyst Recommendation

This vulnerability presents a significant risk to site integrity and administrative session security. Given the ease of exploitation by unauthenticated actors, administrators should prioritize updating the Kadence WooCommerce Email Designer plugin immediately. If an update cannot be performed, consider temporarily disabling the plugin to prevent potential exploitation until a patch is applied.

Description Summary:
The CP Contact Form with PayPal WordPress plugin is vulnerable to missing authorization, allowing unauthenticated attackers to forge payment notifications via an exposed IPN-like endpoint.

Executive Summary:
An unauthenticated authorization bypass in the CP Contact Form with PayPal plugin allows attackers to manipulate payment statuses, posing a significant risk to transaction integrity.

Vulnerability Details

CVE-ID: CVE-2025-13384

Affected Software: CodePeople CP Contact Form with PayPal

Affected Versions: 0 through 1.3.56

Vulnerability: The plugin exposes an unauthenticated endpoint via the cp_contactformpp_ipncheck query parameter that lacks nonce verification and proper signature validation. This allows an unauthenticated attacker to inject arbitrary POST data and falsely mark payment transactions as successful.

Business Impact

This vulnerability directly compromises the financial integrity of e-commerce operations using the affected plugin. By enabling the fraudulent marking of transactions as paid, attackers can bypass payment requirements, leading to direct financial loss and the unauthorized fulfillment of services or goods. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent potential revenue leakage.

Remediation Plan

Immediate Action: Ensure the plugin is updated to a version beyond 1.3.56, as identified in the vendor security advisory. If a patched version is not yet available in your environment, deactivate and remove the plugin immediately to prevent exploitation.

Proactive Monitoring: Review web server access logs for anomalous POST requests targeting the cp_contactformpp_ipncheck endpoint. Monitor transaction logs for payment confirmations that lack corresponding records in the PayPal dashboard.

Compensating Controls: Implement a Web Application Firewall rule to restrict access to the plugin's endpoint or block requests containing suspicious parameters that mimic payment notification data.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is trivial to trigger due to the lack of signature validation, the absence of widespread exploitation suggests the risk is currently manageable through timely patching.

Analyst Recommendation

The ability for an unauthenticated user to manipulate financial transaction states is a critical business risk. Administrators should prioritize the update of the CP Contact Form with PayPal plugin to the latest available version. If the plugin is no longer actively maintained or if updates cannot be applied, the safest course of action is to replace the component with a secure alternative to eliminate the exposure.

Description Summary:
IBM Aspera Console versions 3.4.0 through 3.4.8 are susceptible to SQL injection, allowing unauthenticated remote attackers to manipulate backend database information.

Executive Summary:
A critical SQL injection vulnerability in IBM Aspera Console 3.4.0 through 3.4.8 permits unauthenticated remote attackers to compromise backend database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-13379

Affected Software: IBM Aspera Console

Affected Versions: 3.4.0 through 3.4.8

Vulnerability: The application fails to properly neutralize special elements used in SQL commands, resulting in a CWE-89 SQL injection vulnerability. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend database.

Business Impact

This vulnerability poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation allows unauthorized parties to view, modify, or delete sensitive information stored within the database, which could lead to full data exfiltration or service disruption. With a CVSS score of 8.6, this flaw is categorized as High severity and requires immediate attention to prevent unauthorized access to corporate assets.

Remediation Plan

Immediate Action: Administrators must upgrade to IBM Aspera Console version 3.4.8 FP1 immediately by following the instructions provided in the IBM Fix Central portal.

Proactive Monitoring: Security teams should monitor database logs for anomalous queries, such as those containing SQL syntax characters or unexpected administrative commands originating from external sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection protection signatures to inspect and block malicious traffic targeting the application before it reaches the backend.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of February 7, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the potential for full database access.

Analyst Recommendation

Given the high CVSS score and the potential for complete database compromise, this vulnerability represents a significant security risk. Organizations running the affected versions of IBM Aspera Console should prioritize the deployment of the 3.4.8 FP1 patch. Until the update is applied, ensure that the application is restricted from public internet access where possible to limit the attack surface.

Description Summary:
The ProjectList plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation, potentially leading to remote code execution.

Executive Summary:
An arbitrary file upload vulnerability in the ProjectList WordPress plugin allows authenticated attackers with Editor-level privileges to achieve remote code execution on the server.

Vulnerability Details

CVE-ID: CVE-2025-13376

Affected Software: ov3rkll ProjectList

Affected Versions: 0 through 0.3.0

Vulnerability: The plugin fails to perform adequate file type validation, which allows an authenticated attacker with Editor-level access or higher to upload malicious files via the pl-add.php script. This flaw constitutes an Unrestricted Upload of File with Dangerous Type (CWE-434).

Business Impact

The ability to upload arbitrary files allows an attacker to execute malicious code, which could result in a full site compromise, unauthorized data exfiltration, or the deployment of ransomware. With a CVSS score of 7.2, this vulnerability is classified as High, reflecting the significant risk of total system impact if an attacker leverages existing administrative credentials to gain server-level control.

Remediation Plan

Immediate Action: Since no patched version is currently available, administrators should immediately deactivate and remove the ProjectList plugin from all WordPress installations.

Proactive Monitoring: Review web server access logs for any suspicious file uploads or unexpected access requests directed toward the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block unauthorized file upload attempts that match known malicious patterns.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of November 26, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of server-side validation on the upload endpoint, making it a high-value target for attackers who have already compromised an Editor-level account.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability poses a severe threat to the integrity and confidentiality of the affected WordPress environment. Because no formal patch is currently available, the only effective mitigation is the immediate removal of the vulnerable plugin. Organizations should prioritize identifying all instances of ProjectList within their infrastructure to ensure it is deactivated until the vendor releases a secure version.

Description Summary:
IBM Common Cryptographic Architecture (CCA) contains a flaw allowing unauthenticated users to execute arbitrary commands with elevated privileges. Patches are available for affected versions.

Executive Summary:
A critical remote command execution vulnerability in IBM Common Cryptographic Architecture allows unauthenticated attackers to gain elevated privileges and full control over the affected system.

Vulnerability Details

CVE-ID: CVE-2025-13375

Affected Software: IBM Common Cryptographic Architecture (CCA)

Affected Versions: 7.5.52 and 8.4.82

Vulnerability: This vulnerability allows an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. Because the commands execute with elevated privileges, the attacker can effectively bypass all system security controls.

Business Impact

With a CVSS score of 9.8, the business impact is extreme. Successful exploitation grants an attacker total control over cryptographic operations and the host system, potentially leading to the compromise of encryption keys, sensitive financial data, or critical infrastructure managed by IBM CCA.

Remediation Plan

Immediate Action: Apply the latest security updates provided by IBM for CCA versions 7.5.52 and 8.4.82 immediately.

Proactive Monitoring: Monitor system logs for unauthorized administrative command execution and review network traffic for suspicious outbound connections from the CCA host.

