Description Summary:
The AI Feeds plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the actualizador_git.php file, potentially leading to remote code execution.

Executive Summary:
A critical vulnerability in the AI Feeds plugin for WordPress allows unauthenticated attackers to achieve remote code execution by overwriting plugin files.

Vulnerability Details

CVE-ID: CVE-2025-13597

Affected Software: soportecibeles AI Feeds

Affected Versions: 0 through 1.0.11

Vulnerability: This flaw is an unrestricted file upload vulnerability (CWE-434) caused by a missing capability check in the actualizador_git.php file. Unauthenticated attackers can leverage this to download arbitrary GitHub repositories and overwrite site files, facilitating remote code execution.

Business Impact

Successful exploitation grants an attacker complete control over the WordPress site, enabling them to execute arbitrary code, exfiltrate sensitive data, or deploy malicious payloads. Given the critical CVSS score of 9.8, this vulnerability poses an extreme risk to business continuity, data integrity, and organizational reputation, as it requires no prior authentication to trigger.

Remediation Plan

Immediate Action: Update the AI Feeds plugin to the latest version as provided by the vendor. If an update is not immediately available, deactivate and remove the plugin from the production environment until a patch can be applied.

Proactive Monitoring: Monitor server access logs for unusual requests directed at the actualizador_git.php file or unexpected file modifications within the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block unauthorized access to the specific plugin file and detect malicious file upload patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub.

Analyst Notes: As of November 25, 2025, there is no confirmed active exploitation in the wild; however, the presence of a public proof-of-concept repository significantly lowers the barrier for entry for malicious actors. The lack of authentication requirements makes this vulnerability highly susceptible to automated scanning and exploitation.

Analyst Recommendation

Due to the trivial exploit path and the severity of the potential impact, organizations utilizing the AI Feeds plugin must treat this as a high-priority remediation item. Immediate patching is required to prevent total system compromise, and security teams should perform a forensic review of the affected server if the plugin was active during the exposure window.

Description Summary:
The CIBELES AI plugin for WordPress is vulnerable to arbitrary file uploads and remote code execution via the actualizador_git.php file due to a missing capability check.

Executive Summary:
The CIBELES AI plugin for WordPress contains an unauthenticated arbitrary file upload vulnerability that allows attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-13595

Affected Software: Soporte Cibeles CIBELES AI

Affected Versions: 0 through 1.10.8

Vulnerability: This is an unrestricted file upload vulnerability (CWE-434) located in the actualizador_git.php file. The lack of proper capability checks allows unauthenticated attackers to trigger the download of arbitrary GitHub repositories, enabling them to overwrite critical plugin files and execute malicious code on the server.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected WordPress installation. Given the CVSS score of 9.8, this is a critical risk that could lead to total system compromise, theft of sensitive customer data, and the potential for the site to be used as a staging ground for further attacks, resulting in severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the CIBELES AI plugin to the latest available version provided by the vendor to implement the required capability checks. If an update is not immediately possible, deactivate and remove the plugin from the environment.

Proactive Monitoring: Monitor web server access logs for suspicious requests directed at the actualizador_git.php file, particularly those originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to plugin-specific PHP files and to filter malicious file upload attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/d0n601/CVE-2025-13595).

Analyst Notes: As of Nov 25, 2025, there is no confirmed active exploitation in the wild. However, the availability of a public proof-of-concept repository significantly lowers the barrier to entry for attackers, making the risk of exploitation high.

Analyst Recommendation

This vulnerability is critical due to the lack of authentication required to gain remote code execution capabilities. Administrators must prioritize updating the CIBELES AI plugin immediately to patch the missing capability check. If the plugin cannot be updated, it must be removed from the environment to prevent potential compromise.

Description Summary:
The Advanced Ads plugin for WordPress is vulnerable to Remote Code Execution via the change-ad__content shortcode parameter, allowing authenticated attackers with editor-level permissions to execute code.

Executive Summary:
A critical remote code execution vulnerability in the Advanced Ads WordPress plugin allows authenticated attackers with elevated privileges to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13592

Affected Software: Monetizemore Advanced Ads – Ad Manager & AdSense

Affected Versions: 0 through 2.0.14

Vulnerability: This vulnerability is an improper control of code generation (CWE-94) located in the change-ad__content shortcode parameter. It requires an attacker to possess authenticated editor-level permissions or higher to execute arbitrary code on the underlying server.

Business Impact

The ability for an authenticated user to execute remote code on the server represents a total compromise of the application and potentially the host environment. Given the CVSS score of 7.2, this vulnerability poses a significant risk to data confidentiality, integrity, and availability, which could lead to unauthorized data exfiltration or total system takeover.

Remediation Plan

Immediate Action: Restrict access to the Advanced Ads plugin settings to trusted administrators only and disable the plugin until a verified security patch is confirmed and applied.

Proactive Monitoring: Monitor server access logs and WordPress audit logs for unusual shortcode activity or modifications to ad content parameters by authenticated users.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input patterns targeting shortcode parameters, though this should be considered a temporary measure pending a software update.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of December 31, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the impact is severe, and the attack vector is straightforward for any user with editor-level access.

Analyst Recommendation

Organizations utilizing the Advanced Ads plugin must prioritize auditing the accounts with editor-level permissions to ensure only authorized personnel have access. Because this vulnerability allows for remote code execution, it is imperative to monitor for available updates from the vendor and apply them immediately to neutralize the risk of server compromise.

Description Summary:
A critical flaw in a system REST API allows an authenticated administrator to upload arbitrary files to user-controlled locations, leading to remote code execution.

Executive Summary:
An authenticated administrator can exploit a file upload vulnerability in the system REST API to achieve remote code execution, leading to complete system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13590

Affected Software: Affected software utilizing the identified REST API

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves an arbitrary file upload via a system REST API. An attacker with administrative privileges can bypass restrictions to upload a specially crafted payload to a sensitive directory, subsequently executing it to achieve RCE.

Business Impact

While this requires administrative access, it facilitates malicious insider activity or allows an attacker who has compromised an admin account to achieve persistent, deep-system access. The CVSS score of 9.1 reflects the critical impact of RCE, even when conditioned on high-level authentication.

Remediation Plan

Immediate Action: Apply the latest security patches provided by the vendor to restrict file upload paths and validate file contents.

Proactive Monitoring: Audit administrative REST API logs for file upload requests to non-standard or executable directories.

Compensating Controls: Implement strict file system permissions to prevent the execution of files in directories where the REST API has write access.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation. The requirement for administrative credentials limits the initial attack surface but increases the risk of post-exploitation persistence.

Analyst Recommendation

Organizations should ensure that administrative accounts are protected with multi-factor authentication (MFA) to prevent the initial access required for this exploit. Apply vendor-supplied patches immediately to close the RCE vector.

Description Summary:
The itsourcecode COVID Tracking System 1.0 is vulnerable to remote SQL injection via the code parameter in login.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially access sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-13585

Affected Software: itsourcecode COVID Tracking System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input within the code argument of the login.php file. This flaw permits unauthenticated remote attackers to perform SQL injection attacks against the underlying database.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized data exfiltration, modification of tracking records, or potential administrative bypass, significantly impacting the operational security of the system. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized access to the tracking database.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the service until the vendor provides a remediation.

Proactive Monitoring: Review web server access logs for anomalous requests to login.php containing SQL syntax characters, such as single quotes or comment indicators, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns targeting the login.php script.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue reported in the vulnerability references.

Analyst Notes: As of November 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability represents an immediate risk to the affected system. Security teams should prioritize isolating the application from external networks and implementing strict input validation or WAF rules to mitigate the threat of SQL injection until a formal vendor update is released.

Description Summary:
A SQL injection vulnerability exists in the Question Paper Generator 1.0 signupscript.php file, allowing remote attackers to manipulate the Fname parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Question Paper Generator 1.0 allows for unauthenticated remote exploitation, posing a significant risk of database compromise.

Vulnerability Details

CVE-ID: CVE-2025-13583

Affected Software: code-projects Question Paper Generator

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered via the Fname parameter in the signupscript.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification of application records, or complete compromise of the database contents, directly threatening the confidentiality and integrity of the system.

Remediation Plan

Immediate Action: Since no vendor patch is currently available, administrators should restrict access to the affected script or disable the signupscript.php functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP POST requests directed at signupscript.php containing SQL syntax characters, such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block malicious input targeting the Fname parameter to prevent SQL injection payloads from reaching the application.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the GitHub issue referenced by the CVE record.

Analyst Notes: As of November 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Due to the lack of an official patch and the availability of public exploit material, this vulnerability poses an immediate threat to the environment. Organizations currently running version 1.0 of this software must prioritize isolating the affected component from public-facing networks and implement strict input validation controls to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability exists in the Jonnys Liquor 1.0 application, specifically within the Product argument of the detail.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in code-projects Jonnys Liquor 1.0 exposes the application to remote data manipulation and unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2025-13582

Affected Software: code-projects Jonnys Liquor

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) triggered via the Product GET parameter in the detail.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

The exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive database contents, data corruption, or complete loss of database integrity. With a CVSS score of 7.3, this represents a high risk to business operations and data confidentiality, as attackers can manipulate backend queries to extract or alter information without valid credentials.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected web directory or disable the vulnerable detail.php functionality if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous GET requests containing SQL syntax or unusual parameter strings targeting the detail.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the Product parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue referenced in the vulnerability disclosure.

