Description Summary:
A SQL injection vulnerability in the friendsphoto.php file of Nero Social Networking Site 1.0 allows remote, unauthenticated attackers to manipulate the ID argument to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in Nero Social Networking Site 1.0 allows remote, unauthenticated attackers to compromise database integrity, representing a significant risk to system data.

Vulnerability Details

CVE-ID: CVE-2025-13277

Affected Software: code-projects Nero Social Networking Site

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection due to improper sanitization of the ID parameter within the friendsphoto.php script. This flaw is remotely exploitable by an unauthenticated attacker, allowing them to interfere with database operations.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized data access, potential modification of sensitive records, and exposure of user information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and compromise of the application backend.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict access to the friendsphoto.php endpoint or disable the affected module until a security update is released.

Proactive Monitoring: Security teams should audit database logs for unusual query patterns or syntax errors that indicate SQL injection attempts targeting the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the friendsphoto.php file.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub repository.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it lacks basic input validation for user-supplied data in a critical database-facing function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations using Nero Social Networking Site 1.0 must treat this as a high-priority incident. If the software cannot be updated or the vulnerable functionality isolated, it should be removed from public-facing environments to prevent unauthorized database access.

Description Summary:
The g33kyrash Online-Banking-System is vulnerable to unauthenticated SQL injection via the Username parameter on the index.php page, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in g33kyrash Online-Banking-System poses a critical risk of unauthorized database manipulation and information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-13276

Affected Software: g33kyrash Online-Banking-System

Affected Versions: Up to 12dbfa690e5af649fb72d2e5d3674e88d6743455

Vulnerability: This is a SQL injection (CWE-89) vulnerability occurring in the /index.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to the unauthorized exfiltration of sensitive banking data, credential theft, or modification of transaction records. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality that could result in severe regulatory penalties and loss of customer trust.

Remediation Plan

Immediate Action: Since a formal patch is currently unavailable due to the rolling release nature of the software, administrators must restrict access to the affected index.php endpoint or disable the vulnerable functionality until the vendor provides a remediation.

Proactive Monitoring: Review web server and database logs for anomalous input patterns in the Username field, such as SQL keywords or special characters commonly used in injection attacks.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the application entry points.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists and is documented in the researcher write-up at the provided GitHub repository.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it requires no authentication and targets a common input parameter.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the urgency of this finding. Organizations utilizing this software must prioritize the implementation of compensating controls, such as WAF filtering, to mitigate the risk of SQL injection while awaiting a permanent software update from the developer.

Description Summary:
Campcodes School Fees Payment Management System 1.0 contains a remote SQL injection vulnerability in manage_course.php via the ID parameter.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes School Fees Payment Management System allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13272

Affected Software: Campcodes School Fees Payment Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the manage_course.php file, where insufficient input validation on the ID argument allows an unauthenticated attacker to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated remote attacker to inject SQL commands poses a significant threat to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or financial records stored within the database, potentially resulting in data exfiltration or system compromise. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized database manipulation.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict network access to the application or disable the vulnerable manage_course.php file if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests containing SQL syntax or unusual parameters targeting the manage_course.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the research documentation provided by ASantsSec on GitHub.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the backend database.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of an official patch makes this a high-priority risk. Organizations utilizing this system must implement immediate network-level protections or WAF filtering to mitigate the threat of remote SQL injection. Security teams should prioritize moving this application behind restrictive access controls until the vendor provides a secure update.

Description Summary:
Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the login function, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0 poses a significant risk of unauthorized database interaction and potential information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-13271

Affected Software: Campcodes School Fees Payment Management System

Affected Versions: 1.0

Vulnerability: The vulnerability exists within the ajax.php file, specifically via the login action. An unauthenticated attacker can inject malicious SQL commands into the Username parameter, leading to unauthorized database manipulation.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands presents a high risk to data integrity and confidentiality. With a CVSS score of 7.3, this flaw could allow an attacker to bypass authentication mechanisms, access sensitive student or financial records, or potentially modify system data. Such an incident could result in significant operational disruption and loss of sensitive institutional information.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web interface or implement input validation controls to sanitize the Username parameter. If possible, disable the vulnerable login functionality until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious patterns or anomalous characters in login requests directed at ajax.php. Monitor database query logs for unexpected syntax errors or unauthorized access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization in the login module.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes School Fees Payment Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, to mitigate the risk until the vendor releases a formal security patch. Continuous monitoring for signs of unauthorized access is essential for maintaining the security posture of the affected system.

Description Summary:
A path traversal vulnerability in the lsfusion platform allows remote attackers to manipulate the sid argument in the UploadFileRequestHandler to access unauthorized files.

Executive Summary:
The lsfusion platform contains a path traversal vulnerability that permits remote, unauthenticated attackers to access system files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-13262

Affected Software: lsfusion platform

Affected Versions: 6.0, 6.1

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) located in the UploadFileRequestHandler function within the platform web-client module. An unauthenticated attacker can exploit this remotely by supplying malicious input to the sid parameter.

Business Impact

The ability to perform path traversal allows unauthorized actors to read sensitive configuration files or system data, potentially leading to full system compromise or information disclosure. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized access to sensitive business information stored on the server.

Remediation Plan

Immediate Action: As no official patch is currently listed, administrators should restrict network access to the affected web-client interface and monitor the platform for any suspicious file access requests.

Proactive Monitoring: Review application access logs for unusual patterns in the sid argument, specifically looking for directory traversal sequences such as double dots or encoded path separators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing directory traversal sequences directed at the UploadFileRequestHandler endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists (referenced in the GitHub issue linked in the vulnerability documentation).

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a credible risk to the integrity of the lsfusion platform. Organizations should prioritize implementing defensive filtering at the network perimeter and coordinate with the vendor to monitor for official security updates.

Description Summary:
A buffer overflow vulnerability in the Tenda AC20 router allows remote attackers to trigger a denial of service or remote code execution via a crafted HTTP POST request to the WifiExtraSet endpoint.

Executive Summary:
A buffer overflow vulnerability in Tenda AC20 routers poses a critical risk of remote code execution or system crashes due to insufficient input validation.

Vulnerability Details

CVE-ID: CVE-2025-13258

Affected Software: Tenda AC20

Affected Versions: Tenda AC20: 16.03.08.0, 16.03.08.1, 16.03.08.2, 16.03.08.3, 16.03.08.4, 16.03.08.5, 16.03.08.6, 16.03.08.7, and up to 16.03.08.12.

Vulnerability: This is a buffer overflow vulnerability located in the /goform/WifiExtraSet endpoint. It occurs because the wpapsk_crypto argument lacks proper boundary checks, allowing a remote attacker to trigger memory corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. A successful attack can result in immediate denial of service, rendering the router unusable, or potential remote code execution, which could allow an unauthorized party to gain control over the network device and intercept traffic.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, administrators should restrict management access to the device to trusted local networks only and disable remote administration features.

Proactive Monitoring: Monitor device logs for abnormal HTTP POST requests directed at the /goform/WifiExtraSet endpoint and watch for unexpected device reboots or service outages.

Compensating Controls: Implement firewall rules to block inbound access to the router management interface from untrusted sources and utilize an Intrusion Detection System (IDS) to identify potential buffer overflow patterns in incoming traffic.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept is available via the researcher write-up published on GitHub.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of memory safety checks in the underlying strcpy function.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of this buffer overflow, immediate steps must be taken to harden the affected Tenda AC20 devices. Administrators should ensure these routers are not exposed to the public internet and verify firmware updates regularly for a vendor-supplied fix to resolve the memory corruption flaw.

Description Summary:
The itsourcecode Inventory Management System version 1.0 contains a SQL injection vulnerability in the admin user edit function, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Inventory Management System allows remote attackers to compromise database integrity and potentially access sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-13257

Affected Software: itsourcecode Inventory Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the file /admin/user/index.php within the edit view. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the ID argument.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the exfiltration of user credentials or administrative data. With a CVSS score of 7.3, this flaw poses a high risk to organizational data confidentiality and integrity. If the database user has elevated privileges, the impact could extend to full system compromise or unauthorized administrative actions.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin directory using network-level controls or IP allowlisting.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the /admin/user/index.php endpoint, specifically looking for unusual patterns in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running the affected version of the Inventory Management System should prioritize restricting access to the administrative interface immediately and monitor for unauthorized activity until a permanent vendor patch is released.

Description Summary:
ShopSuite ModulithShop contains a hard-coded credentials vulnerability in its RSA, OAuth2, or database components, which can be exploited by remote, unauthenticated attackers.

Executive Summary:
A critical hard-coded credentials vulnerability in shsuishang ShopSuite ModulithShop allows remote attackers to gain unauthorized access to system components.

Vulnerability Details

CVE-ID: CVE-2025-13252

Affected Software: shsuishang ShopSuite ModulithShop

Affected Versions: Up to commit 45a99398cec3b7ad7ff9383694f0b53339f2d35a

Vulnerability: The software utilizes hard-coded credentials within its RSA, OAuth2, or database management modules. This flaw is remotely exploitable by unauthenticated attackers, potentially allowing unauthorized access to sensitive system functions.

Business Impact

The presence of hard-coded credentials presents a significant security risk, as it bypasses traditional authentication mechanisms. With a CVSS score of 7.3, this high-severity flaw could lead to full system compromise, unauthorized data access, or the manipulation of business-critical transactions if exploited by malicious actors.