Compensating Controls: Isolate the IBM CCA environment behind a strict firewall, allowing access only from trusted management IPs via encrypted channels.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 4, 2026, there is no public information indicating active exploitation. However, given IBM's critical role in enterprise infrastructure, this vulnerability is a prime candidate for targeted attacks.

Analyst Recommendation

This vulnerability represents a "worst-case" scenario for cryptographic infrastructure. Immediate patching is mandatory to prevent unauthenticated attackers from seizing control of the environment and its sensitive cryptographic assets.

Description Summary:
The Kalrav AI Agent plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the kalrav_upload_file AJAX action, potentially leading to remote code execution.

Executive Summary:
The Kalrav AI Agent plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability that poses a critical risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-13374

Affected Software: Iris Idea Tech Solutions Kalrav AI Agent

Affected Versions: 0 through 2.3.3

Vulnerability: This flaw is caused by insufficient file type validation within the kalrav_upload_file AJAX action. Because the action lacks authentication requirements, any unauthenticated attacker can upload malicious files to the server, which may facilitate remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected WordPress site. This could lead to complete data theft, unauthorized modification of site content, or the installation of persistent backdoors, posing a severe risk to organizational reputation and operational integrity. The CVSS score of 9.8 reflects the high severity of this critical flaw.

Remediation Plan

Immediate Action: Update the Kalrav AI Agent plugin to the latest available version that includes the patch for this vulnerability. If an update is not immediately available, deactivate and remove the plugin until a secure version can be deployed.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the kalrav_upload_file AJAX endpoint. Monitor the uploads directory for unexpected file types or scripts that were not authorized by administrative users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block arbitrary file uploads and restrict access to WordPress AJAX actions from untrusted sources.

Exploitation Status

Public Exploit Available: Yes, two public proof-of-concept repositories are available on GitHub.

Analyst Notes: As of Jan 24, 2026, there is no public information indicating active exploitation in the wild, though the existence of public proof-of-concept code increases the likelihood of opportunistic attacks. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate action is required. Organizations using the Kalrav AI Agent plugin must prioritize patching to the latest version to prevent potential remote code execution and full system compromise.

Description Summary:
Advantech iView versions 5.7.05.7057 and prior are vulnerable to SQL injection via unsanitized SNMP v1 trap requests on port 162.

Executive Summary:
An unauthenticated SQL injection vulnerability in Advantech iView 5.7.05.7057 and prior allows remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-13373

Affected Software: Advantech iView

Affected Versions: 5.7.05.7057 and prior

Vulnerability: This vulnerability involves improper neutralization of special elements used in SQL commands (CWE-89). Unauthenticated attackers can trigger the flaw by sending malicious SNMP v1 trap requests to port 162.

Business Impact

The ability to perform SQL injection against a network management platform presents a significant risk to data confidentiality. Successful exploitation could allow an attacker to extract sensitive system information, potentially leading to unauthorized access to the underlying management infrastructure and broader network compromise. Given the CVSS score of 7.5, this is classified as a High severity issue requiring immediate attention to prevent data exfiltration.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.8.1 or later as specified in the vendor advisory.

Proactive Monitoring: Review system logs for unusual SNMP traffic patterns or malformed SNMP trap requests originating from untrusted sources.

Compensating Controls: Restrict access to UDP port 162 to known, trusted management stations using network segmentation or firewall rules to prevent unauthorized SNMP trap submission.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of 2025-12-05, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable due to the lack of required authentication, which increases the necessity for prompt patching.

Analyst Recommendation

This vulnerability represents a critical risk to industrial control and network management environments. Organizations utilizing Advantech iView should prioritize the transition to version 5.8.1 to eliminate the SQL injection vector. Until the update is applied, strict network access control lists for SNMP traffic are essential to mitigate the risk of remote command execution.

Description Summary:
The MoneySpace plugin for WordPress incorrectly stores and exposes sensitive payment information, including full credit card details and CVV codes, to unauthenticated users via the mspaylink endpoint.

Executive Summary:
The MoneySpace plugin for WordPress contains a critical sensitive information exposure vulnerability that allows unauthenticated attackers to steal full customer payment card data.

Vulnerability Details

CVE-ID: CVE-2025-13371

Affected Software: MoneySpace MoneySpace plugin for WordPress

Affected Versions: 0 through 2.13.9

Vulnerability: This vulnerability occurs because the plugin stores sensitive payment data in WordPress post_meta using base64 encoding and embeds it into the inline JavaScript of the mspaylink page. An unauthenticated attacker who identifies a valid order ID can retrieve full credit card numbers and CVV codes directly from the HTML response.

Business Impact

The exposure of raw payment card data, including CVV codes, constitutes a severe violation of PCI-DSS compliance and poses a catastrophic risk to customer financial security. Given the CVSS score of 8.6, this vulnerability represents a high-risk scenario that will likely result in immediate financial fraud, significant regulatory fines, and long-term reputational damage to the merchant.

Remediation Plan

Immediate Action: Update the MoneySpace plugin to the latest available version beyond 2.13.9, which addresses the insecure storage and transmission of payment data.

Proactive Monitoring: Review access logs for the mspaylink endpoint to identify any suspicious, high-frequency requests targeting order identifiers.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the mspaylink endpoint and monitor for unauthorized attempts to probe for order IDs.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of January 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and the high value of the data exposed.

Analyst Recommendation

This vulnerability presents an unacceptable risk to any e-commerce operation utilizing the MoneySpace plugin. Administrators must prioritize updating the plugin immediately to prevent potential data theft. If an update is not immediately feasible, the plugin should be deactivated to prevent further exposure of customer financial data until a secure version is deployed.

Description Summary:
The Vault Terraform Provider incorrectly defaults the LDAP auth method deny_null_bind parameter to false, which may allow authentication bypass if the underlying LDAP server permits null binds.

Executive Summary:
A security misconfiguration in the HashiCorp Vault Terraform Provider could allow unauthenticated users to bypass LDAP authentication, posing a critical risk to identity security.

Vulnerability Details

CVE-ID: CVE-2025-13357

Affected Software: HashiCorp Vault Terraform Provider

Affected Versions: 4.2.0 up to (excluding) 5.5.0

Vulnerability: This vulnerability involves an insecure default configuration where the deny_null_bind parameter is set to false. An unauthenticated attacker could potentially leverage this to bypass authentication mechanisms if the backend LDAP server is configured to accept anonymous or null binds.

Business Impact

The exploitation of this vulnerability could lead to unauthorized access to sensitive systems or data protected by Vault, resulting in significant security breaches. Given the CVSS score of 7.4, this represents a high risk to organizational integrity, as it undermines the primary authentication gateway for infrastructure management.

Remediation Plan

Immediate Action: Upgrade the HashiCorp Vault Terraform Provider to version 5.5.0 or later to ensure the default security settings are correctly applied.