Analyst Notes: As of November 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote interaction with the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk to any environment hosting Jonnys Liquor 1.0. Organizations should apply immediate compensating controls, such as WAF filtering, and isolate the application until a vendor-supplied security patch is released and verified.

Description Summary:
code-projects Library System 1.0 is vulnerable to remote SQL injection in the Login component via the Username argument in index.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Library System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13578

Affected Software: code-projects Library System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the Username parameter within the index.php file of the Login component, allowing for remote SQL injection. This vulnerability is exploitable by an unauthenticated attacker.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the library management system, necessitating prompt intervention to prevent data breaches.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected login interface or consider disabling the service until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous patterns in the Username field, such as SQL syntax characters or unexpected query structures.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the technical documentation provided at the referenced GitHub issue.

Analyst Notes: As of November 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's design allows for automated exploitation, which increases the likelihood of opportunistic attacks.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability poses a high risk to the application environment. Security teams must prioritize isolating the affected system from external networks and applying vendor-provided security updates as soon as they become available.

Description Summary:
The Advanced Library Management System 1.0 contains an unauthenticated SQL injection vulnerability in the delete_admin.php file via the admin_id parameter.

Executive Summary:
A critical SQL injection vulnerability in the projectworlds Advanced Library Management System allows unauthenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-13572

Affected Software: projectworlds Advanced Library Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the admin_id parameter in the delete_admin.php file, allowing unauthenticated remote attackers to inject malicious SQL queries. This flaw permits direct interaction with the database backend without requiring any administrative credentials.

Business Impact

Successful exploitation of this vulnerability enables unauthorized database access, which can lead to sensitive data leakage, unauthorized modification or deletion of records, and potential full system compromise. Given the CVSS score of 7.3, the risk of data integrity loss and service disruption is high, particularly for systems managing library patron or administrative information.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the delete_admin.php file via network-level controls or disable the vulnerable component until a fix is released.

Proactive Monitoring: Inspect web server access logs for anomalous GET requests targeting delete_admin.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or sleep commands.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the admin_id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked research writeup by GYSakura.

Analyst Notes: As of November 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability poses a significant risk to the integrity of the affected system. Administrators must prioritize isolating the vulnerable application from public access and monitor for any signs of unauthorized database interaction until a formal security update is provided by the vendor.

Description Summary:
The Lizza LMS Pro plugin for WordPress is vulnerable to privilege escalation, enabling unauthenticated attackers to register as administrators and take over the site.

Executive Summary:
A critical privilege escalation flaw in the Lizza LMS Pro WordPress plugin allows unauthenticated attackers to gain full administrator access during the registration process.

Vulnerability Details

CVE-ID: CVE-2025-13563

Affected Software: Lizza LMS Pro Plugin (WordPress)

Affected Versions: Up to, and including, 1.0.3

Vulnerability: The lizza_lms_pro_register_user_front_end function does not restrict the roles available during registration. An unauthenticated attacker can supply the 'administrator' role in the registration request to gain full control of the WordPress site.

Business Impact

A successful exploit results in the complete compromise of the Learning Management System, including access to student data, course materials, and financial records. The CVSS score of 9.8 reflects the severity of allowing unauthenticated users to escalate to the highest privilege level.

Remediation Plan

Immediate Action: Update the Lizza LMS Pro plugin to the latest version immediately to fix the registration role validation logic.

Proactive Monitoring: Inspect the WordPress audit logs for any registrations that resulted in the creation of an administrative account.

Compensating Controls: Implement a manual approval process for new user registrations or restrict registration to specific, low-privilege roles at the system level.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 19, 2026, there is no public information indicating active exploitation. This vulnerability is highly critical as it bypasses all standard authentication and authorization barriers.

Analyst Recommendation

Immediate remediation is required to prevent unauthorized administrative access. Update the plugin to the latest version and verify that the registration process no longer accepts arbitrary role assignments from the client side.

Description Summary:
A command injection vulnerability in the D-Link DIR-852 gena.cgi endpoint allows unauthenticated remote attackers to execute arbitrary system commands with root privileges.

Executive Summary:
An unauthenticated command injection vulnerability in D-Link DIR-852 routers poses a critical risk of full system compromise for affected devices.

Vulnerability Details

CVE-ID: CVE-2025-13562

Affected Software: D-Link DIR-852

Affected Versions: 1.00

Vulnerability: This vulnerability is a command injection (CWE-77) flaw located in the gena.cgi script. An unauthenticated attacker can trigger this by sending a crafted HTTP SUBSCRIBE request with a malicious service argument to the target device.

Business Impact

Successful exploitation grants an attacker arbitrary command execution with root privileges on the router. Given the device's role as a network gateway, this could lead to complete interception of network traffic, unauthorized access to internal resources, or the use of the device in botnet activities. While the CVSS score is 7.3, the potential for full system control and the absence of a vendor-provided patch make this a significant security risk.

Remediation Plan

Immediate Action: As this product is no longer supported by the vendor, there is no patch available. Administrators should immediately decommission these devices and replace them with currently supported hardware.

Proactive Monitoring: Monitor network traffic for unexpected SUBSCRIBE requests directed at the gena.cgi endpoint or unusual telnet activity originating from the device.

Compensating Controls: If immediate replacement is not possible, isolate the device behind a robust firewall and restrict access to the web management interface, particularly from untrusted or external networks.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the researcher write-up at the referenced GitHub repository.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication and targets a common network service script.

Analyst Recommendation

Due to the end-of-life status of the D-Link DIR-852 and the availability of functional exploit code, the risk of compromise is high. We strongly recommend that all organizations identify and remove these units from their network infrastructure immediately to prevent potential unauthorized access and lateral movement.

Description Summary:
SourceCodester Company Website CMS 1.0 contains a SQL injection vulnerability in the /admin/index.php file, allowing remote attackers to manipulate the Username argument.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Company Website CMS 1.0 allows for unauthenticated remote exploitation, posing a significant risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2025-13561

Affected Software: SourceCodester Company Website CMS

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/index.php file. The vulnerability arises from improper neutralization of the Username argument, which can be exploited by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exfiltration or administrative bypass. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application, especially if the database stores sensitive user credentials or proprietary business information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin directory using network-level controls or web server authentication until a secure update is released by the vendor.

Proactive Monitoring: Review web access logs for anomalous requests to the /admin/index.php endpoint, specifically looking for SQL syntax patterns or unexpected characters within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeted at the /admin/index.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no prior authentication to trigger the injection flaw.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection flaw necessitates immediate attention. Organizations utilizing SourceCodester Company Website CMS 1.0 must prioritize implementing compensating controls, such as WAF filtering or restricted network access, to mitigate the risk of unauthorized database interaction until a formal vendor patch is provided.

Description Summary:
SourceCodester Company Website CMS 1.0 is vulnerable to remote SQL injection via the email parameter in the password reset function, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Company Website CMS 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13560

Affected Software: SourceCodester Company Website CMS

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection through the email argument within the /admin/reset-password.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

This vulnerability poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, it represents a high-severity threat that could lead to unauthorized data exfiltration or administrative bypass. Successful exploitation may result in full compromise of the backend database, potentially leading to total system instability or unauthorized access to sensitive user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the /admin/reset-password.php endpoint or disable the password reset functionality until a security update is released by the vendor.

Proactive Monitoring: Security teams should implement enhanced monitoring on database query logs for suspicious patterns or unexpected syntax, particularly targeting requests directed at the password reset module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads targeting input parameters like email.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its lack of authentication requirements and the ability to execute arbitrary SQL commands.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing SourceCodester Company Website CMS 1.0 should prioritize implementing the suggested compensating controls and monitor for vendor updates to address this SQL injection flaw permanently.

Description Summary:
The EduKart Pro WordPress plugin allows unauthenticated attackers to register as administrators due to a failure in role restriction within the registration function.

Executive Summary:
A critical privilege escalation vulnerability in the EduKart Pro plugin allows unauthenticated attackers to gain full administrative control over the WordPress site.

Vulnerability Details

CVE-ID: CVE-2025-13559

Affected Software: venusweb EduKart Pro

Affected Versions: 0 through 1.0.3

Vulnerability: The vulnerability exists in the 'edukart_pro_register_user_front_end' function, which fails to perform proper capability checks or role validation during user registration. This allows an unauthenticated attacker to inject an 'administrator' role during the account creation process.

Business Impact

This vulnerability carries a CVSS score of 9.8, indicating a critical risk to the organization. Successful exploitation results in a complete compromise of the WordPress installation, enabling attackers to execute arbitrary code, modify site content, exfiltrate sensitive user data, or pivot to internal network resources.

Remediation Plan

Immediate Action: As no specific patched version is currently listed, administrators should immediately deactivate or uninstall the EduKart Pro plugin until a security update is released by the vendor.

Proactive Monitoring: Review WordPress user registration logs for accounts created with administrative privileges or unusual activity originating from unknown IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block registration requests that attempt to modify or inject role parameters, although deactivation remains the only guaranteed mitigation.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of Nov 25, 2025, there is no confirmed active exploitation in the wild, though the existence of a public proof-of-concept makes the risk of exploitation highly credible. The flaw is trivial to exploit as it requires no authentication or interaction from an existing user.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw and the availability of public proof-of-concept code, immediate action is required. Organizations should prioritize removing the vulnerable component from their production environment until the vendor provides a validated security patch.

Description Summary:
Campcodes Online Polling System 1.0 is vulnerable to unauthenticated SQL injection via the email parameter in the registeracc.php file.