Remediation Plan

Immediate Action: Since no formal patch is currently available, administrators should immediately isolate the affected instance from public networks and rotate any credentials or keys associated with the RSA and OAuth2 modules.

Proactive Monitoring: Review authentication logs and system access records for unusual login patterns or unauthorized access attempts targeting the administrative or database interfaces.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter suspicious traffic and consider implementing additional network-level access controls to restrict access to the application endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue tracker referenced by the CVE record.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, the availability of a public proof-of-concept renders the exploitation risk credible. The nature of this flaw makes it inherently easy to exploit for attackers with network access to the application.

Analyst Recommendation

Given the exposure of hard-coded credentials and the availability of a public exploit, this vulnerability poses an immediate threat to the confidentiality and integrity of the application. Organizations must prioritize restricting access to the affected components and monitor for signs of unauthorized activity until a vendor-supplied security update is released to remove the hard-coded values.

Description Summary:
A SQL injection vulnerability in the Patients Waiting Area Queue Management System allows remote unauthenticated attackers to manipulate the appointmentID argument via the api_patient_schedule.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Patients Waiting Area Queue Management System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-13248

Affected Software: SourceCodester Patients Waiting Area Queue Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection through the appointmentID parameter in the /php/api_patient_schedule.php script. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection can lead to the unauthorized disclosure, modification, or deletion of sensitive patient data. With a CVSS score of 7.3, this high-severity flaw threatens the confidentiality and integrity of the system, potentially leading to regulatory non-compliance and loss of patient trust.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected web directory or disable the vulnerable component entirely.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting /php/api_patient_schedule.php, specifically those containing common SQL injection patterns or unusual characters in the appointmentID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with signatures configured to detect and block SQL injection attempts directed at the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations using this software must treat this as a high-priority risk. Administrators should immediately implement defensive measures such as WAF rules or network segmentation until a formal vendor update is released and verified.

Description Summary:
PHPGurukul Tourism Management System 1.0 contains a SQL injection vulnerability in the admin/user-bookings.php file via the uid parameter, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Tourism Management System 1.0 permits remote unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13247

Affected Software: PHPGurukul Tourism Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection (CWE-89) triggered by improper sanitization of the uid parameter within the /admin/user-bookings.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The ability to perform unauthorized SQL queries against the application database poses a significant risk to data confidentiality and integrity. Given the 7.3 CVSS score, this vulnerability could lead to the exposure of sensitive user booking information or administrative credentials, potentially resulting in unauthorized system access and severe reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until the vendor releases a security update.

Proactive Monitoring: Review application and web server access logs for anomalous patterns, such as SQL syntax characters or unexpected query parameters directed at the user-bookings.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation via simple URL parameter manipulation.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, organizations must treat this vulnerability with high priority. We strongly recommend implementing immediate network-level access controls to isolate the affected administrative components from the public internet. Continue to monitor the vendor website for official security updates and apply them immediately upon release.

Description Summary:
A SQL injection vulnerability exists in the register.php file of code-projects Student Information System 2.0, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Student Information System 2.0 poses a critical risk of database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-13242

Affected Software: code-projects Student Information System

Affected Versions: 2.0

Vulnerability: The application suffers from a SQL injection flaw in the register.php file because it fails to properly sanitize the username parameter before concatenating it into a database query. This vulnerability is remotely exploitable by an unauthenticated attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. This may lead to the unauthorized disclosure of sensitive student records, modification of user accounts, or potential administrative access to the system, resulting in significant data breach and reputational damage. While the CVSS score is 7.3, the remote and unauthenticated nature of the attack makes this a high-priority risk.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the registration page or take the application offline until the vendor provides a security update.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to register.php and monitor database logs for suspicious SQL syntax patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the registration endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub research write-up.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization in a public-facing registration form.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations using Student Information System 2.0 should prioritize the implementation of compensating controls or isolate the instance until the vendor releases a secure version, as unauthenticated remote database access represents a severe security failure.

Description Summary:
A SQL injection vulnerability exists in the index.php file of Student Information System 2.0, allowing unauthenticated attackers to manipulate the username parameter to execute arbitrary SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in Code-Projects Student Information System 2.0 allows remote attackers to compromise database integrity and potentially gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2025-13241

Affected Software: Code-Projects Student Information System

Affected Versions: 2.0

Vulnerability: The application fails to properly sanitize the username parameter within the index.php file before incorporating it into a database query. This oversight allows an unauthenticated attacker to inject malicious SQL statements directly into the authentication process.

Business Impact

Successful exploitation of this flaw can lead to unauthorized access to student records, potential credential theft, and full database compromise. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and application availability, which could lead to severe reputational damage and regulatory non-compliance regarding sensitive student information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected index.php file using network-level controls or by placing the application behind a VPN.

Proactive Monitoring: Review web server access logs for anomalous POST requests to index.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of November 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute the malicious query.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, immediate action is required to secure the affected instance. If the vendor does not provide a security update, consider migrating to a more secure system or implementing strict input validation within the source code to sanitize all user-supplied data before database interaction.

Description Summary:
A SQL injection vulnerability exists in the searchquery.php file of code-projects Student Information System 2.0, allowing unauthenticated remote attackers to manipulate the s parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Student Information System 2.0 allows unauthenticated remote attackers to perform unauthorized database operations.

Vulnerability Details

CVE-ID: CVE-2025-13240

Affected Software: code-projects Student Information System

Affected Versions: 2.0

Vulnerability: The application is vulnerable to SQL injection due to improper neutralization of the s parameter within the searchquery.php file. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands by supplying malicious input to the application.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive student data, potential modification of database records, or full compromise of the backend database. With a CVSS score of 7.3, the vulnerability presents a high risk to data confidentiality and integrity, as it does not require prior authentication to execute.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected web directory or disable the search functionality until a secure update is provided by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for anomalous GET requests targeting searchquery.php, particularly those containing SQL syntax or unusual string patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub repository.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization on the search parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations should prioritize isolating the vulnerable component and implement strict input validation or WAF protections immediately to prevent potential data breaches.

Description Summary:
The Inventory Management System 1.0 is vulnerable to remote SQL injection via the U_USERNAME parameter in the LogSignModal.PHP file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode Inventory Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13237

Affected Software: itsourcecode Inventory Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the U_USERNAME argument within the LogSignModal.PHP file. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. With a CVSS score of 7.3, this high severity flaw could lead to unauthorized data exfiltration, modification of inventory records, or potential administrative account takeover, resulting in operational disruption and loss of trust.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict access to the affected module or take the application offline until a secure version is provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to LogSignModal.PHP, specifically looking for SQL syntax patterns or unexpected character strings in the U_USERNAME parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Security teams must prioritize isolating the affected component and implementing robust input validation or WAF protections to prevent unauthorized database access until the vendor releases a formal security update.

Description Summary:
A SQL injection vulnerability in the itsourcecode Inventory Management System allows remote unauthenticated attackers to manipulate database queries via the user_email parameter in login.php.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Inventory Management System, version 1.0, allows unauthenticated remote attackers to manipulate backend database queries.

Vulnerability Details

CVE-ID: CVE-2025-13235

Affected Software: itsourcecode Inventory Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the /admin/login.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the user_email parameter to compromise database integrity.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive administrative credentials or the exposure of proprietary inventory data. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate further system compromise or data exfiltration.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected administrative login page using network-level controls or IP allowlisting.

Proactive Monitoring: Monitor server access logs for suspicious patterns in the /admin/login.php endpoint, specifically looking for characters commonly used in SQL injection attempts such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the user_email parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on a publicly accessible authentication endpoint.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the relative ease of exploitation for unauthenticated actors, this vulnerability presents an immediate risk. Organizations utilizing this software must prioritize isolating the affected component from external networks until the vendor releases a security update. Continuous monitoring of authentication logs is essential to detect potential exploitation attempts until a permanent patch is applied.

Description Summary:
A SQL injection vulnerability in the itsourcecode Inventory Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID argument in index.php.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Inventory Management System 1.0 permits unauthenticated remote attackers to execute unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2025-13233

Affected Software: itsourcecode Inventory Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the index.php file, specifically within the single-item function. An unauthenticated attacker can supply malicious input via the ID parameter to interact directly with the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of the inventory data. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exposure, potential modification of inventory records, or total database compromise, which would disrupt business operations and undermine data security.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected application by placing it behind a secure VPN or an authenticated proxy.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing SQL syntax patterns targeting the index.php file with the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection attempts targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the GitHub repository referenced in the vulnerability disclosures.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature and the lack of complex requirements for successful exploitation.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing the itsourcecode Inventory Management System must prioritize isolating the application from the public internet until a vendor-supplied patch is developed and verified. Implementing strict WAF filtering is the most viable strategy for reducing the immediate risk of exploitation.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity type confusion vulnerability in Google Chrome allows remote attackers to cause heap corruption, potentially leading to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-13230

Affected Software: Google Chrome

Affected Versions: Versions prior to 142.0.7444.59

Vulnerability: This is a type confusion vulnerability (CWE-843) within the V8 JavaScript engine. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a malicious website, leading to heap corruption.