Proactive Monitoring: Review LDAP authentication logs for anomalous bind attempts, specifically looking for null or empty credentials associated with administrative or service accounts.

Compensating Controls: Ensure that the backend LDAP server is configured to explicitly reject anonymous or null binds, providing a defense-in-depth layer regardless of the client-side configuration.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an initialization error, which creates a persistent vulnerability in environments where the provider is deployed with default settings.

Analyst Recommendation

The reliance on insecure defaults makes this a high-priority update for any organization utilizing the Vault Terraform Provider. Administrators should verify their current provider versions immediately and execute the upgrade to 5.5.0 to remediate the potential authentication bypass vector.

Description Summary:
The URL Shortify WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient parameter sanitization, potentially allowing attackers to target administrative users.

Executive Summary:
The URL Shortify WordPress plugin contains a reflected cross-site scripting vulnerability that poses a significant risk to administrative accounts through malicious script execution.

Vulnerability Details

CVE-ID: CVE-2025-13355

Affected Software: URL Shortify for WordPress

Affected Versions: 0 up to (excluding) 1.11.4

Vulnerability: The plugin fails to properly sanitize and escape input parameters before reflecting them back in the web page. This CWE-79 flaw allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim session, specifically targeting high privilege users such as administrators.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized execution of JavaScript within an administrator's browser session. This may result in session hijacking, the unauthorized modification of plugin configurations, or the redirection of site traffic. Given the CVSS score of 7.1, this represents a high severity risk that could lead to full site compromise if administrative sessions are successfully targeted.

Remediation Plan

Immediate Action: Update the URL Shortify plugin to version 1.11.4 or later immediately to apply the necessary sanitization logic.

Proactive Monitoring: Review access logs for suspicious URL patterns containing script tags or encoded characters that may indicate attempted XSS attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious cross-site scripting patterns directed at the WordPress administrative interface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input reflection occurs without proper output encoding, which is a common vector for session-based attacks.

Analyst Recommendation

Security teams must prioritize the update of the URL Shortify plugin across all WordPress instances. Because this flaw specifically targets high privilege users, the potential for administrative takeover is significant. Ensure that all plugins are maintained at their latest patched versions to minimize the attack surface and prevent unauthorized script injection.

Description Summary:
A SQL injection vulnerability exists in the Train Station Ticketing System 1.0 via the Username parameter in ajax.php, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Train Station Ticketing System 1.0 poses a significant risk of unauthorized database interaction and information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-13344

Affected Software: SourceCodester Train Station Ticketing System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the ajax.php file, triggered by the Username argument. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive ticketing data, potential modification of records, or the compromise of database integrity. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to the confidentiality and availability of the ticketing application, which may contain user or administrative data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected endpoint or disable the ticketing system until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeted at the ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application login parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository reference.

Analyst Notes: As of November 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations currently running version 1.0 of the SourceCodester Train Station Ticketing System should prioritize isolating the application from external networks or applying robust WAF filtering until an official security patch is provided by the vendor.

Description Summary:
The Frontend Admin WordPress plugin is vulnerable to unauthorized modification of critical system options by unauthenticated attackers due to missing capability checks in the ActionOptions::run() method.

Executive Summary:
The Frontend Admin plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to modify sensitive system settings, potentially leading to full site compromise.

Vulnerability Details

CVE-ID: CVE-2025-13342

Affected Software: DynamiApps Frontend Admin

Affected Versions: 0 through 3.28.20

Vulnerability: This vulnerability is caused by missing authorization and inadequate input validation within the ActionOptions::run() save handler. An unauthenticated attacker can exploit this flaw by submitting crafted form data to public frontend forms to change WordPress core settings, such as administrative email addresses or user registration policies.

Business Impact

The ability for an unauthenticated user to alter core WordPress options poses a severe risk to organizational security. By modifying settings like default user roles or administrative email addresses, an attacker can gain unauthorized access, escalate privileges, or intercept password reset emails, effectively leading to a complete takeover of the affected WordPress site. Given the CVSS score of 9.8, this flaw represents a critical threat that requires immediate remediation to prevent unauthorized system control and data loss.

Remediation Plan

Immediate Action: Update the Frontend Admin plugin to the latest available version provided by DynamiApps to ensure the patch is applied.

Proactive Monitoring: Review web server and WordPress application logs for suspicious POST requests directed at frontend forms or unusual modifications to core database options.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to administrative endpoints or suspicious form submissions that target sensitive WordPress configuration parameters.

Exploitation Status

Public Exploit Available: Yes, public proof-of-concept repositories have been identified on GitHub.

Analyst Notes: As of Dec 3, 2025, there is no confirmed active exploitation in the wild; however, public proof-of-concept code is available on GitHub, which significantly lowers the barrier for entry for malicious actors. The vulnerability is inherently easy to exploit due to the lack of required authentication and the public accessibility of the vulnerable form endpoints.

Analyst Recommendation

Due to the critical severity and the public availability of proof-of-concept exploits, administrators must prioritize updating the Frontend Admin plugin immediately. Failure to address this vulnerability allows attackers to bypass all standard authentication barriers, turning a public-facing form into a vector for total system takeover. Patching is the only reliable method to mitigate this risk.

Description Summary:
The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to path traversal via the template_redirect function, allowing unauthenticated file disclosure.

Executive Summary:
The Hippoo Mobile App for WooCommerce plugin for WordPress contains a critical path traversal vulnerability that permits unauthenticated attackers to read sensitive server files.

Vulnerability Details

CVE-ID: CVE-2025-13339

Affected Software: Hippoo Hippoo Mobile App for WooCommerce

Affected Versions: 0 through 1.7.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) triggered within the template_redirect function. It allows any unauthenticated attacker to bypass directory restrictions and access arbitrary files on the underlying server.

Business Impact

The ability for an unauthenticated user to read arbitrary files presents a significant risk of sensitive data exposure, including configuration files, credentials, or proprietary source code. Given the CVSS score of 7.5, this high-severity vulnerability could lead to a full compromise of the application environment or provide the necessary intelligence for further exploitation.

Remediation Plan

Immediate Action: Update the Hippoo Mobile App for WooCommerce plugin to the latest version available from the vendor that includes the security patch. If an update is not immediately available, deactivate and remove the plugin from the production environment.

Proactive Monitoring: Review server access logs for anomalous HTTP requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the WordPress site.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block incoming requests containing directory traversal characters to prevent exploitation of the template_redirect function.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of December 11, 2025, there is no public information indicating active exploitation in the wild. However, the presence of a public proof-of-concept on GitHub increases the risk of opportunistic attacks. The vulnerability is highly reachable due to the lack of required authentication.

Analyst Recommendation

This vulnerability represents a high risk to the confidentiality of the WordPress hosting environment. Administrators are advised to verify the plugin version immediately and apply updates to version 1.7.1 or higher. If the plugin is not essential, removal is the most effective method to eliminate the attack surface entirely.