Executive Summary:
Campcodes Online Polling System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13557

Affected Software: Campcodes Online Polling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the registeracc.php file. The application fails to properly sanitize the email input parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the application database, potentially resulting in data exfiltration or modification. Given the CVSS score of 7.3, this represents a high-risk security flaw that could lead to full compromise of the polling system and sensitive user information stored within the backend database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the registeracc.php endpoint or disable the registration functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the registeracc.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application registration forms.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced on GitHub (ProgramShowMaker/CVE/issues/3).

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

This vulnerability presents a significant risk due to the lack of required authentication and the presence of a public proof-of-concept. Organizations utilizing the Campcodes Online Polling System must prioritize limiting exposure of the vulnerable registeracc.php endpoint immediately and monitor vendor communications for an official security update to address the injection flaw.

Description Summary:
Campcodes Online Polling System 1.0 contains an unauthenticated SQL injection vulnerability in the /admin/checklogin.php file via the myusername parameter.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Polling System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13556

Affected Software: Campcodes Online Polling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/checklogin.php script. An unauthenticated remote attacker can manipulate the myusername argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive administrative credentials or the entire contents of the polling database. With a CVSS score of 7.3, this flaw represents a significant risk that could result in total compromise of the application data layer.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests to /admin/checklogin.php, particularly those containing SQL syntax characters like single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection patterns targeting the myusername parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research reference provided by the CVE record.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per the CVE record, a published proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the exploit, this vulnerability requires immediate attention. Organizations utilizing Campcodes Online Polling System 1.0 must implement strict access controls and WAF protections immediately to mitigate the risk of unauthorized database manipulation while awaiting a formal vendor security update.

Description Summary:
Campcodes School File Management System 1.0 contains an unauthenticated SQL injection vulnerability in the login index.php file via the stud_no parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Campcodes School File Management System allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-13555

Affected Software: Campcodes School File Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the login component, specifically within the index.php file. The vulnerability is triggered by manipulating the stud_no argument, and it can be exploited remotely by an unauthenticated attacker.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the backend database, potentially leading to the unauthorized disclosure or modification of sensitive student and administrative information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to a full compromise of the application data layer.

Remediation Plan

Immediate Action: Since no specific patch is currently available, administrators should restrict access to the login interface using network-level controls or a Web Application Firewall until an official vendor update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns in the stud_no parameter and monitor database audit logs for unusual query activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced on GitHub.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes School File Management System 1.0 must prioritize isolating the affected component from the public internet and implementing stringent WAF filtering to prevent potential data breaches while awaiting a vendor-supplied security update.

Description Summary:
A SQL injection vulnerability in the Campcodes Supplier Management System 1.0 login page allows unauthenticated remote attackers to manipulate the txtUsername parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise database integrity and potentially bypass authentication.

Vulnerability Details

CVE-ID: CVE-2025-13554

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The flaw exists within the index.php file of the Login component, where the txtUsername argument fails to properly sanitize user input. This allows an unauthenticated attacker to execute arbitrary SQL commands remotely.

Business Impact

The ability to perform unauthenticated SQL injection represents a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to extract sensitive supplier data, manipulate records, or gain unauthorized access to the management console, leading to potential operational disruption and loss of trust.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the login portal and implement strict input validation at the Web Application Firewall level.

Proactive Monitoring: Review web server access logs for anomalous characters or SQL syntax patterns within the txtUsername parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to detect and block SQL injection attempts targeting the index.php login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/arpcyber060/CVE/issues/3.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, immediate defensive measures are required. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied security patch is released and validated.

Description Summary:
A buffer overflow vulnerability in the D-Link DWR-M920 router allows remote attackers to trigger memory corruption via the formPinManageSetup function.

Executive Summary:
A critical buffer overflow vulnerability in the D-Link DWR-M920 router could allow an attacker to gain unauthorized control over the device.

Vulnerability Details

CVE-ID: CVE-2025-13553

Affected Software: D-Link DWR-M920

Affected Versions: 1.1.50

Vulnerability: This vulnerability is a buffer overflow (CWE-120) triggered by improper handling of the submit-url argument within the sub_41C7FC function of the /boafrm/formPinManageSetup endpoint. Although the CVSS vector indicates that low privileges are required, the flaw can be initiated remotely.

Business Impact

The exploitation of this buffer overflow could lead to a complete compromise of the affected D-Link router, resulting in unauthorized access to network traffic or total system failure. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational network security and potential data confidentiality.

Remediation Plan

Immediate Action: Monitor official D-Link support channels for firmware updates that address this buffer overflow and apply them immediately upon release.

Proactive Monitoring: Review device access logs for unusual traffic patterns or malformed requests directed at the /boafrm/formPinManageSetup endpoint.

Compensating Controls: Deploy a Web Application Firewall or network-level security controls to inspect and filter incoming traffic for suspicious payloads targeting the management interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability report.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier for malicious actors to develop functional exploit code.

Analyst Recommendation

Given the high CVSS score and the confirmed existence of a public proof-of-concept, this vulnerability poses a significant threat to internal network infrastructure. Administrators should restrict management interface access to trusted internal IP addresses only and prioritize applying vendor patches as soon as they become available to mitigate the risk of device compromise.

Description Summary:
A buffer overflow vulnerability exists in the D-Link DIR-822K and DWR-M920 routers, allowing remote attackers to trigger memory corruption via the submit-url argument in the /boafrm/formWlEncrypt file.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers enables remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13552

Affected Software: D-Link DIR-822K and DWR-M920

Affected Versions: 1.00_20250513164613, 1.1.50

Vulnerability: The vulnerability is a buffer overflow (CWE-120) occurring within the /boafrm/formWlEncrypt script. By manipulating the submit-url parameter, a remote, authenticated attacker can trigger memory corruption that may lead to arbitrary code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized control over affected networking hardware. This poses a significant risk to organizational confidentiality, integrity, and availability, as routers serve as the gateway for network traffic. Given the CVSS score of 8.8, this flaw is categorized as High severity, necessitating immediate attention to prevent potential lateral movement or persistent network monitoring.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately isolate affected devices from the public internet and restrict management access to trusted internal networks only.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes, unexpected reboots, or suspicious traffic patterns originating from the /boafrm/ directory.

Compensating Controls: Implement firewall rules to block unsolicited inbound access to the router management interface and consider using a Web Application Firewall or similar inspection tool to filter malicious payloads directed at the submit-url parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of November 25, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous because it allows remote manipulation of memory, which is a common precursor to full system takeover.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using the D-Link DIR-822K or DWR-M920 should prioritize restricting access to these devices immediately. Monitor vendor support channels closely for the release of security firmware, and apply the update as soon as it becomes available to remediate the underlying memory corruption flaw.

Description Summary:
A buffer overflow vulnerability exists in D-Link DIR-822K and DWR-M920 routers, allowing remote attackers to trigger memory corruption via the submit-url argument in the formWanConfigSetup file.

Executive Summary:
D-Link DIR-822K and DWR-M920 routers are affected by a critical remote buffer overflow vulnerability that could allow for unauthorized system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13551

Affected Software: D-Link DIR-822K and DWR-M920

Affected Versions: 1.00_20250513164613, 1.1.50

Vulnerability: This is a memory corruption flaw caused by a buffer overflow in the /boafrm/formWanConfigSetup component. The vulnerability is reachable via the submit-url parameter and requires low privileges to execute remotely.

Business Impact

Successful exploitation of this buffer overflow can lead to a total loss of system integrity and availability, potentially allowing an attacker to gain unauthorized control over affected networking hardware. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could facilitate lateral movement within a network or allow an attacker to intercept sensitive traffic.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the affected devices and disable remote management interfaces immediately.

Proactive Monitoring: Monitor device logs for unusual traffic patterns or segmentation faults associated with the /boafrm/formWanConfigSetup endpoint.

Compensating Controls: Implement strict firewall rules to limit access to the administrative interface to trusted management IP addresses only, effectively mitigating the remote attack vector.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/QIU-DIE/CVE/issues/46.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its nature as a memory corruption flaw that allows remote execution.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, users of the D-Link DIR-822K and DWR-M920 must treat this as a high-priority security issue. Organizations should isolate these devices from the public internet immediately and monitor vendor communication channels for the release of firmware updates to permanently resolve the underlying buffer overflow.

Description Summary:
A buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers allows remote attackers to trigger memory corruption via the submit-url parameter in the /boafrm/formVpnConfigSetup endpoint.

Executive Summary:
A critical remote buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers poses a severe risk of unauthorized code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13550

Affected Software: D-Link DIR-822K and DWR-M920

Affected Versions: 1.00_20250513164613, 1.1.50

Vulnerability: This is a memory corruption vulnerability classified as a buffer overflow (CWE-120). It occurs when the /boafrm/formVpnConfigSetup endpoint fails to properly validate input provided to the submit-url argument, which can be manipulated by an authenticated user to achieve remote code execution.

Business Impact

The exploitation of this vulnerability can lead to complete system compromise, allowing an attacker to gain unauthorized control over network infrastructure. Given the CVSS score of 8.8, this flaw represents a high-severity risk that could result in data interception, lateral movement within the network, or persistent denial of service, significantly impacting organizational availability and confidentiality.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, administrators should restrict access to the management interface of the affected devices and monitor vendor support portals for emergency firmware releases.

Proactive Monitoring: Security teams should monitor network traffic for anomalous requests targeting the /boafrm/formVpnConfigSetup endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement access control lists (ACLs) to limit management access to trusted internal IP addresses only, and deploy a Web Application Firewall (WAF) or network-based intrusion detection system to filter malicious payloads directed at the vulnerable URL parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced security researcher's GitHub issue tracker.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the potential for memory corruption leading to full remote control of the device.