Business Impact

Successful exploitation of this vulnerability can result in full system compromise, as it allows for arbitrary code execution within the context of the browser. Given the CVSS score of 8.8, this poses a significant risk to organizational data integrity and confidentiality, potentially allowing attackers to bypass security controls and gain unauthorized access to the underlying host system.

Remediation Plan

Immediate Action: Update all Google Chrome installations to version 142.0.7444.59 or later immediately.

Proactive Monitoring: Monitor browser-based traffic for suspicious patterns or anomalous redirects to unknown domains, and audit endpoint logs for unexpected process execution originating from the browser.

Compensating Controls: Utilize enterprise browser management policies to restrict the execution of untrusted scripts and ensure that security features like site isolation are strictly enforced across all managed endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires user interaction, the technical impact of heap corruption in the V8 engine is severe and historically represents a high-priority target for threat actors.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate organization-wide update to the latest version of Google Chrome. Security teams should treat this as a high-priority deployment to prevent potential remote code execution attacks targeting browser users.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity type confusion vulnerability in the Google Chrome V8 engine could allow a remote attacker to achieve heap corruption, potentially leading to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-13229

Affected Software: Google Chrome

Affected Versions: Versions prior to 142.0.7444.59

Vulnerability: This flaw exists within the V8 JavaScript engine, where improper handling of object types allows for type confusion. An unauthenticated remote attacker can trigger this vulnerability by enticing a user to visit a specially crafted HTML page.

Business Impact

The exploitation of this vulnerability can lead to heap corruption, which is a common precursor to arbitrary code execution within the browser context. With a CVSS score of 8.8, this represents a significant threat to user workstations and corporate data, potentially facilitating unauthorized system access or the deployment of malicious payloads.

Remediation Plan

Immediate Action: Update Google Chrome to version 142.0.7444.59 or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor endpoint logs for unusual browser crashes or unexpected process behavior that may indicate an attempted exploit.

Compensating Controls: Utilize browser-based security policies, such as disabling JavaScript for untrusted sites or employing endpoint protection platforms that detect memory corruption patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the V8 engine is a frequent target for browser-based attacks, and the technical impact is classified as total.

Analyst Recommendation

Given the potential for remote code execution and the high CVSS severity rating, this update should be treated with high priority. System administrators should ensure that all instances of the Google Chrome browser are updated to the patched version across the enterprise to eliminate the risk of exploitation through malicious web content.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity type confusion vulnerability in the Google Chrome V8 engine could allow a remote attacker to achieve arbitrary code execution or system compromise via a malicious webpage.

Vulnerability Details

CVE-ID: CVE-2025-13228

Affected Software: Google Chrome

Affected Versions: Prior to 142.0.7444.59

Vulnerability: This flaw exists within the V8 JavaScript engine and is classified as a type confusion vulnerability. An unauthenticated remote attacker can trigger this issue by enticing a user to visit a specially crafted HTML page, potentially leading to heap corruption.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it facilitates unauthorized code execution within the browser context. Given the CVSS score of 8.8, successful exploitation could lead to full system compromise, data exfiltration, or the installation of persistent malware, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Update all Google Chrome instances to version 142.0.7444.59 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for unusual browser process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Deploy endpoint protection solutions that can detect and block malicious web traffic and utilize browser-based security policies to limit the execution of untrusted scripts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Type confusion flaws in V8 are historically high-value targets for remote code execution chains, and they should be remediated with high priority.

Analyst Recommendation

Due to the critical nature of browser-based vulnerabilities and the potential for remote code execution, organizations must prioritize the deployment of the latest Chrome security updates. Ensure that automatic update mechanisms are enabled and verify that all managed endpoints have successfully transitioned to the patched version to mitigate this risk.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A high-severity type confusion vulnerability in the Google Chrome V8 engine could allow a remote attacker to achieve arbitrary code execution or system compromise via a malicious webpage.

Vulnerability Details

CVE-ID: CVE-2025-13227

Affected Software: Google Chrome

Affected Versions: Prior to 142.0.7444.59

Vulnerability: This is a Type Confusion (CWE-843) vulnerability within the V8 JavaScript engine, which can be triggered by an unauthenticated remote attacker through a specially crafted HTML page, leading to heap corruption.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to execute arbitrary code within the context of the browser, which could result in unauthorized data access, the installation of malware, or full system compromise for the end user.

Remediation Plan

Immediate Action: Update Google Chrome to version 142.0.7444.59 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Security teams should monitor endpoint logs for unusual browser crashes or unexpected process behavior that may indicate an attempt to trigger heap corruption.

Compensating Controls: While a WAF cannot prevent client-side browser exploits, enforcing strict content security policies and disabling unnecessary browser features may reduce the attack surface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Browser-based type confusion flaws are frequently targeted by attackers due to the high reliability of memory corruption primitives they provide.

Analyst Recommendation

Given the high CVSS score and the nature of V8 engine vulnerabilities, this flaw presents a significant risk to organizational endpoints. Administrators must prioritize the deployment of the latest Chrome browser updates across all managed devices to mitigate the risk of remote code execution.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows a remote attacker to perform heap corruption via a crafted HTML page.

Executive Summary:
A critical type confusion vulnerability in Google Chrome's V8 engine could allow a remote attacker to achieve system compromise through heap corruption via a malicious webpage.

Vulnerability Details

CVE-ID: CVE-2025-13226

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 142.0.7444.59

Vulnerability: This is a type confusion vulnerability (CWE-843) occurring within the V8 JavaScript engine. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a specially crafted HTML page, leading to heap corruption.

Business Impact

The exploitation of this vulnerability carries a high impact due to the potential for remote code execution or unauthorized system access. With a CVSS score of 8.8, this flaw poses a significant risk to organizational endpoints by enabling attackers to bypass browser security boundaries. Successful exploitation could lead to full system compromise, data theft, or the installation of malicious software on the host machine.

Remediation Plan

Immediate Action: Update Google Chrome to version 142.0.7444.59 or later immediately to incorporate the security patches provided by the vendor.

Proactive Monitoring: Security teams should monitor endpoint logs for browser crashes or anomalous memory access patterns that may indicate attempts to trigger heap corruption.

Compensating Controls: While browser-level patching is the only definitive fix, ensure that endpoint detection and response (EDR) solutions are active to identify and block suspicious child processes spawned by the browser.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. V8 type confusion flaws are common targets for browser-based exploitation and should be addressed with high priority to prevent potential weaponization.

Analyst Recommendation

Given the high CVSS severity rating and the nature of V8 vulnerabilities, this update must be prioritized for all managed workstations. Organizations should enforce the update across their fleet immediately to mitigate the risk of remote heap corruption attacks.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows remote attackers to trigger heap corruption via a crafted HTML page.

Executive Summary:
A critical type confusion vulnerability in Google Chrome versions prior to 142.0.7444.175 poses a severe risk of remote code execution or system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13224

Affected Software: Google Chrome

Affected Versions: Versions prior to 142.0.7444.175

Vulnerability: This is a type confusion flaw (CWE-843) within the V8 JavaScript engine, which can be triggered by a remote, unauthenticated attacker through the presentation of a specially crafted HTML page. Successful exploitation leads to heap corruption, potentially allowing the execution of arbitrary code within the context of the browser.

Business Impact

The CVSS score of 8.8 indicates a high-severity risk, primarily due to the potential for total loss of confidentiality, integrity, and availability. If exploited, an attacker could compromise user systems, exfiltrate sensitive data, or install malicious software, leading to significant reputational damage and potential operational disruption within an enterprise environment.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 142.0.7444.175 or later immediately to resolve the vulnerable V8 component.

Proactive Monitoring: Monitor browser-based traffic for unusual patterns and review endpoint security logs for signs of anomalous process behavior related to the Chrome executable.

Compensating Controls: Utilize endpoint protection platforms with behavior monitoring to detect and block malicious heap manipulation attempts, and ensure users are restricted from navigating to untrusted or suspicious web domains.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the risk of remote code execution is high, the requirement for user interaction (UI:R) slightly mitigates the immediate attack surface.

Analyst Recommendation

Given the nature of V8 vulnerabilities in modern browsers, this flaw represents a significant security risk to organizational endpoints. IT administrators should prioritize the deployment of the Google Chrome stable channel update across the fleet to address this vulnerability and protect against potential exploitation.

Description Summary:
A type confusion vulnerability in the V8 engine of Google Chrome allows a remote attacker to achieve heap corruption via a crafted HTML page.

Executive Summary:
A critical type confusion vulnerability in the Google Chrome V8 engine is currently being exploited in the wild, posing a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-13223

Affected Software: Google Chrome

Affected Versions: Google Chrome prior to 142.0.7444.175

Vulnerability: This is a type confusion flaw within the V8 JavaScript engine. An unauthenticated remote attacker can trigger heap corruption by enticing a user to visit a specially crafted HTML page.

Business Impact

The ability to trigger heap corruption remotely presents a significant threat to organizational security. Successful exploitation could lead to arbitrary code execution, potentially resulting in complete system compromise, data theft, or the installation of malicious software. Given the CVSS score of 9.5 and the confirmation of active exploitation in the wild, this vulnerability represents an immediate and critical risk to business operations.

Remediation Plan

Immediate Action: Update all instances of Google Chrome to version 142.0.7444.175 or later immediately.