Description Summary:
The Blaze Demo Importer plugin for WordPress contains a missing capability check, allowing authenticated attackers to perform unauthorized database resets and delete site content.

Executive Summary:
A critical authorization vulnerability in the Blaze Demo Importer plugin allows authenticated users to trigger destructive database resets and mass file deletion.

Vulnerability Details

CVE-ID: CVE-2025-13334

Affected Software: BlazeThemes Blaze Demo Importer

Affected Versions: 1.0.0 through 1.0.13

Vulnerability: The vulnerability stems from a missing capability check on the blaze_demo_importer_install_demo function. This allows any authenticated user, including those with subscriber-level access, to trigger administrative functions that truncate database tables and remove site assets.

Business Impact

The potential impact of this vulnerability is severe, as it allows for the complete destruction of site content and configuration data. With a CVSS score of 8.1, the risk of significant operational downtime and loss of integrity is high, potentially leading to total service disruption and loss of critical business information.

Remediation Plan

Immediate Action: Since a specific patched version is not confirmed, administrators should immediately deactivate and remove the Blaze Demo Importer plugin from their WordPress environment until an official security update is released by the vendor.

Proactive Monitoring: Security teams should monitor server logs for unauthorized access to the plugin directory or unusual execution patterns involving the blaze_demo_importer_install_demo function.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests directed at the vulnerable plugin endpoint, provided the traffic pattern can be isolated from legitimate administrative activity.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently exploited in the wild, the lack of authorization checks makes this a trivial target for any authenticated user on the platform.

Analyst Recommendation

Given the destructive potential of this vulnerability, immediate removal of the plugin is the most effective way to secure the environment. Organizations should prioritize removing unused or vulnerable plugins to reduce the overall attack surface of their WordPress installations.

Description Summary:
The File Uploader for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the add-image-data REST API endpoint, potentially leading to remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the File Uploader for WooCommerce plugin allows unauthenticated attackers to achieve remote code execution on affected WordPress sites.

Vulnerability Details

CVE-ID: CVE-2025-13329

Affected Software: snowray File Uploader for WooCommerce

Affected Versions: 0 through 1.0.3

Vulnerability: This flaw is caused by missing file type validation within the add-image-data REST API endpoint, which permits unauthenticated attackers to upload malicious files. These files can be executed on the server, facilitating remote code execution.

Business Impact

The vulnerability carries a CVSS score of 9.8, reflecting its critical severity and the ease of exploitation by unauthenticated actors. Successful exploitation allows full compromise of the web server, potentially leading to unauthorized data access, site defacement, or the deployment of persistent backdoors within the WordPress environment.

Remediation Plan

Immediate Action: Review the official WordPress plugin repository for a security update and update to the latest version immediately. If no update is available, deactivate and remove the plugin until a vendor-supplied patch is confirmed.

Proactive Monitoring: Monitor server access logs for suspicious requests directed at the REST API, particularly those involving unconventional file types or unusual POST requests to the add-image-data endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to sensitive REST API endpoints and inspect incoming file uploads for malicious signatures.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Dec 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of file type validation creates a trivial path for attackers to place executable code on the underlying server.

Analyst Recommendation

Given the critical CVSS score and the potential for complete system compromise, this vulnerability poses an extreme risk to any organization utilizing the affected plugin. Administrators must prioritize the application of vendor patches or the removal of the vulnerable component to prevent unauthorized remote code execution.

Description Summary:
The Simple Pizza Ordering System version 1.0 contains an SQL injection vulnerability in the listorder.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in the Simple Pizza Ordering System version 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-13323

Affected Software: code-projects Simple Pizza Ordering System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID parameter in the listorder.php script. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the application database, potentially leading to the exposure, modification, or deletion of sensitive ordering data. Given the CVSS score of 7.3, this represents a high risk to data integrity and confidentiality. Organizations relying on this software may face significant operational disruption and loss of customer trust if the database is compromised.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the affected system or disable the listorder.php functionality if it is not business critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting listorder.php, specifically looking for SQL syntax patterns or unusual character sequences in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate the risk until a permanent software fix is applied.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub repository.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, making the exploitation risk credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization in the affected PHP file.

Analyst Recommendation

This vulnerability presents a high risk due to the availability of proof-of-concept code and the lack of a vendor-provided security update. Administrators must treat this as a priority and implement compensating controls or network isolation immediately to prevent unauthorized database access. Continued vigilance and migration to a supported, secure alternative are strongly advised.

Description Summary:
The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion via the wpag_uploadaudio_callback AJAX handler in versions up to 2.0.

Executive Summary:
The WP AUDIO GALLERY plugin for WordPress contains an arbitrary file deletion vulnerability that allows authenticated attackers with subscriber-level access to compromise site integrity and potentially achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-13322

Affected Software: husainali52 WP AUDIO GALLERY

Affected Versions: 0 through 2.0

Vulnerability: This vulnerability occurs due to improper validation of user supplied file paths in the audio_upload parameter within the wpag_uploadaudio_callback AJAX handler. Any authenticated user with subscriber level access or higher can leverage this flaw to delete arbitrary files on the server.

Business Impact

Successful exploitation allows an attacker to delete critical system files, including the wp-config.php file, which can lead to a complete site takeover or remote code execution. Given the CVSS score of 8.1, this vulnerability poses a high risk to business operations, as it can result in total service disruption, unauthorized administrative access, and potential data loss.

Remediation Plan

Immediate Action: Since there is no official patch available, administrators should immediately deactivate and uninstall the WP AUDIO GALLERY plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the wpag_uploadaudio_callback AJAX endpoint or unusual file deletion patterns within the WordPress installation directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin's AJAX handler and restrict access to the WordPress dashboard to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof of concept for this vulnerability. The vulnerability is highly exploitable due to the low privilege requirement, making the removal of the plugin the safest course of action.

Analyst Recommendation

This vulnerability presents a significant risk to site security and availability. Organizations using the WP AUDIO GALLERY plugin must treat this as a high priority item and remove the software from their environment immediately to prevent potential exploitation of the file deletion flaw.

Description Summary:
A SQL injection vulnerability exists in the API feature of Digi On-Prem Manager, allowing authenticated attackers with valid API tokens to execute arbitrary SQL commands.

Executive Summary:
An authenticated SQL injection vulnerability in Nettec AS Digi On-Prem Manager poses a high risk of total system compromise for organizations utilizing the affected API feature.

Vulnerability Details

CVE-ID: CVE-2025-13319

Affected Software: Nettec AS Digi On-Prem Manager

Affected Versions: 24.12.5 up to (excluding) 25.08.5

Vulnerability: This is an SQL injection vulnerability (CWE-89) stemming from improper input validation within the API interface. Successful exploitation requires the attacker to possess a valid API token, as the attack is performed against an authenticated API endpoint.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for full confidentiality, integrity, and availability impact. A successful exploit could allow an attacker to dump sensitive database contents, modify records, or potentially gain further control over the underlying server infrastructure, leading to significant data breaches and operational disruption.