Analyst Recommendation

Due to the presence of a public proof-of-concept and the high-severity nature of buffer overflow vulnerabilities, this issue should be treated as an urgent priority. Administrators must immediately isolate affected routers from public-facing exposure and apply vendor-supplied firmware updates as soon as they become available to eliminate the underlying attack vector.

Description Summary:
A buffer overflow vulnerability exists in the D-Link DIR-822K router due to improper input validation within the formNtp function, allowing remote exploitation via the submit-url argument.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-822K firmware version 1.00 allows remote attackers to trigger memory corruption and execute unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2025-13549

Affected Software: D-Link DIR-822K

Affected Versions: 1.00

Vulnerability: The flaw resides in the sub_455524 function within the /boafrm/formNtp file, where insufficient validation of the submit-url parameter leads to a buffer overflow. The CVSS vector indicates that the attack requires low privileges (authenticated) and is exploitable over the network without user interaction.

Business Impact

The exploitation of this buffer overflow can lead to a complete compromise of the affected network device, resulting in unauthorized administrative control, potential traffic interception, or permanent denial of service. With a CVSS score of 8.8, this vulnerability represents a significant risk to network integrity and confidentiality, particularly if the device serves as a primary gateway or edge router.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict management interface access to trusted internal networks only and disable remote administration features.

Proactive Monitoring: Monitor system logs for unusual administrative access attempts or frequent device reboots, which may indicate crash attempts associated with memory corruption.

Compensating Controls: Implement strict network segmentation to isolate the vulnerable device and deploy an intrusion detection system to monitor for malicious payloads targeting the /boafrm/formNtp endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided by the vulnerability reporter on GitHub.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the remote exploitability and the existence of a public proof-of-concept, users of the D-Link DIR-822K should prioritize isolating these devices from external network exposure. Organizations must maintain strict access controls and monitor for vendor updates, applying them immediately upon release to remediate the underlying memory corruption flaw.

Description Summary:
A buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers allows remote attackers to trigger memory corruption via the submit-url argument in the /boafrm/formFirewallAdv endpoint.

Executive Summary:
A critical buffer overflow vulnerability in D-Link DIR-822K and DWR-M920 routers poses a high risk of remote code execution and system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13548

Affected Software: D-Link DIR-822K and DWR-M920

Affected Versions: 1.00_20250513164613, 1.1.50

Vulnerability: The vulnerability is a buffer overflow (CWE-120) triggered by improper handling of the submit-url parameter within the /boafrm/formFirewallAdv file. While the CVSS vector indicates that low privileges are required (PR:L), the flaw allows for remote exploitation and total technical impact.

Business Impact

The potential for remote code execution via buffer overflow presents a severe risk to organizational network security. Compromise of these devices could lead to total loss of confidentiality, integrity, and availability, effectively granting attackers a foothold within the local network. With a CVSS score of 8.8, this vulnerability is categorized as High and warrants immediate attention to prevent unauthorized access or device hijacking.

Remediation Plan

Immediate Action: Since a specific patch is not currently identified, administrators should immediately restrict access to the affected web management interfaces by disabling remote administration or placing these devices behind a firewall.

Proactive Monitoring: Monitor network traffic for unusual POST requests targeting the /boafrm/formFirewallAdv endpoint and review device logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement Web Application Firewall (WAF) rules or network access control lists to block traffic directed at the vulnerable management URI from untrusted sources.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided via the referenced GitHub issue.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the high severity and the availability of public proof-of-concept code, users of D-Link DIR-822K and DWR-M920 devices must prioritize securing their management interfaces. Organizations should verify their firmware versions and monitor official D-Link support channels for upcoming security patches, applying them as soon as they become available.

Description Summary:
A memory corruption vulnerability exists in D-Link DIR-822K and DWR-M920 routers within the /boafrm/formDdns file, allowing remote attackers to manipulate the submit-url argument.

Executive Summary:
A memory corruption vulnerability in D-Link DIR-822K and DWR-M920 routers allows for remote exploitation, posing a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-13547

Affected Software: D-Link DIR-822K and DWR-M920

Affected Versions: 1.00_20250513164613, 1.1.50

Vulnerability: The flaw is a memory corruption issue triggered via the submit-url argument in the /boafrm/formDdns endpoint. The vulnerability requires low privileges (authenticated) to initiate a remote attack.

Business Impact

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation could lead to total compromise of the affected routing hardware, potentially allowing attackers to intercept network traffic, gain unauthorized access to internal resources, or cause persistent denial of service conditions.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict access to the web management interface, ensure the device is not exposed to the public internet, and monitor for official firmware updates from D-Link.

Proactive Monitoring: Review system logs for unusual activity or unauthorized access attempts targeting the /boafrm/formDdns endpoint or administrative management pages.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network security control to filter or block suspicious HTTP requests containing malformed submit-url parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://github.com/QIU-DIE/CVE/issues/42).

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential to cause arbitrary memory corruption, which is a common precursor to remote code execution.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, the risk of exploitation is elevated. Network administrators should immediately isolate these devices from external networks and monitor vendor communications closely for the release of a security patch to resolve this memory corruption flaw.

Description Summary:
The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation, potentially allowing remote code execution by authenticated users.

Executive Summary:
A high-severity arbitrary file upload vulnerability in the PostGallery plugin for WordPress allows authenticated attackers with subscriber-level permissions to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-13543

Affected Software: rtowebsites PostGallery

Affected Versions: 0 through 1.12.5

Vulnerability: This flaw is caused by improper file type validation within the PostGalleryUploader class functions, which can be exploited by any authenticated user, including those with subscriber-level access, to upload malicious files to the server.

Business Impact

The ability for an attacker to upload arbitrary files, such as malicious scripts, poses a critical risk to the confidentiality, integrity, and availability of the affected WordPress site. Successful exploitation can lead to full site compromise, unauthorized data access, and the potential for lateral movement within the hosting environment. With a CVSS score of 8.8, this vulnerability represents a significant security risk that requires prompt attention.

Remediation Plan

Immediate Action: As there is currently no patched version available, administrators should immediately deactivate and uninstall the PostGallery plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious file uploads or requests directed at the plugin directory, specifically looking for attempts to access non-image file extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and restrict access to the plugin's upload endpoints for users below administrator privileges.

Exploitation Status

Public Exploit Available: Yes, two public proof-of-concept repositories exist on GitHub.

Analyst Notes: As of 2025-12-09, there is no confirmed active exploitation in the wild, though the existence of public proof-of-concept code increases the likelihood of opportunistic attacks. The flaw is inherently exploitable because the underlying code lacks the necessary capability checks to prevent standard users from interacting with the upload function.

Analyst Recommendation

Given the high CVSS score and the existence of public proof-of-concept material, this vulnerability poses a credible threat to any WordPress installation utilizing the PostGallery plugin. Administrators must prioritize the immediate removal or deactivation of the affected component to prevent potential remote code execution. Continue to monitor the official WordPress plugin repository for the release of a security patch and only re-enable the plugin once the vendor has confirmed the flaw is resolved.

Description Summary:
The DesignThemes LMS plugin for WordPress is vulnerable to unauthenticated privilege escalation, allowing attackers to register as administrators through the registration function.

Executive Summary:
An unauthenticated privilege escalation vulnerability in the DesignThemes LMS plugin for WordPress allows remote attackers to gain full administrative access to the affected site.

Vulnerability Details

CVE-ID: CVE-2025-13542

Affected Software: DesignThemes DesignThemes LMS

Affected Versions: 0 through 1.0.4

Vulnerability: The vulnerability exists in the dtlms_register_user_front_end function, which fails to perform proper capability checks or validation on user-supplied role parameters. This allows any unauthenticated attacker to inject the administrator role during the account registration process.

Business Impact

The potential for total site takeover represents a critical security risk, as unauthorized administrative access can lead to full data exfiltration, the deployment of malicious code, and total loss of system integrity. With a CVSS score of 9.8, this vulnerability is considered critical because it requires no authentication to execute and results in complete compromise of the WordPress environment.

Remediation Plan

Immediate Action: Review the official DesignThemes vendor advisory for the release of a patched version of the LMS plugin and apply the update immediately. If no patch is currently available, deactivate the plugin until a secure version is released.

Proactive Monitoring: Audit user account creation logs for suspicious administrator registrations and monitor the WordPress user database for unauthorized account elevation.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests targeting the dtlms_register_user_front_end endpoint, or restrict registration access to trusted IP addresses only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Dec 2, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the ease of exploitation, as it requires no interaction from a privileged user to grant the attacker full administrative control.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw and the potential for total system compromise, administrators must treat this as a high-priority incident. If you are running version 1.0.4 or earlier, you should immediately disable the plugin and monitor the environment for signs of unauthorized administrative accounts until a vendor-supplied patch is successfully deployed.

Description Summary:
The Tiare Membership plugin for WordPress fails to validate user roles during registration, allowing unauthenticated attackers to register as administrators and compromise the entire site.

Executive Summary:
The Tiare Membership plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain full administrative control over the affected website.

Vulnerability Details

CVE-ID: CVE-2025-13540

Affected Software: Qode Interactive Tiare Membership

Affected Versions: 0 through 1.2

Vulnerability: This vulnerability is caused by improper privilege management within the tiare_membership_init_rest_api_register function, which fails to restrict the roles assigned during user registration. Consequently, an unauthenticated attacker can supply the administrator role during the registration process to achieve full site takeover.