Proactive Monitoring: Monitor network traffic for unusual browser behavior and review endpoint security logs for signs of anomalous process execution originating from browser sessions.

Compensating Controls: While no direct virtual patch exists, deploying robust endpoint detection and response (EDR) solutions and ensuring browser sandboxing features remain enabled can help limit the impact of potential exploits.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of November 18, 2025. Type confusion bugs in the V8 engine are frequently targeted by threat actors due to their reliability in bypassing modern browser security protections.

Analyst Recommendation

Due to the critical severity and confirmed active exploitation of this vulnerability, organizations must prioritize the immediate deployment of the patched version of Google Chrome across all endpoints. Delaying this update exposes the enterprise to a high probability of compromise by sophisticated adversaries currently leveraging this flaw.

Description Summary:
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 are vulnerable to SQL injection, allowing authenticated remote attackers to manipulate back-end database information.

Executive Summary:
A critical SQL injection vulnerability in IBM Aspera Orchestrator 4.0.0 through 4.1.0 allows authenticated remote attackers to compromise the integrity and confidentiality of back-end database information.

Vulnerability Details

CVE-ID: CVE-2025-13214

Affected Software: IBM Aspera Orchestrator

Affected Versions: 4.0.0 through 4.1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by the improper neutralization of special elements in SQL commands. An authenticated remote attacker can inject crafted SQL statements to view, modify, or delete data within the underlying database.

Business Impact

The ability to manipulate the back-end database poses a significant risk to data confidentiality, integrity, and availability. With a CVSS score of 7.6, this vulnerability warrants high priority as it could lead to unauthorized data exfiltration or the destruction of critical operational records, potentially causing severe service disruption or regulatory compliance failures.

Remediation Plan

Immediate Action: Upgrade to IBM Aspera Orchestrator version 4.1.1 or later to fully remediate the vulnerability.

Proactive Monitoring: Review database access logs for unusual queries or unauthorized attempts to access or modify data tables.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to inspect and block malicious traffic targeting the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the potential for unauthorized data modification makes it a significant target for lateral movement within a compromised environment.

Analyst Recommendation

Given the potential for database compromise, organizations should prioritize the deployment of the 4.1.1 patch. While the vulnerability requires an authenticated attacker, internal threats or compromised user credentials make this a high-risk vector that must be addressed immediately to prevent data loss or manipulation.

Description Summary:
The GiveWP plugin for WordPress is vulnerable to stored cross-site scripting via the name parameter due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious scripts.

Executive Summary:
A critical stored cross-site scripting vulnerability in the GiveWP WordPress plugin allows unauthenticated attackers to execute arbitrary web scripts in the browser of site visitors.

Vulnerability Details

CVE-ID: CVE-2025-13206

Affected Software: StellarWP GiveWP – Donation Plugin and Fundraising Platform

Affected Versions: 0 through 4.13.0

Vulnerability: The vulnerability is a stored cross-site scripting (CWE-79) flaw triggered via the name parameter. It allows unauthenticated attackers to inject malicious scripts that execute when a user accesses the affected page, provided that avatars are enabled in the WordPress installation.

Business Impact

This vulnerability poses a significant risk to site integrity and user security. Successful exploitation allows attackers to steal session cookies, redirect users to malicious websites, or perform unauthorized actions on behalf of site administrators, potentially leading to full site compromise. With a CVSS score of 7.2, the high impact on confidentiality and integrity necessitates immediate attention to prevent unauthorized script execution.

Remediation Plan

Immediate Action: Update the GiveWP – Donation Plugin and Fundraising Platform to the latest version available (ensure the version is beyond 4.13.0) as specified by the vendor advisory.

Proactive Monitoring: Monitor WordPress access logs for suspicious POST requests targeting donation or profile update endpoints that contain script tags or encoded characters in the name parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with active cross-site scripting protection rules to detect and block malicious input payloads targeting the donation platform.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the injection vector.

Analyst Recommendation

Given the high risk of cross-site scripting and the unauthenticated nature of the attack vector, organizations using GiveWP must prioritize patching this plugin immediately. Administrators should verify their current version and apply the vendor-supplied update to eliminate the sanitization failure before the flaw is weaponized in the wild.

Description Summary:
The npm package expr-eval is vulnerable to Prototype Pollution, allowing unauthenticated attackers to achieve arbitrary code execution via the JavaScript prototype-based inheritance model.

Executive Summary:
A critical prototype pollution vulnerability in the expr-eval npm package allows unauthenticated remote attackers to achieve arbitrary code execution on systems processing malicious input.

Vulnerability Details

CVE-ID: CVE-2025-13204

Affected Software: silentmatt expr-eval

Affected Versions: 0 through 2.0.2

Vulnerability: The vulnerability stems from improper control over object prototype attributes (CWE-1321). An unauthenticated attacker can manipulate the JavaScript prototype chain through the express eval interface to execute arbitrary code within the context of the application.

Business Impact

Successful exploitation of this flaw can lead to a full compromise of the application server, allowing for unauthorized data access, modification, or complete system takeover. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the integrity and availability of any infrastructure utilizing the affected package for expression evaluation.

Remediation Plan

Immediate Action: Migrate from the vulnerable expr-eval package to the expr-eval-fork package, which resolves this issue in version 2.0.2.

Proactive Monitoring: Review application logs for unusual JavaScript object property modifications or attempts to access restricted system modules like child_process or fs.

Compensating Controls: Implement input validation to sanitize expressions before they reach the eval interface and consider deploying a Web Application Firewall with rules configured to block common prototype pollution injection patterns.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced in the CVE record.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct nature of the eval injection vector.

Analyst Recommendation

Organizations using the silentmatt expr-eval package must prioritize migrating to the maintained expr-eval-fork repository immediately. Given the availability of public proof-of-concept code and the high potential impact of arbitrary code execution, this remediation is necessary to prevent unauthorized system access.

Description Summary:
Simple Cafe Ordering System 1.0 contains a SQL injection vulnerability in the addmem.php file via the studentnum argument, allowing remote unauthenticated attackers to execute malicious database queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Cafe Ordering System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13203

Affected Software: code-projects Simple Cafe Ordering System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection through the studentnum parameter in the addmem.php file. This flaw permits an unauthenticated remote attacker to manipulate database queries, potentially leading to unauthorized data access or modification.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could result in the exfiltration of sensitive user information, unauthorized administrative access, or complete compromise of the underlying database, warranting the high CVSS score of 7.3.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and disable the vulnerable functionality if possible.

Proactive Monitoring: Monitor web server and database logs for suspicious SQL syntax patterns, such as UNION, SELECT, or OR 1=1, originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads targeting the studentnum parameter.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation for unauthenticated users, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize the isolation of the Simple Cafe Ordering System until a vendor-supplied security update is released and applied to remediate the underlying code flaw.

Description Summary:
The Simple Cafe Ordering System version 1.0 is vulnerable to SQL injection via the Username parameter in login.php, allowing unauthenticated remote attackers to compromise the database.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Cafe Ordering System allows attackers to bypass authentication and execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-13201

Affected Software: code-projects Simple Cafe Ordering System

Affected Versions: 1.0

Vulnerability: The application fails to sanitize user-supplied input before incorporating it into SQL queries, using insecure legacy database functions. This flaw permits an unauthenticated remote attacker to manipulate database queries via the Username parameter to perform authentication bypass or data extraction.

Business Impact

A successful exploit allows an unauthorized actor to bypass authentication, potentially gaining full administrative access to the system. This can lead to total data compromise, including user credentials and transaction records, as well as the ability to manipulate business logic such as order placement. Given the CVSS score of 7.3, this represents a significant risk to the integrity and confidentiality of the application data.

Remediation Plan

Immediate Action: As no official vendor patch is available, developers must manually replace all instances of the deprecated mysql_* functions with PDO or mysqli using parameterized queries and prepared statements.

Proactive Monitoring: Security teams should monitor web server and database logs for anomalous query patterns, such as the use of SQL comment syntax or boolean logic characters in input fields, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block common SQL injection payloads, such as tautologies or union-based queries, to provide virtual patching until the source code can be remediated.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up linked in the CVE references.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input validation and the use of dangerous, legacy database connection methods.

Analyst Recommendation

The presence of a publicly available proof-of-concept combined with the ease of exploitation makes this a high-priority issue for any organization utilizing the Simple Cafe Ordering System. Because the software appears to lack an official update path, organizations should prioritize migrating to a more secure alternative or performing an immediate code-level audit to implement prepared statements, as the current state of the software is unsuitable for production environments.

Description Summary:
The Popup builder with Gamification plugin for WordPress is vulnerable to SQL Injection via REST API endpoints. This allows attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL Injection vulnerability in the Popup builder with Gamification WordPress plugin allows attackers to compromise the site's database through various REST API endpoints.

Vulnerability Details

CVE-ID: CVE-2025-13192

Affected Software: Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin

Affected Versions: All versions up to, and including, 2.x

Vulnerability: This vulnerability is a generic SQL Injection flaw located within multiple REST API endpoints. An attacker can manipulate input parameters to execute unauthorized queries against the WordPress database, likely without requiring high-level authentication.