Remediation Plan

Immediate Action: Update Digi On-Prem Manager to version 25.08.5 or later as specified by the vendor security advisory.

Proactive Monitoring: Review API access logs for anomalous, high-frequency, or malformed queries that contain SQL syntax, especially originating from service accounts.

Compensating Controls: If immediate patching is not feasible, restrict API access to known, trusted IP addresses using network-level controls and ensure the API feature is disabled if it is not required for daily operations.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the requirement for an existing API token limits the initial attack surface, the potential for total system impact makes this a high-priority item for remediation.

Analyst Recommendation

Given the high CVSS score and the potential for total system compromise, organizations should prioritize upgrading their Digi On-Prem Manager instances to the patched version. Security teams must verify if the API feature is actively used and, if not, ensure it remains disabled to eliminate the attack vector entirely while scheduling the update.

Description Summary:
The CRM Memberships plugin for WordPress is susceptible to unauthenticated privilege escalation and account takeover via insecure AJAX endpoints.

Executive Summary:
The CRM Memberships plugin for WordPress contains a critical vulnerability that allows unauthenticated attackers to reset arbitrary user passwords and gain unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2025-13313

Affected Software: dripadmin CRM Memberships

Affected Versions: 0 through 2.6

Vulnerability: The plugin fails to perform authorization and authentication checks on the ntzcrm_changepassword and ntzcrm_get_users AJAX actions. This allows an unauthenticated attacker to enumerate user email addresses and subsequently trigger a password reset for any account, including those with administrative privileges.

Business Impact

The ability for an unauthenticated attacker to reset passwords for any user account poses a catastrophic risk to organizational security. Successful exploitation leads to full account takeover, potential data exfiltration, and total control over the WordPress environment. Given the CVSS score of 9.8, this vulnerability is classified as critical and requires immediate attention to prevent severe operational disruption and loss of sensitive information.

Remediation Plan

Immediate Action: Update the CRM Memberships plugin to the latest available version that includes the security patch. If an update is not immediately available, deactivate the plugin until a secure version can be deployed.

Proactive Monitoring: Review web server access logs for anomalous requests targeting ntzcrm_changepassword or ntzcrm_get_users endpoints. Monitor user account modification logs for unexpected password resets or unauthorized profile changes.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to the identified vulnerable AJAX endpoints. Restrict access to the WordPress administrative interface at the network level until the vulnerability is addressed.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit exists).

Analyst Notes: As of Dec 5, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible, as it requires no prior authentication and leverages standard AJAX functionality, making it a high-value target for automated scanning tools.

Analyst Recommendation

The severity of this vulnerability, combined with the ease of exploitation, necessitates an immediate response. Administrators must prioritize the application of the vendor patch or the removal of the plugin to eliminate the risk of total account compromise. Continued reliance on unpatched versions of this plugin exposes the entire WordPress instance to significant and preventable security threats.

Description Summary:
The Ocean Modal Window WordPress plugin is vulnerable to Remote Code Execution due to unsafe evaluation of user-controlled modal display conditions.

Executive Summary:
A critical vulnerability in the Ocean Modal Window plugin allows authenticated attackers with high privileges to achieve Remote Code Execution on the hosting server.

Vulnerability Details

CVE-ID: CVE-2025-13307

Affected Software: OceanWP Ocean Modal Window

Affected Versions: 0 up to 2.3.3

Vulnerability: The plugin utilizes an unsafe eval statement to process modal display conditions, which can be configured by users with the edit_pages capability. This flaw permits an authenticated attacker to inject arbitrary code that executes on every page of the site.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. With the ability to execute arbitrary code, an attacker can compromise sensitive data, modify site content, or use the server as a pivot point for further lateral movement within the network. Given the CVSS score of 7.2, this represents a significant risk to organizational integrity and data confidentiality.

Remediation Plan

Immediate Action: Update the Ocean Modal Window plugin to version 2.3.3 or later immediately to address the injection flaw.

Proactive Monitoring: Monitor server access logs and WordPress audit logs for suspicious activity or unexpected code execution patterns originating from administrative sessions.

Compensating Controls: Restrict access to administrative and editor-level accounts to authorized personnel only, and implement a Web Application Firewall (WAF) to detect and block common code injection payloads.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for high privileges mitigates the risk from external unauthenticated actors, but the impact remains severe.

Analyst Recommendation

Organizations utilizing the Ocean Modal Window plugin must prioritize updating to the patched version 2.3.3. Due to the nature of Remote Code Execution vulnerabilities, failure to patch leaves the entire application environment exposed to total compromise. Administrators should perform this update immediately and audit existing modal configurations for signs of unauthorized modification.

Description Summary:
A buffer overflow vulnerability in the Traceroute diagnostic function of multiple D-Link routers allows remote attackers to execute arbitrary code.

Executive Summary:
A critical buffer overflow vulnerability in multiple D-Link router models allows remote attackers to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2025-13305

Affected Software: D-Link DWR-M920, DWR-M921, DWR-M960, DIR-822K, and DIR-825M

Affected Versions: 1.01.07

Vulnerability: The vulnerability exists within the processing of the host argument in the /boafrm/formTracerouteDiagnosticRun endpoint. By manipulating this argument, a remote attacker with low privileges can trigger a buffer overflow, leading to memory corruption.

Business Impact

The exploitation of this flaw can lead to a total compromise of the affected routing hardware, allowing for unauthorized code execution. Given the CVSS score of 8.8, this represents a high risk that could facilitate network-wide eavesdropping, traffic redirection, or the use of these devices as entry points for lateral movement within the corporate network.

Remediation Plan

Immediate Action: Monitor the vendor support portal for official firmware updates and apply them to all affected devices as soon as they become available.

Proactive Monitoring: Review system logs for unusual diagnostic activity or repeated failed attempts to access routing configuration endpoints.

Compensating Controls: Restrict access to the router management interface to trusted internal IP addresses and employ a WAF or firewall rule to block unauthorized access to the /boafrm/ directory.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept is available via the referenced GitHub issue (https://github.com/LX-LX88/cve/issues/12).

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows remote manipulation of a diagnostic process that lacks sufficient input validation.

Analyst Recommendation

Due to the availability of a public proof of concept and the high severity of potential memory corruption, organizations should treat this vulnerability with high priority. We recommend isolating these devices from external network exposure until a vendor-supplied patch is successfully deployed.

Description Summary:
A buffer overflow vulnerability exists in the diagnostic ping function of multiple D-Link routers, allowing remote attackers to trigger memory corruption via the host argument.

Executive Summary:
A critical buffer overflow vulnerability in multiple D-Link router models allows remote attackers to execute arbitrary code or cause system instability.