Business Impact

A successful exploit grants an attacker complete administrative access to the WordPress environment. This level of compromise leads to total data loss, unauthorized access to sensitive user information, and the potential for full site defacement or the installation of malicious backdoors, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Since a specific patched version is not currently identified in the provided data, administrators should immediately deactivate and remove the Tiare Membership plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user registration logs for suspicious activity or accounts created with administrative privileges that were not authorized by site management.

Compensating Controls: Implement a Web Application Firewall to block unauthorized REST API requests directed at the plugin registration endpoints.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized module available in current data.

Analyst Notes: As of Nov 28, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its ease of exploitation: it requires no authentication and targets the core registration functionality of the plugin.

Analyst Recommendation

Given the critical nature of this privilege escalation flaw, immediate action is required to prevent unauthorized administrative access. If the Tiare Membership plugin is currently active on your environment, you must disable it immediately to mitigate the risk of full site compromise. Monitor vendor release channels closely for a security update and verify the integrity of your administrative user list before restoring functionality.

Description Summary:
The FindAll Membership plugin for WordPress fails to properly validate user login data, allowing unauthenticated attackers to gain administrative access.

Executive Summary:
A critical authentication bypass vulnerability in the FindAll Membership plugin allows unauthenticated attackers to hijack administrative accounts and gain full control over the affected WordPress site.

Vulnerability Details

CVE-ID: CVE-2025-13539

Affected Software: Elated Themes FindAll Membership

Affected Versions: 0 through 1.0.4

Vulnerability: This vulnerability occurs due to improper session handling within the findall_membership_check_facebook_user and findall_membership_check_google_user functions. Unauthenticated attackers can leverage this flaw to impersonate administrative users if they possess knowledge of the target account email and utilize the default temporary user functionality.

Business Impact

Successful exploitation grants an attacker full administrative privileges, leading to complete site compromise. This permits the exfiltration of sensitive data, the injection of malicious content, and potential persistent access to the server environment. With a CVSS score of 9.8, this vulnerability is classified as critical, as it requires no user interaction or prior authentication to execute.

Remediation Plan

Immediate Action: Discontinue the use of the FindAll Membership plugin immediately until a security update is released by the vendor, as no patch is currently identified. If the plugin is essential, restrict access to the site entirely until a fix is deployed.

Proactive Monitoring: Review WordPress administrative user logs for unauthorized account creation or suspicious login activity associated with the affected plugin functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests attempting to interact with the identified vulnerable authentication functions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Nov 27, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to its reliance on standard plugin functionality to bypass security controls.

Analyst Recommendation

Given the critical severity of this authentication bypass, administrators must treat this as a priority security event. Because no patch is currently available, removing the plugin is the only guaranteed method to prevent unauthorized administrative access. If removal is not feasible, implement strict network-level access controls and maintain heightened monitoring for any unauthorized administrative activity.

Description Summary:
The FindAll Listing plugin for WordPress fails to restrict user roles during registration, allowing unauthenticated attackers to register as site administrators.

Executive Summary:
A critical privilege escalation vulnerability in the Elated Themes FindAll Listing plugin enables unauthenticated attackers to gain full administrative control over the WordPress site.

Vulnerability Details

CVE-ID: CVE-2025-13538

Affected Software: Elated Themes FindAll Listing

Affected Versions: 0 through 1.0.5

Vulnerability: This vulnerability, identified as CWE-269, exists within the findall_listing_user_registration_additional_params function. Unauthenticated attackers can inject the administrator role during the registration process, provided the FindAll Membership plugin is also active.

Business Impact

Successful exploitation grants an attacker full administrative access to the WordPress environment. Given the CVSS score of 9.8, this represents a critical risk that could lead to complete system compromise, unauthorized data exfiltration, and full site takeover.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate the FindAll Listing and FindAll Membership plugins until a secure update is provided by the vendor.

Proactive Monitoring: Review WordPress user registration logs for anomalous account creations or users with unexpected administrator privileges.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block registration requests that attempt to modify user role parameters or suspicious POST requests directed at the registration endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 28, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of input validation on user roles during the registration sequence.

Analyst Recommendation

This vulnerability presents a severe risk to site integrity and security. Because the flaw allows for unauthenticated privilege escalation, organizations using these plugins must prioritize their immediate deactivation or removal until the vendor releases a verified security update.

Description Summary:
The PowerPress plugin for WordPress is vulnerable to arbitrary file uploads in versions up to 11.15.2, potentially allowing authenticated remote code execution.

Executive Summary:
The Blubrry PowerPress plugin for WordPress contains an arbitrary file upload vulnerability that allows authenticated attackers with Contributor access or higher to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-13536

Affected Software: Blubrry PowerPress Podcasting plugin

Affected Versions: 0 through 11.15.2

Vulnerability: The flaw exists within the powerpress_edit_post function, which fails to properly halt execution when file extension validation fails. This allows authenticated users with Contributor-level privileges to upload malicious files to the server, leading to potential remote code execution.

Business Impact

A successful exploit grants an attacker the ability to execute arbitrary code on the underlying web server. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full site compromise, unauthorized data access, and potential lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update the Blubrry PowerPress Podcasting plugin to version 11.15.3 or the latest available release immediately.

Proactive Monitoring: Monitor web server logs for suspicious file upload activity, particularly requests directed toward the plugin directory or unexpected file types being created in the WordPress uploads folder.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and restrict access to the WordPress administrative and post-editing interfaces for non-trusted users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 28, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is restricted by the requirement for Contributor-level authentication, which serves as a barrier for external unauthenticated actors but remains a significant risk from malicious or compromised internal user accounts.

Analyst Recommendation

This vulnerability presents a significant risk to WordPress installations due to the potential for remote code execution. Administrators should prioritize updating the PowerPress plugin immediately to close the file upload vector. If an immediate update is not feasible, restrict the Contributor role permissions or disable the plugin until a patch can be successfully deployed.

Description Summary:
The OneClick Chat to Order plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing unauthenticated access to sensitive customer order data.

Executive Summary:
The OneClick Chat to Order plugin for WordPress contains an Insecure Direct Object Reference vulnerability that allows unauthenticated attackers to exfiltrate sensitive customer information.

Vulnerability Details

CVE-ID: CVE-2025-13526

Affected Software: walterpinem OneClick Chat to Order

Affected Versions: 0 through 1.0.8

Vulnerability: This vulnerability occurs in the wa_order_thank_you_override function due to a lack of proper validation on a user controlled parameter. An unauthenticated attacker can view private order details, including contact information and payment methods, by manipulating the order ID in the URL.

Business Impact

The exposure of customer contact details, addresses, and payment information poses a severe risk to data privacy and regulatory compliance. With a CVSS score of 7.5, this high severity vulnerability could result in significant reputational damage, loss of customer trust, and potential legal liabilities stemming from data breaches.

Remediation Plan

Immediate Action: Update the OneClick Chat to Order plugin to the latest available version that includes the patch for this vulnerability. If an update is not immediately available, deactivate the plugin until a secure version is deployed.

Proactive Monitoring: Review web server access logs for anomalous patterns where an external entity attempts to iterate through sequential order IDs or requests the thank you page with unauthorized parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized or suspicious requests to the plugin's thank you page endpoints, though this should be considered a temporary measure.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and the sensitive nature of the exposed data.

Analyst Recommendation

Given the high impact of this vulnerability, administrators should prioritize the remediation of this plugin immediately. Because the vulnerability allows unauthenticated access to sensitive customer data, identifying and patching the affected installations is critical to preventing unauthorized data exfiltration.

Description Summary:
The Mattermost Confluence plugin fails to sanitize user display names during HTML template rendering, allowing authenticated users to perform stored Cross-site Scripting attacks.

Executive Summary:
A high-severity Cross-site Scripting vulnerability in the Mattermost Confluence plugin allows authenticated users to execute arbitrary JavaScript in the browsers of other users.

Vulnerability Details

CVE-ID: CVE-2025-13523

Affected Software: Mattermost Confluence Plugin

Affected Versions: 0 up to 1.7.0

Vulnerability: The vulnerability is a Stored Cross-site Scripting flaw (CWE-79) caused by improper neutralization of user-controlled display names. An authenticated user can trigger this by crafting a malicious display name, which is then rendered in the browser of a victim who visits a malicious OAuth2 connection link.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript within the context of a victim's session, potentially leading to unauthorized actions, session hijacking, or sensitive data theft. With a CVSS score of 7.7, this vulnerability poses a significant risk to organizational data integrity and user account security, particularly within collaborative environments where trust is high.

Remediation Plan

Immediate Action: Update the Mattermost Confluence plugin to version 1.7.0 or higher immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web application logs for suspicious OAuth2 traffic patterns or unusual display name strings that contain script tags or unexpected HTML characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block malicious payloads in HTTP requests, which may provide temporary protection against XSS injection attempts.

Exploitation Status

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Analyst Notes: As of February 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be authenticated to the platform, which limits the attack surface to existing users within the environment.

Analyst Recommendation

Given the potential for account compromise and the ability for an attacker to target other users via OAuth2 links, organizations should prioritize updating the Mattermost Confluence plugin to version 1.7.0. Administrators must ensure that all instances are patched to eliminate this XSS vector and protect user sessions from unauthorized script execution.

Description Summary:
The SureMail WordPress plugin allows unauthenticated users to upload arbitrary files due to insufficient validation in the save_file function, potentially leading to remote code execution.