Business Impact

A successful SQL injection attack can lead to the full disclosure of sensitive database records, including user credentials, customer data, and site configurations. The CVSS score of 8.2 indicates a high severity, as this could result in a complete site takeover and significant data privacy violations.

Remediation Plan

Immediate Action: Update the "Popup builder with Gamification" plugin to the latest version immediately. If no update is available, deactivate and remove the plugin.

Proactive Monitoring: Review database logs for unusual queries containing SQL keywords like UNION, SELECT, or SLEEP, and monitor for unauthorized administrative user creation.

Compensating Controls: Deploy a Web Application Firewall (WAF) with generic SQL injection protection rules to filter malicious REST API requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation. However, SQL injection vulnerabilities in WordPress plugins are frequently targeted by automated scanning tools.

Analyst Recommendation

The severity of this SQL injection flaw cannot be overstated, as it provides a direct path to database compromise. Immediate application of the vendor's patch is the only effective way to mitigate this risk and protect sensitive organizational data.

Description Summary:
A stack-based buffer overflow in the soapcgi_main function of the /soap.cgi endpoint in D-Link DIR-816L firmware allows remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DIR-816L router allows remote attackers to execute arbitrary code, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-13191

Affected Software: D-Link DIR-816L

Affected Versions: D-Link DIR-816L: 2_06_b09_beta

Vulnerability: This memory corruption vulnerability exists within the soapcgi_main function of the /soap.cgi file. An attacker with low-level privileges can trigger a stack-based buffer overflow by sending specifically crafted input to the vulnerable endpoint, potentially leading to remote code execution.

Business Impact

A successful exploit allows an unauthorized party to gain control over the affected network device. This can lead to complete compromise of the router, interception of network traffic, and lateral movement into the internal network, resulting in significant data breach risks and total loss of device confidentiality and integrity. The high CVSS score of 8.8 reflects the severity of this remote attack vector and the potential for total impact on the device.

Remediation Plan

Immediate Action: As this device is no longer supported by the manufacturer, there is no official security patch available. Immediately retire the device from the production environment or isolate it behind a robust firewall that blocks all traffic to the /soap.cgi endpoint.

Proactive Monitoring: Monitor network traffic for anomalous HTTP requests directed at the /soap.cgi endpoint, specifically looking for unusually long strings or non-standard characters in parameters that may indicate buffer overflow attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with signatures configured to detect and block malicious payloads targeting soapcgi_main vulnerabilities on legacy D-Link hardware.

Exploitation Status

Public Exploit Available: Yes — a technical write-up containing attack details and proof-of-concept evidence is publicly available via the GitHub repository linked in the research write-up.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking in the legacy firmware code.

Analyst Recommendation

Given that the affected product is end-of-life and no vendor patch will be provided, the only effective mitigation is the immediate decommissioning of the D-Link DIR-816L device. Organizations relying on this hardware for network perimeter security are at high risk and should prioritize replacing the device with a currently supported, patched alternative to ensure long-term security.

Description Summary:
A stack-based buffer overflow in the D-Link DIR-816L allows remote attackers to execute arbitrary code via the en argument in the scandir_main function.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DIR-816L router allows for remote code execution by an authenticated attacker.

Vulnerability Details

CVE-ID: CVE-2025-13190

Affected Software: D-Link DIR-816L

Affected Versions: 2_06_b09_beta

Vulnerability: The vulnerability exists within the scandir_main function of the /portal/__ajax_exporer.sgi file, where improper handling of the en argument leads to a stack-based buffer overflow. While the attack is performed remotely, it requires a low-privileged authenticated user to trigger the flaw.

Business Impact

The exploitation of this vulnerability can lead to a full compromise of the affected router, potentially allowing an attacker to gain unauthorized access to the network, intercept traffic, or pivot into internal systems. With a CVSS score of 8.8, this represents a high-severity risk to business continuity and data confidentiality, particularly for organizations relying on this legacy hardware.

Remediation Plan

Immediate Action: As the affected product is no longer supported by the maintainer, the immediate action is to decommission and replace the device.

Proactive Monitoring: Monitor network traffic for unusual activity originating from or directed toward router management interfaces, specifically looking for abnormal HTTP requests to the /portal/ path.

Compensating Controls: If the device cannot be immediately replaced, place it behind a firewall that restricts access to the management interface, or utilize a Web Application Firewall (WAF) to inspect and block malicious payloads targeting the /portal/__ajax_exporer.sgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a technical write-up containing attack details is available via the linked GitHub repository.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published research write-up confirms that the mechanism for exploitation is publicly documented.

Analyst Recommendation

Given that the affected D-Link DIR-816L firmware is no longer supported and no official patch will be provided, the risk of continued use is extreme. Organizations must prioritize the removal of this device from production environments to prevent potential remote code execution and unauthorized network access.

Description Summary:
A stack-based buffer overflow in the genacgi_main function of the D-Link DIR-816L allows remote attackers to execute arbitrary code via the SERVER_ID or HTTP_SID arguments.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the D-Link DIR-816L router allows remote code execution, posing a severe risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-13189

Affected Software: D-Link DIR-816L

Affected Versions: 2_06_b09_beta

Vulnerability: This flaw involves a stack-based buffer overflow triggered by improper memory management within the genacgi_main function of the gena.cgi file. An attacker with low-level privileges can send a specially crafted request containing malicious SERVER_ID or HTTP_SID arguments to achieve remote code execution.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating high severity. Successful exploitation allows an attacker to compromise the router, potentially leading to unauthorized network access, interception of traffic, or the redirection of internal traffic to malicious destinations. Given that this device is end-of-life and unsupported by the vendor, the risk of permanent compromise is significant.

Remediation Plan

Immediate Action: Because the affected device is no longer supported by D-Link and no patch exists, the primary remediation is to decommission the device and replace it with a currently supported model.

Proactive Monitoring: Monitor network traffic for unusual patterns, specifically attempts to access the gena.cgi endpoint or malformed HTTP requests originating from untrusted sources.

Compensating Controls: If immediate replacement is not feasible, isolate the device behind a robust firewall, restrict management access to a dedicated management VLAN, and employ a Web Application Firewall to filter malicious input strings in HTTP headers.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept document and technical analysis have been published via the research repository linked in the CVE record.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of modern memory protections in legacy firmware.

Analyst Recommendation

The D-Link DIR-816L is an end-of-life product and will not receive security updates. Continued use of this hardware exposes the network to trivial remote code execution attacks. Organizations must prioritize the retirement and replacement of this hardware to eliminate this unpatchable security exposure.

Description Summary:
A stack-based buffer overflow in the authenticationcgi_main function of D-Link DIR-816L allows remote, unauthenticated attackers to execute arbitrary code via the Password parameter.

Executive Summary:
A critical remote code execution vulnerability exists in the D-Link DIR-816L router, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13188

Affected Software: D-Link DIR-816L

Affected Versions: 2_06_b09_beta

Vulnerability: The device suffers from a stack-based buffer overflow in the authenticationcgi_main function within the /authentication.cgi file. An unauthenticated remote attacker can trigger this memory corruption by sending a specially crafted request containing a malicious Password argument.

Business Impact

The CVSS score of 9.8 reflects the extreme severity of this flaw, which allows for unauthenticated remote code execution. Successful exploitation results in complete system compromise, enabling attackers to intercept network traffic, pivot into internal environments, or deploy persistent malware. Given that this product is end-of-life and no longer supported, the risk of unpatched exploitation is elevated.

Remediation Plan

Immediate Action: As the manufacturer has discontinued support for this device, there is no official patch available; users must immediately decommission the affected hardware and replace it with a currently supported device.

Proactive Monitoring: Monitor network traffic for anomalous attempts to access /authentication.cgi and review system logs for signs of unauthorized configuration changes or unexpected process execution.

Compensating Controls: If immediate replacement is not feasible, isolate the device behind a robust firewall, restrict access to its management interface to trusted internal segments only, and disable remote management features.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists in a GitHub repository and is documented in the researcher's technical write-up.

Analyst Notes: As of November 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking on the Password parameter, which allows for reliable instruction pointer control.

Analyst Recommendation

This vulnerability represents a critical security failure in a device that no longer receives vendor security updates. Organizations still utilizing the D-Link DIR-816L must prioritize its immediate removal from the network, as there is no path to remediation through patching. Continued use of this hardware exposes the entire network to unauthenticated remote exploitation.

Description Summary:
A critical authentication bypass in the Toto Link X5000R router allows unauthenticated attackers to enable Telnet, facilitating root-level command execution.

Executive Summary:
A critical authentication bypass vulnerability in the Toto Link X5000R router permits unauthenticated remote attackers to gain root access with a blank password.

Vulnerability Details

CVE-ID: CVE-2025-13184

Affected Software: Toto Link X5000R AX1800 Router

Affected Versions: All versions prior to V9.1.0u.6369_B20230113

Vulnerability: The device suffers from a missing authentication check (CWE-306) within the cstecgi.cgi component, which can be manipulated by an unauthenticated attacker to enable Telnet services and access the system as root.

Business Impact

Successful exploitation grants an attacker full control over the affected network device. This level of access allows for total system compromise, including the interception of network traffic, modification of device configurations, and potential pivot points into the internal local area network, leading to significant data loss and operational disruption. Given the CVSS score of 9.8, this vulnerability poses a critical risk to organizational infrastructure.