Vulnerability Details

CVE-ID: CVE-2025-13304

Affected Software: D-Link DWR-M920, DWR-M921, DWR-M960, DWR-M961, and DIR-825M

Affected Versions: 1.01.07, 1.1.47

Vulnerability: This flaw involves a buffer overflow triggered by improper input validation within the /boafrm/formPingDiagnosticRun file. While the CVSS vector indicates low privileges are required, the vulnerability is reachable remotely and poses a significant risk to device integrity.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the affected routing hardware. Given the CVSS score of 8.8, the potential for unauthorized code execution poses severe risks to network confidentiality and availability, potentially allowing attackers to pivot into internal segments or intercept sensitive traffic.

Remediation Plan

Immediate Action: Since a specific patch is not yet confirmed, administrators should restrict access to the web management interface, disable the diagnostic ping feature if possible, or isolate these devices from public-facing networks.

Proactive Monitoring: Monitor network traffic for unusual diagnostic requests or malformed payloads targeting the /boafrm/formPingDiagnosticRun endpoint.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Prevention System with rules configured to inspect and block suspicious input strings directed at router management endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository reference.

Analyst Notes: As of November 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of buffer overflows in embedded web interfaces.

Analyst Recommendation

Due to the remote nature of this vulnerability and the confirmed existence of a public proof-of-concept, users must treat this as a high-priority risk. Administrators should immediately audit their network perimeter to identify affected D-Link hardware and apply the strictest possible access controls until an official firmware update from the vendor is verified and deployed.

Description Summary:
A SQL injection vulnerability exists in the itsourcecode Web-Based Internet Laboratory Management System 1.0, specifically within the subject controller component, allowing for remote data manipulation.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-13301

Affected Software: itsourcecode Web-Based Internet Laboratory Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the /subject/controller.php file, which fails to properly sanitize user input, allowing an unauthenticated attacker to manipulate backend database queries.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk to data integrity and confidentiality. Successful exploitation could allow an attacker to unauthorizedly access, modify, or delete sensitive laboratory management data, potentially leading to significant operational disruption and a breach of institutional data privacy.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected web application and disable the vulnerable functionality if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests directed at the /subject/controller.php endpoint, specifically looking for SQL syntax patterns or unexpected character strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue tracker.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger and targets a common database interaction point.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents an elevated risk to the environment. Organizations currently running version 1.0 of this system should prioritize isolating the application from external networks and implement strict input validation via WAF rules until a secure version is released.

Description Summary:
A SQL injection vulnerability exists in the Web-Based Internet Laboratory Management System 1.0 via the /settings/controller.php file, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-13300

Affected Software: itsourcecode Web-Based Internet Laboratory Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located within the /settings/controller.php file. The vulnerability allows an unauthenticated, remote attacker to manipulate database queries through the application.

Business Impact

Successful exploitation allows an attacker to inject arbitrary SQL commands into the backend database. This can lead to unauthorized data exposure, modification of database contents, or potential service disruption. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to the integrity and confidentiality of the system.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the management system to trusted internal networks only.

Proactive Monitoring: Review web server access logs for suspicious URL parameters containing SQL syntax or unusual characters directed at the /settings/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up on GitHub.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, users of this software are at elevated risk. Organizations must implement strict network-level access controls to ensure the application is not exposed to the public internet and continue to monitor vendor channels for the release of a security update.

Description Summary:
A SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via /user/controller.php.

Executive Summary:
The itsourcecode Web-Based Internet Laboratory Management System is vulnerable to a remote SQL injection flaw that could allow unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13299

Affected Software: itsourcecode Web-Based Internet Laboratory Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /user/controller.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing for the manipulation of backend database queries.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data stored within the system database. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or potential disruption of laboratory management operations.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the /user/controller.php endpoint via network-level controls or by disabling the affected functionality if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous request patterns, particularly those containing SQL syntax or unusual parameters directed at the /user/controller.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the researcher.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated nature and the relative ease of executing SQL injection attacks against the identified endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a clear vendor-provided patch, organizations utilizing this system must prioritize immediate mitigation. Restricting network access to the application and implementing WAF protections is essential to preventing potential unauthorized data access until a permanent security update is released.

Description Summary:
A SQL injection vulnerability exists in the Web-Based Internet Laboratory Management System 1.0, allowing unauthenticated remote attackers to manipulate database queries via the enrollment controller.

Executive Summary:
The Web-Based Internet Laboratory Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized database interaction and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-13298

Affected Software: itsourcecode Web-Based Internet Laboratory Management System

Affected Versions: 1.0

Vulnerability: This vulnerability involves an SQL injection flaw within the file /enrollment/controller.php, which can be triggered remotely by an unauthenticated attacker to manipulate backend database operations.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the underlying database. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive student or laboratory data, potential data destruction, or complete compromise of the system integrity, resulting in significant operational downtime and reputational damage.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the laboratory management system or disable the affected enrollment functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax, such as UNION, SELECT, or OR 1=1, directed at the /enrollment/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection patterns to provide virtual patching until a permanent fix is provided by the vendor.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher at https://github.com/f14g-orz/CVE/issues/4.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute malicious queries.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability represents a high risk to the availability and confidentiality of the affected management system. Organizations currently running version 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for unauthorized access attempts until a formal patch is made available by itsourcecode.

Description Summary:
A SQL injection vulnerability exists in the itsourcecode Web-Based Internet Laboratory Management System 1.0 via the /course/controller.php file, allowing remote unauthenticated attackers to execute code.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Web-Based Internet Laboratory Management System allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13297

Affected Software: itsourcecode Web-Based Internet Laboratory Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /course/controller.php file. This flaw allows an unauthenticated, remote attacker to manipulate database queries by injecting malicious SQL commands.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive laboratory data, potential modification of system records, or total database compromise. Given the CVSS score of 7.3, this represents a high-severity risk that requires immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should immediately restrict network access to the application or take the system offline until a fix is provided by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for unusual characters or SQL syntax within URL parameters targeting the /course/controller.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to mitigate the risk while the vulnerability remains unpatched.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided by the researcher at GitHub.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the database layer.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication and the presence of a public proof-of-concept. Organizations utilizing the itsourcecode Web-Based Internet Laboratory Management System must treat this as a high-priority incident. Until the vendor releases a security update, isolation of the affected system is the most effective method to prevent potential exploitation.

Description Summary:
The BILGER product from Argus Technology Inc. contains an insertion of sensitive information into sent data vulnerability, allowing for unauthorized message identifier exposure.

Executive Summary:
A vulnerability in Argus Technology Inc. BILGER allows for the unauthorized disclosure of sensitive data, posing a significant risk to information confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-13295

Affected Software: Argus Technology Inc. BILGER

Affected Versions: 0 up to (excluding) 2.4.9

Vulnerability: This is an insertion of sensitive information into sent data (CWE-201) vulnerability where the application fails to properly secure outbound data, allowing an unauthenticated attacker to choose a message identifier and potentially expose sensitive information.