Executive Summary:
A critical file upload vulnerability in the SureMail WordPress plugin allows unauthenticated attackers to execute arbitrary code, posing a severe risk to site integrity and server security.

Vulnerability Details

CVE-ID: CVE-2025-13516

Affected Software: Brainstorm Force SureMail – SMTP and Email Logs Plugin

Affected Versions: 0 through 1.9.0

Vulnerability: The plugin fails to validate file types or extensions in the save_file function, allowing unauthenticated attackers to upload malicious scripts to a web-accessible directory. Because the plugin uses predictable MD5 hash naming and relies on ineffective .htaccess protections on non-Apache servers, attackers can trigger remote code execution by directly accessing the uploaded files.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary code on the underlying web server, leading to a complete compromise of the WordPress installation and potentially the entire hosting environment. Given the CVSS score of 8.1, this vulnerability is classified as High severity, as it facilitates unauthorized data exfiltration, site defacement, or the deployment of malware with minimal effort from an unauthenticated remote actor.

Remediation Plan

Immediate Action: Update the SureMail – SMTP and Email Logs Plugin to the latest available version provided by Brainstorm Force. If an update is not immediately available, deactivate the plugin until a patch is applied.

Proactive Monitoring: Review web server access logs for requests directed at the wp-content/uploads/suremails/attachments/ directory, specifically looking for attempts to access .php files.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block direct access to the /wp-content/uploads/suremails/attachments/ directory and prohibit the execution of script files from within the uploads folder.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of 2025-12-02, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is technically feasible through predictable filename generation, the reliance on specific server configurations limits the immediate attack surface for attackers.

Analyst Recommendation

This vulnerability represents a significant security oversight that bypasses standard access controls. Administrators should prioritize the update of this plugin immediately to eliminate the risk of remote code execution. If the plugin cannot be updated, it must be removed from the environment to prevent potential exploitation.

Description Summary:
A vulnerability in Nebim V3 ERP allows for execution with unnecessary privileges, enabling an authenticated user to expand control over the underlying operating system via the database.

Executive Summary:
A critical privilege escalation vulnerability in Nebim V3 ERP permits authenticated attackers to compromise the host operating system through the database.

Vulnerability Details

CVE-ID: CVE-2025-13506

Affected Software: Nebim Neyir Computer Industry and Services Inc, Nebim V3 ERP

Affected Versions: 2.0.59 up to (excluding) 3.0.1

Vulnerability: The flaw is categorized as CWE-250, Execution with Unnecessary Privileges, where the application fails to restrict database operations appropriately. An attacker with low-level authenticated access can leverage this to gain expanded control over the underlying operating system.

Business Impact

This vulnerability carries a high CVSS score of 8.8, reflecting the severity of allowing an authenticated user to achieve total control over system resources. A successful exploit could lead to full system compromise, unauthorized access to sensitive financial or business data, and significant operational disruption. The ability to escalate privileges from a database connection poses a severe risk to the integrity and confidentiality of the entire ERP environment.

Remediation Plan

Immediate Action: Update Nebim V3 ERP to version 3.0.1 or later immediately to apply the necessary security controls.

Proactive Monitoring: Review database access logs for unusual command execution patterns or unauthorized administrative actions initiated by standard user accounts.

Compensating Controls: Implement strict database user permission controls, ensuring that the application service account operates with the absolute minimum privileges required for its function.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of June 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent risk is elevated due to the direct path it provides from a standard authenticated session to operating system level control.

Analyst Recommendation

Given the high CVSS score and the potential for total system compromise, organizations running Nebim V3 ERP should prioritize this update. Administrators must verify their version numbers and apply the vendor patch immediately to prevent potential exploitation of this privilege escalation flaw.

Description Summary:
A flaw in WebKitGTK and WPE WebKit allows an out-of-bounds read and integer underflow, causing a UIProcess crash via a crafted payload to the GLib remote inspector server.

Executive Summary:
A critical vulnerability in WebKitGTK and WPE WebKit allows unauthenticated remote attackers to trigger a denial of service via a crafted payload.

Vulnerability Details

CVE-ID: CVE-2025-13502

Affected Software: WebKitGTK and WPE WebKit

Affected Versions: WebKitGTK prior to 2.50.2; various Red Hat Enterprise Linux distributions.

Vulnerability: The vulnerability consists of an out-of-bounds read and integer underflow triggered by a crafted payload sent to the GLib remote inspector server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that this is an unauthenticated, network-exploitable flaw requiring no user interaction.

Business Impact

The ability for a remote, unauthenticated attacker to cause a UIProcess crash results in a denial of service, which can disrupt critical browser or application functionality. Given the CVSS score of 7.5, this high-severity flaw represents a significant risk to service availability, particularly for systems utilizing the WebKit engine for core business operations.

Remediation Plan

Immediate Action: Update WebKitGTK to version 2.50.2 or later, or apply the specific security errata provided by Red Hat for your respective distribution (e.g., RHSA-2025:22789).

Proactive Monitoring: Monitor system logs for abnormal activity or frequent service restarts associated with the GLib remote inspector server.

Compensating Controls: Disable the remote inspector server functionality if it is not required for production environments to eliminate the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of November 27, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is network-exploitable and automatable, the lack of current exploit activity allows for a prioritized but controlled patching cycle.

Analyst Recommendation

Organizations should prioritize the deployment of the provided vendor patches to eliminate this denial of service risk. Because the vulnerability is remotely exploitable without authentication, systems exposing the GLib remote inspector server to the network must be patched or isolated immediately to maintain system stability.

Description Summary:
A flaw in the Wireshark Kafka dissector allows for a denial of service through the access of an uninitialized pointer when processing malicious traffic.

Executive Summary:
The Wireshark Kafka dissector contains a memory safety vulnerability that can be exploited by an attacker to trigger a crash, leading to a denial of service.

Vulnerability Details

CVE-ID: CVE-2025-13499

Affected Software: Wireshark Foundation Wireshark

Affected Versions: 4.6.0, 4.4.0 through 4.4.10

Vulnerability: This issue is a CWE-824 vulnerability involving the access of an uninitialized pointer within the Kafka dissector. An attacker can trigger this condition by providing a specially crafted capture file, requiring user interaction to process the file.

Business Impact

The exploitation of this vulnerability results in a denial of service, which can disrupt network analysis operations and security monitoring workflows. Given the CVSS score of 7.8, the impact on availability is significant, potentially hindering incident response capabilities during critical network events. Organizations relying on Wireshark for continuous traffic monitoring face temporary operational downtime if an attacker successfully triggers the crash.

Remediation Plan

Immediate Action: Upgrade to Wireshark version 4.6.1, 4.4.11, or later to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review security logs for evidence of unusual traffic capture activity or unexpected application terminations.

Compensating Controls: Restrict the ability to open or process untrusted packet capture files from unknown or external sources until the software has been updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is an inherent memory management error triggered by malformed input files.

Analyst Recommendation

This vulnerability presents a high risk to availability for teams that frequently perform deep packet inspection on potentially adversarial traffic. System administrators should prioritize the deployment of the patched versions, 4.6.1 or 4.4.11, to ensure the stability and security of their network analysis environment.

Description Summary:
The Latest Registered Users WordPress plugin is vulnerable to unauthenticated user data export due to missing authorization checks in its form submission handling.

Executive Summary:
A critical vulnerability in the Latest Registered Users WordPress plugin allows unauthenticated attackers to export sensitive user data, posing a significant risk to user privacy.

Vulnerability Details

CVE-ID: CVE-2025-13493

Affected Software: WebRndExperts Latest Registered Users

Affected Versions: 0 through 1.4

Vulnerability: The plugin suffers from missing authorization and nonce validation within the rnd_handle_form_submit function. This flaw allows unauthenticated remote attackers to trigger the export of site user details in CSV format by manipulating the action parameter.

Business Impact

Successful exploitation of this vulnerability results in the unauthorized disclosure of user information, which can lead to targeted phishing campaigns, identity theft, or further compromise of the WordPress environment. With a CVSS score of 7.5, the risk is considered high due to the ease of exploitation by unauthenticated actors and the potential for large-scale data harvesting.

Remediation Plan

Immediate Action: Since no patched version is currently available, administrators should immediately deactivate and uninstall the Latest Registered Users plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting the admin-post.php endpoint or the my_simple_form action, which may indicate attempted exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing the action=my_simple_form parameter if the plugin must remain active in a restricted environment.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of January 9, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it requires no authentication to execute, allowing automated scripts to scrape user databases with minimal effort.

Analyst Recommendation

Given the lack of a vendor-provided patch, the only effective way to mitigate this risk is the total removal of the vulnerable software from the production environment. Organizations should prioritize removing this plugin immediately to prevent the unauthorized exfiltration of user records.

Description Summary:
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to unauthenticated remote code execution via the prepare_form function due to improper input handling.

Executive Summary:
A critical remote code execution vulnerability in the Advanced Custom Fields: Extended plugin allows unauthenticated attackers to gain full control over the affected WordPress server.

Vulnerability Details

CVE-ID: CVE-2025-13486

Affected Software: The Advanced Custom Advanced Custom Fields: Extended

Affected Versions: 0.9.0.5 through 0.9.1.1

Vulnerability: The vulnerability exists within the prepare_form() function, which improperly passes user-supplied input to call_user_func_array(). This flaw allows unauthenticated remote attackers to execute arbitrary code on the underlying server.