Remediation Plan

Immediate Action: Update the firmware of the Toto Link X5000R router to version V9.1.0u.6369_B20230113 or the latest available release to close the authentication bypass.

Proactive Monitoring: Monitor network traffic for unauthorized Telnet connections (TCP port 23) and review device system logs for anomalous administrative access or unexpected configuration changes.

Compensating Controls: Disable Telnet access on the router immediately and ensure the device management interface is not accessible from the public internet by utilizing firewall rules or Access Control Lists (ACLs).

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's technical write-up referenced in the CVE record.

Analyst Notes: As of Dec 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the predictable nature of the root access vector.

Analyst Recommendation

This vulnerability represents a severe risk to network security, as it provides a direct path to total device compromise. Administrators should prioritize firmware updates immediately and strictly restrict management access to the device to prevent unauthorized exploitation while the remediation is being deployed.

Description Summary:
A SQL injection vulnerability in the Simple Online Hotel Reservation System allows remote, unauthenticated attackers to execute malicious queries via the admin_id parameter in edit_account.php.

Executive Summary:
The Simple Online Hotel Reservation System version 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13170

Affected Software: code-projects Simple Online Hotel Reservation System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/edit_account.php file. It is triggered by manipulating the admin_id argument, and because the vulnerability does not require prior authentication, it is remotely exploitable by any unauthenticated attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability allows unauthorized actors to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this represents a significant security risk that could result in the compromise of sensitive administrative accounts and reservation data. Such an incident could lead to severe reputational damage and the loss of customer trust.

Remediation Plan

Immediate Action: As there is no official vendor patch available, administrators should immediately restrict access to the /admin directory using network-level controls or IP allow-listing.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns, particularly those targeting the admin_id parameter in the edit_account.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until a permanent fix is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation via simple HTTP GET or POST requests.

Analyst Recommendation

The presence of a public proof-of-concept significantly increases the likelihood of exploitation by automated scanners and malicious actors. Organizations currently running version 1.0 of the Simple Online Hotel Reservation System must treat this as a high-priority risk. If the software cannot be patched or adequately protected by compensating controls, it should be taken offline until a secure version is verified and deployed.

Description Summary:
A SQL injection vulnerability exists in the add_query_reserve.php file of the Simple Online Hotel Reservation System 1.0, allowing remote unauthenticated attackers to manipulate the room_id parameter.

Executive Summary:
The Simple Online Hotel Reservation System 1.0 is vulnerable to unauthenticated SQL injection, which could lead to full database compromise and unauthorized system access.

Vulnerability Details

CVE-ID: CVE-2025-13169

Affected Software: code-projects Simple Online Hotel Reservation System

Affected Versions: 1.0

Vulnerability: This is a classic SQL injection flaw (CWE-89) located in the add_query_reserve.php file. The application fails to sanitize the room_id parameter, allowing an unauthenticated remote attacker to inject malicious SQL queries directly into the backend database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass authentication, exfiltrate sensitive reservation data, modify or delete records, and potentially gain full control over the underlying database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in severe reputational damage and legal liability regarding guest privacy.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the affected web application using network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous POST requests to add_query_reserve.php, specifically searching for payloads containing SQL syntax such as UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the room_id parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's GitHub write-up.

Analyst Notes: As of November 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability poses a critical risk to any organization hosting this software. Organizations should prioritize isolating the affected system from public-facing networks until a secure update is provided by the vendor, and ensure that database permissions are restricted to the absolute minimum necessary for application functionality.

Description Summary:
Digiwin EasyFlow GP is vulnerable to a denial of service attack, allowing unauthenticated remote attackers to crash the web service by sending specially crafted requests.

Executive Summary:
An unauthenticated remote denial of service vulnerability in Digiwin EasyFlow GP poses a significant risk to service availability.

Vulnerability Details

CVE-ID: CVE-2025-13165

Affected Software: Digiwin EasyFlow GP

Affected Versions: 5.8.8.3 through 5.8.11.1.0810112, 8.1.x through 8.1.1.2, 5.7.x through 5.7.7.2

Vulnerability: This flaw is classified as a resource allocation issue (CWE-770) where the application fails to limit or throttle requests, enabling an unauthenticated attacker to exhaust system resources and force a denial of service.

Business Impact

Successful exploitation results in the complete unavailability of the EasyFlow GP web service, which can disrupt critical business workflows dependent on the platform. With a CVSS score of 7.5, this high-severity vulnerability highlights the potential for significant operational downtime if left unpatched.

Remediation Plan

Immediate Action: Update version 5.8.x to 5.8.11.1.081013 or later, and version 8.1.x to 8.1.1.3 or later; for version 5.7.x, users must upgrade to an unaffected version or apply the provided vendor patch.

Proactive Monitoring: Monitor server resource utilization and web server logs for anomalous spikes in traffic or repetitive, malformed request patterns that may indicate a denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter suspicious traffic and enforce rate limiting on incoming requests to the affected endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of resource throttling makes this service inherently susceptible to simple request-flooding attacks.

Analyst Recommendation

Given the ease of exploitability and the potential for service disruption, organizations running the affected versions of Digiwin EasyFlow GP should prioritize the installation of the vendor-provided patches. Until updates are applied, implement strict network-level access controls and monitoring to mitigate the risk of unauthorized service disruption.

Description Summary:
IQ-Support by IQ Service International contains an arbitrary file read vulnerability caused by relative path traversal, allowing unauthenticated remote attackers to download sensitive system files.

Executive Summary:
An unauthenticated remote code execution vulnerability exists in IQ-Support, creating a critical risk of unauthorized sensitive file disclosure.

Vulnerability Details

CVE-ID: CVE-2025-13161

Affected Software: IQ Service International IQ-Support

Affected Versions: 1.0

Vulnerability: The application is susceptible to a relative path traversal vulnerability, which allows unauthenticated remote attackers to manipulate file paths and access arbitrary files on the underlying system.

Business Impact

A successful exploit of this vulnerability allows unauthorized actors to read sensitive system configuration files or credentials, which could lead to complete system compromise or lateral movement within the network. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality and integrity, necessitating prompt attention to prevent unauthorized information disclosure.

Remediation Plan

Immediate Action: Contact IQ Service International immediately to obtain and apply the latest security patches or configuration updates for version 1.0.

Proactive Monitoring: Review web server and system access logs for anomalous requests containing path traversal patterns, such as sequences of dot-dot-slash.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and malformed URI requests to the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and ease of exploitation via simple URI manipulation.

Analyst Recommendation

Given the potential for unauthorized access to critical system files, organizations running IQ-Support 1.0 must treat this vulnerability with high urgency. Administrators should verify the current installation status and coordinate with the vendor to secure the environment, while simultaneously implementing network-level filtering to mitigate the risk of exploitation until a formal patch is applied.

Description Summary:
The Flo Forms WordPress plugin allows unauthenticated users to upload malicious SVG files, leading to Stored Cross-Site Scripting (XSS) when an administrator views the file.

Executive Summary:
The Flo Forms WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting, which could lead to full site compromise if an administrator views a malicious uploaded file.

Vulnerability Details

CVE-ID: CVE-2025-13159

Affected Software: Flothemes Flo Forms – Easy Drag & Drop Form Builder

Affected Versions: 0 through 1.0.43

Vulnerability: This is a Stored Cross-Site Scripting (XSS) vulnerability caused by a lack of file content validation during SVG uploads via an unauthenticated AJAX endpoint. Unauthenticated attackers can inject malicious JavaScript into SVG files that execute within the context of an administrator session.

Business Impact

The vulnerability carries a CVSS score of 7.1, reflecting a high risk to the integrity and confidentiality of the WordPress environment. Successful exploitation allows an attacker to execute arbitrary scripts in the administrator's browser, potentially leading to unauthorized administrative actions, session hijacking, or full site compromise.

Remediation Plan

Immediate Action: Since a specific patched version is not currently listed, administrators should immediately disable or remove the Flo Forms plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review WordPress media library logs and plugin upload directories for suspicious SVG files or unexpected file modifications that indicate unauthorized access.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized file uploads or restrict access to the flo_form_submit AJAX endpoint to trusted IP addresses.

Exploitation Status

Public Exploit Available: Yes, a public Proof-of-Concept exists on GitHub.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild, but the presence of a public Proof-of-Concept repository elevates the risk of exploitation. The reliance on an unauthenticated endpoint makes this flaw particularly attractive to automated attack scripts.

Analyst Recommendation

Given the potential for full administrative takeover, this vulnerability poses a significant risk to site security. Administrators must prioritize the removal of the vulnerable plugin immediately and monitor for any signs of unauthorized administrative activity until a verified security patch is released and applied.

Description Summary:
The Vitepos plugin for WooCommerce is vulnerable to arbitrary file uploads in the insert_media_attachment function, allowing authenticated users to achieve remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the Vitepos plugin for WooCommerce allows authenticated attackers to execute arbitrary code on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-13156

Affected Software: Appsbd Vitepos – Point of Sale (POS) for WooCommerce

Affected Versions: 0 through 3.3.0

Vulnerability: This flaw is caused by insufficient file type validation within the save_update_category_img function. Any authenticated user with subscriber-level access or higher can upload malicious files, leading to potential remote code execution.