Business Impact

The exposure of sensitive information via message identifiers can lead to unauthorized data access, potentially compromising proprietary information or user privacy. With a CVSS score of 7.5, this high severity flaw indicates that the vulnerability is easily exploitable over a network without requiring authentication, which could lead to significant data breaches if left unpatched.

Remediation Plan

Immediate Action: Update the Argus Technology Inc. BILGER software to version 2.4.9 or later to resolve the underlying data exposure flaw.

Proactive Monitoring: Review network traffic and application logs for anomalous message identifier patterns or unexpected outbound data transmissions that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or deep packet inspection tool to identify and block suspicious outbound data requests that contain sensitive information patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 2, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature, allowing an attacker to manipulate data identifiers to facilitate unauthorized information disclosure.

Analyst Recommendation

Given the high severity of this vulnerability and the potential for unauthorized sensitive data disclosure, administrators should prioritize the upgrade to version 2.4.9 immediately. Applying this patch is the only definitive way to close the exposure vector and protect against potential data exfiltration attempts.

Description Summary:
An unauthenticated SQL injection vulnerability in TBEA TLogger V2.1.0.0B0.0.0.0 allows remote attackers to read, modify, or delete data in the device database via unsanitized HTTP parameters.

Executive Summary:
TBEA TLogger devices are susceptible to a critical SQL injection vulnerability allowing unauthenticated remote attackers to manipulate device databases.

Vulnerability Details

CVE-ID: CVE-2025-13294

Affected Software: TBEA TLogger (TBEA Communication Box 3rd Generation)

Affected Versions: 0 through V2.1.0.0B0.0.0.0

Vulnerability: The web server component of the TBEA TLogger fails to properly validate or parameterize input for multiple HTTP endpoints. This allows an unauthenticated remote attacker to inject malicious SQL commands into the device's CCU.db database.

Business Impact

Exploitation of this vulnerability allows for the full compromise of data stored on the TBEA Communication Box. Given the critical 9.3 CVSS score, attackers could modify device settings or delete critical operational data, leading to significant system downtime and potential loss of control over industrial communication infrastructure.

Remediation Plan

Immediate Action: Contact TBEA support or consult the official vendor portal to obtain the latest firmware update for the TBEA Communication Box 3rd Generation.

Proactive Monitoring: Review device access logs for suspicious HTTP requests that contain SQL syntax, such as UNION, SELECT, or DROP commands.

Compensating Controls: Restrict network access to the TBEA TLogger web interface by placing it behind a secure VPN or an isolated management network accessible only to authorized personnel.

Exploitation Status

Public Exploit Available: No confirmed public exploit available.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the device suggests that it may be exposed in industrial environments, increasing the potential impact if targeted.

Analyst Recommendation

Due to the critical nature of this SQL injection vulnerability, immediate action is required to isolate affected devices from public networks. Organizations should work with TBEA to identify and apply the necessary firmware patches to remediate the vulnerability and secure the device interface.

Description Summary:
TBEA TLogger contains a hard-coded root credential, allowing an unauthenticated remote attacker to gain administrative access via SSH.

Executive Summary:
A critical vulnerability in TBEA TLogger devices exposes the root account to unauthenticated remote attackers via hard-coded credentials.

Vulnerability Details

CVE-ID: CVE-2025-13293

Affected Software: TBEA TLogger

Affected Versions: 0 through V2.1.0.0B0.0.0.0

Vulnerability: This is a hard-coded credential vulnerability (CWE-798) that allows an unauthenticated attacker to access the device as root. The attacker can retrieve the password hash from the device and gain full administrative control over the system via the SSH service.

Business Impact

The presence of a hard-coded root credential represents a total compromise of the affected device. With a CVSS score of 9.3, this flaw enables complete administrative takeover, potentially leading to unauthorized data access, total loss of device integrity, and potential use of the device for further network attacks.

Remediation Plan

Immediate Action: Update the TBEA TLogger firmware to the latest available version provided by the vendor. Ensure that default credentials are changed immediately upon update.

Proactive Monitoring: Monitor network traffic for unauthorized SSH connections originating from unknown or untrusted sources. Regularly audit system logs for unexpected administrative login events.

Compensating Controls: Restrict SSH access to the device to trusted management IP addresses only using firewall rules. Disable the SSH service if it is not required for daily operations.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Aug 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently high-risk due to the ease of access provided by hard-coded credentials.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Organizations utilizing TBEA TLogger must prioritize firmware updates and isolate affected devices from public-facing networks until patches are applied to prevent potential unauthorized access.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to remote SQL injection in the manufacturer/confirm_order.php file via manipulation of the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13291

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /manufacturer/confirm_order.php file. An unauthenticated attacker can exploit this by manipulating the ID parameter to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive supplier or order information stored within the application database. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data exfiltration or database compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected file or disable the vulnerable module until the vendor releases a security update.

Proactive Monitoring: Review application and database logs for suspicious SQL syntax, such as unexpected UNION, SELECT, or sleep commands, specifically targeting the confirm_order.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns and sanitize input for all HTTP requests targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation provided in the referenced GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, the risk of exploitation is elevated. Organizations currently running Campcodes Supplier Management System 1.0 must prioritize isolating the affected system from external networks and implementing strict WAF filtering to mitigate the threat until a vendor-supplied update is available.

Description Summary:
A buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1 allows remote attackers to trigger memory corruption via the delno argument in the fromPptpUserSetting function.

Executive Summary:
A critical memory corruption vulnerability in the Tenda CH22 router firmware could allow remote attackers to execute arbitrary code or cause a system crash.

Vulnerability Details

CVE-ID: CVE-2025-13288

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: This is a buffer overflow vulnerability (CWE-120) located in the fromPptpUserSetting function within the /goform/PPTPUserSetting endpoint. Attackers with low-level privileges can trigger this flaw by manipulating the delno argument, leading to potential remote code execution.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high level of risk to operational integrity. A successful exploit could lead to full system compromise of the affected network device, enabling attackers to gain unauthorized access to internal network traffic or disrupt critical communication services, resulting in significant downtime and potential data exfiltration.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, users should restrict access to the device management interface to trusted internal segments only and disable the PPTP functionality if it is not strictly required for operations.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/PPTPUserSetting endpoint and review device system logs for signs of unexpected crashes or reboots associated with unauthorized input.

Compensating Controls: Deploy a Web Application Firewall or an intrusion detection system capable of filtering malformed inputs to the administrative web interface to mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists on GitHub as referenced in the vulnerability disclosure.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a publicly disclosed exploit increases the likelihood of opportunistic attacks against exposed devices.

Analyst Recommendation

Given the remote exploitability and the existence of a public proof-of-concept, users must treat this vulnerability with high priority. Administrators should immediately isolate the affected Tenda CH22 devices from public-facing networks and monitor for vendor-provided firmware updates that address this memory corruption flaw.