Business Impact

The CVSS score of 9.8 reflects the critical nature of this flaw, as it requires no authentication and provides full system impact. Successful exploitation can lead to total compromise of the WordPress environment, including unauthorized data exfiltration, the installation of persistent backdoors, and the creation of administrative accounts, leading to severe reputational and operational damage.

Remediation Plan

Immediate Action: Update the Advanced Custom Fields: Extended plugin to the latest available version immediately to patch the vulnerable prepare_form() function. If an update is not immediately available, deactivate the plugin until a secure version is deployed.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugin directory, specifically looking for attempts to call unexpected functions or execute system-level commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rules to detect and block malicious payloads targeting the prepare_form() function. Ensure the WAF is configured to log and alert on blocked attempts to prevent further exploitation.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via a Metasploit module and various public proof-of-concept repositories on GitHub.

Analyst Notes: As of Dec 3, 2025, there is no public information indicating active exploitation in the wild, though the presence of weaponized exploit code makes the risk of imminent attack extremely high. The vulnerability is highly exploitable due to the lack of authentication requirements and the direct nature of the code injection flaw.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of weaponized exploit code, organizations must prioritize patching this plugin immediately. Failure to address this flaw leaves the entire server environment exposed to complete takeover. Administrators should verify the integrity of their WordPress instance post-patch to ensure no unauthorized administrative users or backdoors were created during the exposure window.

Description Summary:
A SQL injection vulnerability exists in itsourcecode Online File Management System 1.0 via the Username parameter in ajax.php, allowing remote unauthenticated attackers to execute malicious queries.

Executive Summary:
The itsourcecode Online File Management System version 1.0 is vulnerable to an unauthenticated SQL injection attack, which could allow remote actors to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13485

Affected Software: itsourcecode Online File Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the ajax.php file, triggered by manipulating the Username argument during the login process. The flaw allows an unauthenticated, remote attacker to perform unauthorized database operations.

Business Impact

Successful exploitation of this vulnerability permits unauthorized interaction with the underlying database, potentially leading to data exfiltration, modification, or account bypass. With a CVSS score of 7.3, this represents a high-severity risk that could facilitate full compromise of the application data layer if left unaddressed.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the login interface and disable the affected file if it is not business-critical.

Proactive Monitoring: Review web server access logs for suspicious patterns in the ajax.php request parameters, specifically focusing on SQL syntax characters like single quotes, dashes, or UNION statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests to ajax.php that contain SQL injection signatures in the Username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as attributed to the GitHub issue report referenced by the vulnerability record.

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation in the wild, though a public proof-of-concept is available. The vulnerability's design allows for unauthenticated remote access, making it highly accessible to attackers.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses an immediate risk to the confidentiality and integrity of the system. Organizations should prioritize isolating the affected application or implementing strict WAF filtering until an official security update is released by the vendor.

Description Summary:
IBM Aspera Orchestrator versions 4.0.0 through 4.1.0 are vulnerable to OS command injection, allowing authenticated users to execute arbitrary commands with elevated system privileges.

Executive Summary:
A critical OS command injection vulnerability in IBM Aspera Orchestrator allows authenticated attackers to execute arbitrary system commands with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2025-13481

Affected Software: IBM Aspera Orchestrator

Affected Versions: 4.0.0 through 4.1.0

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) flaw stemming from improper validation of user supplied input, which allows an authenticated user to gain elevated execution capabilities on the host system.

Business Impact

Successful exploitation of this flaw allows an authenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to a full system compromise. Given the CVSS score of 8.8, this vulnerability poses a significant risk to data confidentiality, integrity, and system availability, necessitating prompt remediation to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Upgrade IBM Aspera Orchestrator to version 4.1.1 or later as specified in the vendor security advisory.

Proactive Monitoring: Review system and application access logs for unusual command execution patterns or unauthorized attempts to access administrative functions.

Compensating Controls: Ensure that access to the Orchestrator management interface is strictly restricted to authorized personnel only, and utilize network segmentation to limit exposure to potentially untrusted users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on authenticated access necessitates strict enforcement of the principle of least privilege for all system users to minimize the attack surface.

Analyst Recommendation

This vulnerability represents a high-severity risk due to the potential for complete system compromise via command injection. Organizations should prioritize the deployment of the 4.1.1 update provided by IBM immediately. In environments where immediate patching is not feasible, restrict access to the application to the absolute minimum number of users to mitigate the risk of exploitation.

Description Summary:
An authorization bypass vulnerability exists in PosCube QR Menu due to a user-controlled key flaw, allowing unauthenticated attackers to access restricted functions.

Executive Summary:
An authorization bypass vulnerability in PosCube QR Menu (versions up to 21052026) allows unauthenticated attackers to access unauthorized resources, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-13479

Affected Software: PosCube Hardware Software and Consulting Ltd. QR Menu

Affected Versions: 0 through 21052026

Vulnerability: This vulnerability is classified as an authorization bypass via a user-controlled key (CWE-639). It allows an unauthenticated, remote attacker to manipulate keys to gain unauthorized access to data or functions intended for restricted users.

Business Impact

Successful exploitation allows unauthorized access to sensitive information managed by the QR Menu system. Given the CVSS score of 7.5, this high-severity flaw could lead to the exposure of customer or operational data, potentially resulting in reputational damage and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain a security update or patch for the affected QR Menu version, as a specific patch version is currently not publicly listed.

Proactive Monitoring: Monitor system access logs for anomalous patterns where unauthorized users appear to be accessing administrative or restricted endpoints.

Compensating Controls: Implement Web Application Firewall (WAF) rules to detect and block suspicious requests that attempt to manipulate session or authorization keys.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for exploitation.

Analyst Recommendation

The vulnerability represents a significant security oversight that requires immediate attention. Organizations utilizing the PosCube QR Menu should prioritize vendor communication to verify if a patch is available and apply it as soon as it is provided to close this critical authorization gap.

Description Summary:
Digital Operations Services Inc. WifiBurada contains vulnerabilities involving the exposure of private personal information and insufficiently protected credentials.

Executive Summary:
A vulnerability in Digital Operations Services Inc. WifiBurada (versions up to 21052026) facilitates the exposure of private personal information and credentials to unauthorized actors.

Vulnerability Details

CVE-ID: CVE-2025-13477

Affected Software: Digital Operations Services Inc. WifiBurada

Affected Versions: 0 through 21052026

Vulnerability: The software suffers from insufficient protection of credentials (CWE-522) and improper handling of private information (CWE-359). Exploitation requires low privileges (PR:L) to access sensitive data, according to the CVSS vector.

Business Impact

The exposure of personal information and credentials can lead to full account takeover and the breach of sensitive user data. With a CVSS score of 7.1, this vulnerability represents a high risk to organizational security, potentially resulting in unauthorized access to internal systems and severe privacy violations.

Remediation Plan

Immediate Action: Reach out to Digital Operations Services Inc. for updated software versions or security patches addressing credential protection and data privacy.

Proactive Monitoring: Review authentication logs and user access records for suspicious activity or unauthorized credential usage within the WifiBurada platform.

Compensating Controls: Enforce strict access controls and, if possible, implement multi-factor authentication (MFA) to mitigate the impact of potentially compromised credentials.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of credential and privacy vulnerabilities makes this an attractive target for attackers seeking lateral movement.

Analyst Recommendation

Addressing this vulnerability is critical to maintaining user privacy and system integrity. Administrators should treat this as a high-priority update and ensure that all instances of WifiBurada are patched as soon as the vendor provides a remediation.

Description Summary:
A vulnerability in the Menulux Software Mobile App allows an unauthenticated attacker to perform an authorization bypass by manipulating user-controlled keys.

Executive Summary:
A critical authorization bypass vulnerability in the Menulux Software Mobile App enables unauthenticated attackers to access restricted data, posing a significant risk to user privacy.

Vulnerability Details

CVE-ID: CVE-2025-13474

Affected Software: Menulux Software Mobile App

Affected Versions: 0 up to 9.5.8

Vulnerability: This flaw, classified as CWE-639, allows an unauthenticated attacker to manipulate identifiers to bypass authorization checks. The vulnerability is remotely exploitable without user interaction and carries a CVSS score of 7.5, indicating a high risk of unauthorized data access.

Business Impact

The ability to bypass authorization mechanisms can lead to the unauthorized exposure of sensitive user or business data managed within the application. Given the high CVSS score, this vulnerability represents a severe threat to data confidentiality and could result in significant regulatory and reputational damage if exploited.

Remediation Plan

Immediate Action: Update the Menulux Software Mobile App to version 9.5.8 or later to incorporate the necessary security fixes.

Proactive Monitoring: Review application access logs for unusual patterns or access requests that deviate from standard user behavior.

Compensating Controls: Implement network-level access controls or a Web Application Firewall where applicable to filter suspicious traffic directed at the mobile backend services.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature and lack of authentication requirements.

Analyst Recommendation

Organizations utilizing the Menulux Software Mobile App must prioritize upgrading to version 9.5.8 immediately to eliminate this authorization bypass risk. Given the high impact on data confidentiality, failure to patch leaves the environment susceptible to unauthorized information disclosure.

Description Summary:
A regression in RNP 0.18.0 results in uninitialized symmetric session keys for public-key encrypted packets, allowing attackers to trivially decrypt sensitive data.

Executive Summary:
A critical cryptographic vulnerability in Ribose RNP version 0.18.0 allows for the trivial decryption of public-key encrypted data, leading to a complete loss of confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-13470

Affected Software: Ribose RNP

Affected Versions: 0.18.0

Vulnerability: The flaw, categorized as CWE-330 (Use of Insufficiently Random Values), occurs because a refactoring error leaves the symmetric session key for Public-Key Encrypted Session Key packets as an all-zero byte array. This vulnerability is exploitable by an unauthenticated attacker who intercepts encrypted traffic.