Business Impact

The ability for a low-privileged attacker to achieve remote code execution poses a severe threat to the confidentiality, integrity, and availability of the entire WordPress environment. With a CVSS score of 8.8, this vulnerability allows an attacker to gain full control over the web server, potentially leading to data breaches, site defacement, or total system compromise.

Remediation Plan

Immediate Action: Since a specific patched version is not explicitly provided in the enrichment data, users should monitor the WordPress plugin repository for an update beyond version 3.3.0 and apply it immediately. If an update is unavailable, deactivate or remove the plugin until a secure version is released.

Proactive Monitoring: Review web server logs for suspicious file upload requests or attempts to access unknown files within the uploads directory. Monitor for unusual processes initiated by the web server user account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file uploads from unauthorized users or to restrict file types to strictly non-executable extensions.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a GitHub repository.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild. However, the presence of public proof-of-concept code elevates the risk significantly. The vulnerability is inherently exploitable because the software fails to enforce server-side validation on uploaded files, which is a fundamental security control.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability represents a high-risk exposure for any organization using the Vitepos plugin. Administrators must prioritize restricting user access to the plugin and applying the latest available security updates as soon as they are published by the vendor to prevent exploitation.

Description Summary:
Lenovo Baiying Client contains an improper permissions vulnerability that allows a local authenticated user to execute code with elevated privileges.

Executive Summary:
A local privilege escalation vulnerability in Lenovo Baiying Client allows authenticated users to execute arbitrary code with higher privileges, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-13155

Affected Software: Lenovo Baiying Client

Affected Versions: 0 up to (excluding) 4.1.0

Vulnerability: This vulnerability is caused by incorrect default permissions, which may allow a local authenticated user to manipulate the application and achieve code execution with elevated privileges.

Business Impact

The ability for a local user to escalate privileges to the level of the application provides an attacker with a foothold to compromise system security, potentially leading to unauthorized data access or complete system takeover. With a CVSS score of 7.8, this vulnerability represents a High severity risk that must be addressed to prevent lateral movement and privilege abuse within the environment.

Remediation Plan

Immediate Action: Update the Lenovo Baiying Client to version 4.1.0 or later to resolve the underlying permission configuration issue.

Proactive Monitoring: Audit system logs for unexpected process execution or modifications to application binaries that may indicate an attempt to exploit local permissions.

Compensating Controls: Restrict local user access to the affected system and enforce the principle of least privilege to minimize the potential for non-privileged accounts to interact with sensitive services.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is locally exploitable, requiring prior access to the system.

Analyst Recommendation

Given the potential for privilege escalation and the availability of a vendor-provided patch, administrators should prioritize updating all instances of the Lenovo Baiying Client to version 4.1.0. Failure to update leaves local users with the ability to bypass security constraints and execute unauthorized code, which is a critical risk for multi-user environments.

Description Summary:
A DLL hijacking vulnerability in Lenovo One Client allows a local authenticated user to execute code with elevated privileges via an uncontrolled search path.

Executive Summary:
Lenovo One Client contains a DLL hijacking vulnerability that enables local authenticated users to achieve elevated code execution, posing a significant security risk.

Vulnerability Details

CVE-ID: CVE-2025-13152

Affected Software: Lenovo One Client

Affected Versions: 0 through 2.8.200.5081

Vulnerability: This vulnerability, categorized as CWE-427, involves an uncontrolled search path element where the application improperly loads dynamic link libraries. An authenticated local user can exploit this behavior to execute malicious code with the privileges of the application.

Business Impact

The ability for a local user to escalate privileges to the level of the application provides a direct path for full system compromise. Given the CVSS score of 7.8, this flaw represents a high risk to organizational security, as it facilitates lateral movement and unauthorized access to sensitive system resources.

Remediation Plan

Immediate Action: Lenovo has officially declared that Lenovo One is no longer supported and recommends that all customers discontinue its use and migrate to Smart Connect, available via the Microsoft Store.

Proactive Monitoring: Security teams should audit system logs for unauthorized software installation or execution patterns originating from standard user accounts.

Compensating Controls: Restrict local user permissions to prevent the installation of unauthorized files and ensure that application directories are properly secured with restrictive access control lists.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The risk is primarily driven by the software being in an end of life state, meaning no security patches will be issued to address this flaw.

Analyst Recommendation

Due to the lack of vendor support and the inherent risk of local privilege escalation, organizations must prioritize the immediate removal of Lenovo One Client from all endpoints. Transitioning to the recommended replacement, Smart Connect, is the only effective way to remediate this vulnerability and eliminate the associated exposure.

Description Summary:
A stack-based buffer overflow in libtasn1 version 4.20.0 exists within the asn1_expend_octet_string function, potentially allowing for denial of service.

Executive Summary:
A stack-based buffer overflow in the libtasn1 library, specifically within the asn1_expend_octet_string function, presents a significant risk of service disruption.

Vulnerability Details

CVE-ID: CVE-2025-13151

Affected Software: GnuTLS libtasn1

Affected Versions: 0 through 4.20.0

Vulnerability: This is a stack-based buffer overflow (CWE-121) caused by the failure to validate the size of input data in the asn1_expend_octet_string function. The vulnerability is exploitable by an unauthenticated attacker via a network-accessible vector.

Business Impact

The CVSS score of 7.5 indicates a high-severity vulnerability primarily impacting system availability. Successful exploitation of this buffer overflow could result in the crashing of applications relying on the libtasn1 library, leading to significant service downtime and operational instability.

Remediation Plan

Immediate Action: Organizations should monitor the GnuTLS upstream repository for the release of a patched version of libtasn1 and apply the update immediately upon availability.

Proactive Monitoring: Security teams should review application logs for abnormal crashes or segmentation faults that may indicate attempts to trigger this buffer overflow.

Compensating Controls: Implementing robust input validation at the application layer or using memory-safe wrappers for ASN.1 parsing can provide temporary protection while waiting for a formal vendor patch.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly automatable, the lack of a known exploit reduces the immediate risk of weaponized attacks.

Analyst Recommendation

Given the core nature of the libtasn1 library in cryptographic and network communications, this vulnerability carries substantial risk. Administrators must prioritize tracking the GnuTLS project for the official fix and ensure patching cycles are prepared for rapid deployment once the remediation code is verified and released.

Description Summary:
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 contain an unverified password change vulnerability that allows authenticated users to modify the password of another user.

Executive Summary:
An authenticated user can bypass security controls to reset other user passwords in IBM Aspera Orchestrator, potentially leading to full account takeover.

Vulnerability Details

CVE-ID: CVE-2025-13148

Affected Software: IBM Aspera Orchestrator

Affected Versions: 4.0.0 through 4.1.0

Vulnerability: This vulnerability, identified as CWE-620, allows an authenticated user to change the password of any other user without knowing the original password. The flaw exists due to a lack of proper verification during the password change process.

Business Impact

The ability for an authenticated user to reset another account's credentials poses a significant risk to data confidentiality and system integrity. With a CVSS score of 8.1, this high-severity flaw could allow an attacker to escalate privileges by targeting administrative accounts, potentially leading to unauthorized access to sensitive file transfer workflows and business-critical data.

Remediation Plan

Immediate Action: Upgrade to IBM Aspera Orchestrator version 4.1.1 immediately as per the official vendor security advisory.

Proactive Monitoring: Review system authentication logs for unusual password change activities or patterns of rapid account modification.

Compensating Controls: Limit access to the orchestration interface to trusted users via network-level restrictions or VPNs until the patch is successfully applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently being exploited in the wild, the potential for account takeover makes it a priority for remediation.

Analyst Recommendation

Given the high CVSS score and the direct impact on user account security, this vulnerability presents an elevated risk to the integrity of the Aspera environment. Security teams should prioritize the upgrade to version 4.1.1 across all affected instances to eliminate the possibility of unauthorized password resets and subsequent account compromise.

Description Summary:
The WP Ultimate CSV Importer plugin for WordPress is vulnerable to PHP object injection via untrusted CSV file imports, allowing authenticated administrators to potentially execute arbitrary code.

Executive Summary:
A high-severity PHP object injection vulnerability in the WP Ultimate CSV Importer plugin allows authenticated administrators to compromise the integrity and availability of the WordPress site.

Vulnerability Details

CVE-ID: CVE-2025-13145

Affected Software: Smackcoders WP Ultimate CSV Importer

Affected Versions: 0 through 7.33.1

Vulnerability: The vulnerability exists due to improper deserialization of untrusted data in the import_single_post_as_csv function. This flaw requires an attacker to have administrator-level access to trigger the malicious payload.

Business Impact

Successful exploitation permits an authenticated administrator to inject PHP objects, which can lead to arbitrary file deletion, sensitive data exposure, or remote code execution if a suitable POP chain is present. Given the CVSS score of 7.2, this vulnerability represents a significant risk to site security and business continuity, as it allows for full administrative control over the affected WordPress environment.

Remediation Plan

Immediate Action: Update the WP Ultimate CSV Importer plugin to the latest version, ensuring all instances are at least version 7.33.2 or higher.

Proactive Monitoring: Audit WordPress administrative logs for suspicious file import activities or unauthorized modifications to system configuration files.