Description Summary:
A SQL injection vulnerability exists in the login.php file of itsourcecode Online Voting System 1.0, allowing remote unauthenticated attackers to manipulate the Username argument.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode Online Voting System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13285

Affected Software: itsourcecode Online Voting System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the login.php file. The application fails to properly sanitize the Username argument, enabling an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

The ability to perform unauthenticated SQL injection poses a significant risk to the confidentiality, integrity, and availability of the voting database. With a CVSS score of 7.3, this high-severity flaw could allow an attacker to bypass authentication, extract sensitive user information, or modify voting records, leading to severe reputational damage and loss of trust in the system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the login portal and evaluate the necessity of the application until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous patterns in the Username field, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads directed at the login.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its accessibility to unauthenticated remote users.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing the itsourcecode Online Voting System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and maintain heightened monitoring until an official patch is provided by the vendor.

Description Summary:
ThinPLUS TPmCloud contains an OS command injection vulnerability, allowing unauthenticated remote attackers to execute arbitrary system commands on the host server.

Executive Summary:
A critical OS command injection vulnerability in ThinPLUS TPmCloud allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13284

Affected Software: ThinPLUS TPmCloud

Affected Versions: TPmCloud4.0

Vulnerability: This vulnerability is an OS command injection flaw (CWE-78) resulting from improper neutralization of special elements in system commands. It permits unauthenticated remote attackers to inject and execute arbitrary commands with the privileges of the application server.

Business Impact

The severity of this flaw is critical, as reflected by its CVSS score of 9.8. Successful exploitation allows for complete system takeover, unauthorized data exfiltration, and potential lateral movement within the network. Such an incident poses a severe risk to organizational data integrity and operational availability.

Remediation Plan

Immediate Action: Update the ThinPLUS TPmCloud installation to version TPmCloud4.2 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review system and application logs for unusual process execution or suspicious shell activity originating from the web service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common OS command injection payloads, such as shell metacharacters, in inbound HTTP requests.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of Nov 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, the nature of OS command injection makes this a highly attractive target for automated scanning and exploitation.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation, this vulnerability should be prioritized for immediate remediation. Administrators must verify their version status and apply the provided patch to version TPmCloud4.2 as soon as possible to prevent potential unauthorized access and system compromise.

Description Summary:
TenderDocTransfer contains a CSRF vulnerability and an absolute path traversal flaw, allowing unauthenticated remote attackers to copy arbitrary files on a user system via phishing.

Executive Summary:
A critical vulnerability in Chunghwa Telecom TenderDocTransfer allows unauthenticated remote attackers to perform unauthorized file operations, posing a significant risk of information leakage.

Vulnerability Details

CVE-ID: CVE-2025-13283

Affected Software: Chunghwa Telecom TenderDocTransfer

Affected Versions: 0 up to (excluding) 0.41.159

Vulnerability: The application lacks Cross-Site Request Forgery (CSRF) protections for its local web server APIs and contains an absolute path traversal flaw, which can be triggered by unauthenticated remote attackers through phishing lures.

Business Impact

The ability for an attacker to perform arbitrary file copy operations leads to unauthorized data access and potential information disclosure of sensitive local files. Given the CVSS score of 7.1, this vulnerability represents a high risk to business confidentiality and system integrity, as attackers can exfiltrate data or disrupt services by maliciously manipulating file paths.

Remediation Plan

Immediate Action: Upgrade the TenderDocTransfer application to version 0.41.159 or later immediately to resolve the identified API and path traversal vulnerabilities.

Proactive Monitoring: Review application access logs for unusual API requests, specifically those originating from external sources that attempt to interact with local file system paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) or equivalent network security policy to restrict access to the local web server APIs and block suspicious cross-origin requests that may indicate CSRF attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible due to the combination of CSRF and path traversal, which allows an attacker to weaponize a user-initiated action via phishing.

Analyst Recommendation

Organizations utilizing TenderDocTransfer must prioritize the upgrade to version 0.41.159. Until the patch is applied, users should exercise extreme caution regarding phishing emails or websites that might attempt to interact with local application APIs, as this is the primary vector for triggering the vulnerability.

Description Summary:
TenderDocTransfer contains a CSRF vulnerability and an absolute path traversal flaw, allowing unauthenticated remote attackers to trigger the deletion of arbitrary files via malicious phishing links.

Executive Summary:
Chunghwa Telecom TenderDocTransfer is vulnerable to arbitrary file deletion, posing a significant risk of system instability and data loss through unauthenticated remote exploitation.

Vulnerability Details

CVE-ID: CVE-2025-13282

Affected Software: Chunghwa Telecom TenderDocTransfer

Affected Versions: 0 up to (excluding) 0.41.159

Vulnerability: The application lacks Cross-Site Request Forgery (CSRF) protection on its local web server APIs, which, combined with an absolute path traversal flaw, allows an unauthenticated attacker to delete arbitrary files on the host system.

Business Impact

The ability for an unauthenticated attacker to delete arbitrary files on the host system creates a severe risk of service disruption, loss of critical business data, or total system compromise. With a CVSS score of 8.1, this vulnerability is classified as High, reflecting the potential for significant operational impact if the application is used to manage sensitive documents or system configurations.

Remediation Plan

Immediate Action: Update the TenderDocTransfer software to version 0.41.159 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unauthorized API requests or unusual file deletion patterns, particularly those originating from user web browsers.

Compensating Controls: Implement strict network access controls to limit access to the local web server APIs and utilize a web application firewall to block suspicious cross-site requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it chains CSRF with path traversal, enabling remote attackers to manipulate the local file system without prior authentication.

Analyst Recommendation

The combination of CSRF and path traversal in TenderDocTransfer presents a high-risk scenario that must be addressed promptly. Organizations should prioritize updating to version 0.41.159 to eliminate the underlying vulnerability and prevent potential remote file deletion attacks.

Description Summary:
CodeAstro Simple Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the login function, allowing remote attackers to manipulate the username parameter.

Executive Summary:
A critical SQL injection vulnerability in CodeAstro Simple Inventory System 1.0 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-13280

Affected Software: CodeAstro Simple Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located within the login functionality of the index.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands via the username argument.

Business Impact

The ability to perform unauthorized SQL queries against the database poses a significant risk to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this high-severity flaw could lead to full database compromise, unauthorized data extraction, or administrative account takeover, potentially causing severe reputational damage and operational disruption.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, users should restrict access to the login interface using network-level controls or consider disabling the service until a secure version is released.

Proactive Monitoring: Security teams should monitor web server logs for unusual SQL syntax or unexpected character patterns within the username field during authentication attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads directed at the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability presents an immediate risk to any deployment of CodeAstro Simple Inventory System 1.0. Organizations should assume an elevated risk profile and prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to prevent exploitation until the vendor provides a remediation update.