Business Impact

The impact of this vulnerability is severe as it effectively negates the primary security function of the software: confidentiality. Any data encrypted using public-key methods in this version can be decrypted by unauthorized parties, potentially exposing sensitive communications, credentials, or proprietary information. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to organizational data integrity and compliance requirements.

Remediation Plan

Immediate Action: Upgrade to RNP version 0.18.1 immediately, or revert to version 0.17.1 if 0.18.1 is not yet available for your specific distribution.

Proactive Monitoring: Review logs for unauthorized attempts to access or decrypt encrypted archives and monitor for any anomalous traffic patterns related to cryptographic operations.

Compensating Controls: If immediate patching is not possible, cease using public-key encryption features within the affected RNP version and prioritize the use of alternative secure communication channels that do not rely on the vulnerable PKESK implementation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, the simplicity of the root cause—an all-zero key—makes the decryption process trivial for any adversary capable of intercepting the encrypted data.

Analyst Recommendation

Given the total failure of encryption for public-key packets in RNP 0.18.0, organizations must treat this as a high-priority remediation task. Failure to update the software will leave all information protected by public-key encryption exposed to anyone with access to the encrypted packets. Ensure that all systems, including those bundling RNP such as Thunderbird, are updated to the secure versions as soon as they become available.

Description Summary:
The WooCommerce Square plugin is vulnerable to an Insecure Direct Object Reference (IDOR) via the get_token_by_id function, allowing unauthenticated attackers to expose credit card tokens.

Executive Summary:
An unauthenticated IDOR vulnerability in the WooCommerce Square plugin allows attackers to access sensitive customer payment tokens, posing a significant risk of financial fraud.

Vulnerability Details

CVE-ID: CVE-2025-13457

Affected Software: WooCommerce WooCommerce Square

Affected Versions: 4.2.0 up to 4.2.3, 4.3.0 up to 4.3.2, 4.4.0 up to 4.4.2, 4.5.0 up to 4.5.2, 4.6.0 up to 4.6.4, 4.7.0 up to 4.7.4, 4.8.0 up to 4.8.8, 4.9.0 up to 4.9.9

Vulnerability: This is an Authorization Bypass Through User Controlled Key (CWE-639) occurring in the get_token_by_id function. The flaw allows unauthenticated remote attackers to retrieve credit card tokens (ccof) by manipulating input parameters.

Business Impact

The exposure of credit card tokens directly facilitates fraudulent financial transactions on the affected site. With a CVSS score of 7.5, this high-severity vulnerability could lead to significant reputational damage, loss of customer trust, and potential regulatory fines related to payment processing security.

Remediation Plan

Immediate Action: Update the WooCommerce Square plugin to the latest patched version available from the vendor repository.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the plugin's API endpoints, particularly those attempting to iterate through token IDs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block unauthorized access attempts or suspicious object ID enumeration patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of authentication requirements makes this flaw highly attractive for automated scanning and exploitation.

Analyst Recommendation

Given the ease of exploitation and the direct impact on sensitive financial data, administrators must prioritize patching this plugin immediately. Ensure all instances of the WooCommerce Square plugin are updated to the secure versions identified above to close the authorization gap.

Description Summary:
A local authentication bypass vulnerability in Lenovo ThinkPlus configuration software allows an authenticated user to enroll an untrusted fingerprint on affected devices.

Executive Summary:
A local authentication bypass vulnerability in Lenovo ThinkPlus configuration software allows an authenticated user to enroll unauthorized fingerprints, posing a significant risk to device security.

Vulnerability Details

CVE-ID: CVE-2025-13455

Affected Software: Lenovo ThinkPlus Configuration Software

Affected Versions: Lenovo ThinkPlus FU100 Gen 1, FU200 Gen 1, TU800 Gen 1, TSD303 Gen 1

Vulnerability: This is an authentication bypass flaw (CWE-290) occurring within the configuration software. It allows an already authenticated local user to manipulate the device authentication mechanism and register an unauthorized fingerprint.

Business Impact

The ability to enroll an unauthorized fingerprint grants a malicious actor persistent, physical access to the protected device. Given the CVSS score of 7.8, this vulnerability represents a high risk to data confidentiality and integrity, as it facilitates unauthorized access to sensitive information stored on or accessed via these devices.

Remediation Plan

Immediate Action: Review the official Lenovo security advisory at https://iknow.lenovo.com.cn/detail/436983 and follow the specific product impact guidance provided by the vendor.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes or attempts to access the fingerprint enrollment utility by non-administrative users.

Compensating Controls: Restrict local user privileges on systems utilizing these devices to ensure that only authorized personnel can execute configuration software.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of January 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to already have local authenticated access, which limits the initial attack surface to users already present on the system.

Analyst Recommendation

While this vulnerability requires local access, the potential for persistent unauthorized biometric access makes it a significant security concern for enterprise environments. Administrators should consult the linked Lenovo advisory immediately to determine if a firmware or software update is available for their specific device version and apply the recommended mitigations to prevent unauthorized fingerprint enrollment.

Description Summary:
A SQL injection vulnerability exists in SourceCodester Online Shop Project 1.0 via the Search argument in action.php, allowing remote attackers to execute unauthorized database queries.

Executive Summary:
SourceCodester Online Shop Project 1.0 is vulnerable to unauthenticated remote SQL injection, presenting a significant risk of unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2025-13451

Affected Software: SourceCodester Online Shop Project

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the action.php file. It allows an unauthenticated remote attacker to manipulate the Search parameter to execute arbitrary SQL commands.

Business Impact

The ability to perform SQL injection allows an attacker to bypass authentication, extract sensitive customer or administrative data, or potentially modify database contents. With a CVSS score of 7.3, this high-severity vulnerability threatens the confidentiality and integrity of the application, which could lead to significant reputational damage and data loss for organizations using this software.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict public access to the affected web directory or disable the search functionality until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns in the Search parameter, such as SQL keywords or unusual character sequences, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the action.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-up at the provided GitHub reference.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running SourceCodester Online Shop Project 1.0 must treat this as a high-priority item, implement the recommended WAF protections, and monitor for vendor updates to remediate the underlying flaw immediately.

Description Summary:
A SQL injection vulnerability exists in the login.php file of code-projects Online Shop Project 1.0, allowing unauthenticated remote attackers to manipulate the Password argument.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Shop Project 1.0 allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13449

Affected Software: code-projects Online Shop Project

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the Password argument within the login.php file. This allows an unauthenticated attacker to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to user credentials, sensitive business data, or potential administrative account takeover. Given the CVSS score of 7.3, this flaw represents a high risk that requires immediate attention to prevent unauthorized database manipulation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the login.php endpoint or take the application offline until the vendor releases a security update.

Proactive Monitoring: Monitor database query logs for anomalous syntax, specifically looking for SQL keywords like UNION, SELECT, or SLEEP in authentication requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the login parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/xiaojuzirr/cve/issues/3.

Analyst Notes: As of November 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the direct exposure of the SQL interface.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of a vendor-supplied patch elevates the urgency of this advisory. Organizations using code-projects Online Shop Project 1.0 must prioritize the implementation of compensating controls, such as WAF rules, to neutralize the threat while awaiting a permanent software update.

Description Summary:
An OS command injection vulnerability in the Progress LoadMaster API allows an authenticated user with administrative privileges to execute arbitrary commands on the underlying appliance.

Executive Summary:
An OS command injection vulnerability in Progress LoadMaster allows authenticated attackers with administrative access to achieve remote code execution on the appliance.

Vulnerability Details

CVE-ID: CVE-2025-13447

Affected Software: Progress Software LoadMaster

Affected Versions: 7.2.50 up to (excluding) V7.2.62.2, 7.1.32 up to (excluding) V7.2.62.2, 7.2.37 up to (excluding) V7.2.62.2, 7.2.39 up to (excluding) V7.2.62.2, 7.2.50 up to (excluding) V7.2.54.16, 7.1.32 up to (excluding) V7.2.54.16, 7.2.37 up to (excluding) V7.2.54.16, 7.2.39 up to (excluding) V7.2.54.16

Vulnerability: This vulnerability is an OS command injection flaw occurring within the API input parameters. It requires an attacker to possess valid User Administration credentials to trigger the execution of arbitrary commands.

Business Impact

A successful exploit grants the attacker total control over the LoadMaster appliance, which often serves as a critical gateway for network traffic and load balancing. Given the CVSS score of 8.4, this high severity flaw poses a significant risk of lateral movement, data interception, and total system compromise. Organizations relying on these appliances for service availability face potential downtime and severe security breaches if these administrative interfaces are compromised.

Remediation Plan

Immediate Action: Upgrade the LoadMaster firmware to version 7.2.62.2 or 7.2.54.16, as specified by the vendor advisory.

Proactive Monitoring: Review administrative access logs for suspicious API requests or unexpected command execution patterns originating from authorized accounts.

Compensating Controls: Restrict access to the LoadMaster management interface to trusted management networks or VPNs to limit the exposure of the API to unauthorized users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the high potential impact makes it a priority for environments where administrative accounts may be targeted by malicious actors.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability, administrators must prioritize patching the affected LoadMaster appliances. Ensure that administrative accounts are secured with strong, unique credentials and that access to the management API is strictly controlled to prevent exploitation by compromised or malicious internal users.