Compensating Controls: Restrict administrative access to the WordPress dashboard to trusted IP addresses and implement a Web Application Firewall to block suspicious serialized object strings in POST requests.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of November 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the exploit requires administrative privileges, the potential for remote code execution makes this a high-priority update for all WordPress environments utilizing this plugin.

Analyst Recommendation

Organizations should treat this vulnerability with urgency by immediately updating the affected plugin. Because the vulnerability allows for high-impact actions like code execution, administrators should also conduct a post-update security review to ensure no unauthorized administrative accounts or backdoors were created prior to the patch application.

Description Summary:
The WP Directory Kit plugin for WordPress is vulnerable to unauthenticated SQL injection via the columns_search parameter in the select_2_ajax function, allowing for sensitive database information theft.

Executive Summary:
The WP Directory Kit plugin for WordPress contains an unauthenticated SQL injection vulnerability that allows remote attackers to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-13138

Affected Software: WordPress WP Directory Kit

Affected Versions: 0 through 1.4.3

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the select_2_ajax function. It occurs due to insufficient input validation and improper sanitization of the columns_search parameter, which can be triggered by unauthenticated attackers to manipulate database queries.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to data confidentiality. Because the flaw allows an unauthenticated attacker to append malicious SQL commands, an adversary could exfiltrate sensitive data stored within the WordPress database, including user credentials, configuration details, or proprietary content. With a CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent unauthorized data exposure and potential compliance violations.

Remediation Plan

Immediate Action: Update the WP Directory Kit plugin to the latest available version provided by the vendor. If a patched version is not immediately available, deactivate and remove the plugin from the WordPress installation until a fix is deployed.

Proactive Monitoring: Monitor database access logs and web server error logs for suspicious patterns, such as unexpected SQL syntax errors or high volumes of requests directed at the select_2_ajax endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: No (a Nuclei detection template is available, but no weaponized exploit or public proof-of-concept exists).

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is highly accessible as it does not require authentication, making it a priority for remediation.

Analyst Recommendation

Given the ease of exploitability and the potential for severe data exfiltration, administrators should treat this vulnerability with high priority. Ensure the WP Directory Kit plugin is updated to the version provided by the vendor immediately. If updating is not currently feasible, the safest course of action is to disable the plugin entirely to eliminate the attack surface.

Description Summary:
A UI spoofing vulnerability in Arc Browser allows a site to enter fullscreen mode without a notification, enabling the rendering of fake UI elements to deceive users.

Executive Summary:
A critical UI spoofing vulnerability in the Arc Browser allows malicious sites to bypass fullscreen notifications to facilitate credential theft or phishing via fake address bars.

Vulnerability Details

CVE-ID: CVE-2025-13132

Affected Software: The Browser Company of New York Arc Browser (Dia)

Affected Versions: 0 up to (excluding) 1.6.0

Vulnerability: This flaw, categorized as Improper Restriction of Rendered UI Layers or Frames (CWE-1021), allows an unauthenticated remote attacker to trigger a fullscreen state without the required user notification toast. By suppressing this visual indicator, an attacker can overlay deceptive interface components to impersonate legitimate websites.

Business Impact

The ability to present a spoofed user interface poses a significant risk to organizational security, as it facilitates sophisticated phishing attacks and credential harvesting. While the CVSS score of 7.4 reflects a high impact on integrity, the primary danger lies in the potential for users to be misled into entering sensitive information into illegitimate, attacker-controlled UI layers.

Remediation Plan

Immediate Action: Update the Arc Browser to version 1.6.0 or later immediately to ensure the fullscreen notification mechanism is correctly enforced.

Proactive Monitoring: Security teams should monitor endpoint logs for browser-related anomalies and educate users on identifying signs of browser spoofing, such as inconsistencies in standard UI elements.

Compensating Controls: Deploy endpoint protection solutions that can detect and block navigation to known malicious domains, providing a defense-in-depth layer against sites attempting to exploit UI rendering flaws.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on user interaction and successful social engineering to achieve its full potential impact.

Analyst Recommendation

Given the nature of this vulnerability as a mechanism for deceptive UI manipulation, the risk of exploitation increases if users are not protected by the latest security patches. Organizations should prioritize updating the Arc Browser across all managed workstations to version 1.6.0 to restore essential browser security notifications and prevent potential phishing success.

Description Summary:
Sonarr 4.0.15.2940 contains a vulnerability involving incorrect default permissions in the Sonarr.Console.exe service component that could lead to unauthorized privilege escalation.

Executive Summary:
A local privilege escalation vulnerability in Sonarr 4.0.15.2940 allows attackers with local access to manipulate service permissions and potentially gain elevated system control.

Vulnerability Details

CVE-ID: CVE-2025-13131

Affected Software: Sonarr Sonarr

Affected Versions: Sonarr: 4.0.15.2940

Vulnerability: This vulnerability is caused by incorrect default permissions in the Sonarr.Console.exe service. Exploitation requires an attacker to already have local system access to interact with the service environment.

Business Impact

The exploitation of this flaw could allow a local user to escalate their privileges, potentially resulting in full system compromise. With a CVSS score of 7.8, the vulnerability poses a significant risk to the confidentiality and integrity of the host system, particularly in environments where multiple users or processes share the same host.

Remediation Plan

Immediate Action: Since a specific patch is not yet available, ensure the Sonarr service is configured to run under a low privilege account rather than a high privilege or administrative account.

Proactive Monitoring: Monitor system logs for unauthorized attempts to modify service configurations or unexpected execution of the Sonarr console binary.

Compensating Controls: Implement strict file system permissions on the Sonarr installation directory to prevent non-administrative users from modifying or replacing the executable files.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available.

Analyst Notes: As of November 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently limited by its requirement for local access, but it remains a concern for defense-in-depth strategies.

Analyst Recommendation

Security teams should prioritize restricting access to the Sonarr service configuration and ensuring the application runs with the principle of least privilege. Given that a fix is pending for the next major release, users should monitor official vendor communications for the availability of version 5 and apply the update as soon as it is released.

Description Summary:
Radarr 5.28.0.10274 contains a vulnerability involving incorrect default permissions in the Service component, potentially allowing local privilege escalation.

Executive Summary:
A local privilege escalation vulnerability in Radarr 5.28.0.10274 allows authenticated local users to manipulate service permissions, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-13130

Affected Software: Radarr

Affected Versions: 5.28.0.10274

Vulnerability: This vulnerability stems from incorrect default permissions and improper privilege assignment within the Radarr.Console.exe file. The flaw requires an attacker to have local access to the environment to exploit the service configuration.

Business Impact

The exploitation of this vulnerability could allow a local user to gain unauthorized elevated privileges on the host system. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, or the execution of malicious code with administrative rights.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict local user access to the Radarr installation directory and the associated service executable. Audit existing local user permissions to ensure that only authorized service accounts have access to modify the service binary.

Proactive Monitoring: Monitor system logs for unauthorized attempts to modify service configurations or unexpected privilege escalation events. Review logs associated with the Radarr service for unusual activity originating from local user accounts.

Compensating Controls: Implement strict file system permissions (Access Control Lists) on the Radarr installation folder to prevent unauthorized modification by low-privileged users. Utilize Endpoint Detection and Response (EDR) solutions to alert on suspicious process execution patterns related to service manipulation.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable by any local user with sufficient access to interact with the service binary.

Analyst Recommendation

Due to the lack of a vendor-provided patch, organizations must prioritize hardening the host environment hosting the Radarr service. Restricting access to the installation directory is the most effective temporary measure to prevent local attackers from abusing these incorrect permissions until a formal security update is released.

Description Summary:
The wpForo Forum plugin for WordPress is vulnerable to unauthenticated SQL injection via the post_args and topic_args parameters, allowing unauthorized database information extraction.

Executive Summary:
The wpForo Forum plugin for WordPress contains a critical SQL injection vulnerability that allows unauthenticated attackers to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-13126

Affected Software: tomdever wpForo Forum

Affected Versions: 0 through 2.4.12

Vulnerability: This flaw is a SQL injection (CWE-89) caused by insufficient escaping and lack of parameterized queries in the post_args and topic_args parameters. An unauthenticated attacker can manipulate these parameters to execute arbitrary SQL queries against the underlying database.

Business Impact

The ability for an unauthenticated attacker to inject SQL queries poses a severe risk to data confidentiality. Successful exploitation could lead to the unauthorized extraction of sensitive user data, forum content, or internal system credentials, potentially resulting in a significant data breach. With a CVSS score of 7.5, this high severity vulnerability demands immediate attention to prevent unauthorized access to the application backend.

Remediation Plan

Immediate Action: Administrators should monitor the vendor's official channels for the release of a patched version and apply the update immediately upon availability. If an update is not available, consider temporarily deactivating the wpForo Forum plugin to neutralize the attack vector.

Proactive Monitoring: Security teams should review database logs for anomalous query patterns, such as unexpected use of UNION or SLEEP commands, originating from the plugin endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and the relative ease of injecting malicious payloads into the vulnerable parameters.

Analyst Recommendation

Given the high CVSS score and the potential for unauthenticated data exfiltration, this vulnerability represents a significant security risk. Organizations currently running the affected versions of the wpForo Forum plugin must prioritize the application of vendor-supplied patches as soon as they are released. Until a fix is deployed, restricting access to the affected forum components or utilizing a WAF to filter malicious traffic is essential to protect the integrity and confidentiality of the database.