Description Summary:
A stack-based buffer overflow exists in the Tenda AC18 router within the /goform/WizardHandle endpoint, allowing remote attackers to trigger memory corruption via the mtuvalue parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda AC18 router allows remote, low-privileged attackers to achieve system-level memory corruption.

Vulnerability Details

CVE-ID: CVE-2025-11122

Affected Software: Tenda AC18

Affected Versions: 15.03.05.19

Vulnerability: This is a stack-based buffer overflow (CWE-121) occurring in the /goform/WizardHandle endpoint. By sending a specifically crafted POST request with an oversized mtuvalue parameter, an attacker with low privileges can trigger memory corruption, potentially leading to remote code execution.

Business Impact

The exploitation of this vulnerability poses a severe risk to network integrity and security. Because this affects a core networking device, a successful attack could result in the total compromise of the router, enabling unauthorized access to internal network traffic, device hijacking, or the establishment of a persistent foothold within the local environment. With a CVSS score of 8.8, this flaw represents a high-severity threat that requires immediate attention to prevent unauthorized administrative control.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the router management interface to trusted internal IP addresses only. Disable remote management features immediately to prevent external exploitation.

Proactive Monitoring: Monitor network traffic for anomalous POST requests directed at the /goform/WizardHandle endpoint. Review system logs for signs of unexpected device reboots or process crashes that may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) configured to inspect and block malformed HTTP POST requests containing excessive data in the mtuvalue parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's published technical write-up on GitHub.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild, but the existence of a published proof-of-concept makes the risk of exploitation credible. The vulnerability is inherently exploitable as the affected function lacks bounds checking on input parameters.

Analyst Recommendation

Given the availability of a public proof-of-concept and the critical nature of the vulnerability, Tenda AC18 users must treat this as a high-priority security issue. Because no vendor patch is currently available, it is imperative to implement strict network segmentation and disable remote management interfaces immediately. Organizations should maintain heightened vigilance for suspicious activity on these devices until the manufacturer releases a firmware update to resolve the underlying memory corruption flaw.

Description Summary:
A buffer overflow vulnerability in the Tenda AC8 router allows remote attackers to trigger memory corruption via the formSetServerConfig function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC8 firmware version 16.03.34.06 permits remote code execution, posing a significant threat to device integrity.

Vulnerability Details

CVE-ID: CVE-2025-11120

Affected Software: Tenda AC8

Affected Versions: 16.03.34.06

Vulnerability: The vulnerability exists within the formSetServerConfig function of the /goform/SetServerConfig endpoint. An authenticated attacker can trigger a buffer overflow, leading to memory corruption and potential system compromise.

Business Impact

Successful exploitation of this flaw allows a remote attacker to achieve total impact on the confidentiality, integrity, and availability of the affected router. Given the CVSS score of 8.8, this vulnerability presents a high risk to business operations, as compromised networking equipment can be used as a pivot point for lateral movement within the corporate network or to intercept sensitive traffic.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official Tenda support portal for the release of a security patch addressing this buffer overflow. If no patch is available, isolate the device from the public internet immediately.

Proactive Monitoring: Review system access logs for anomalous requests directed at the /goform/SetServerConfig endpoint. Monitor for unexpected device reboots or performance degradation that may indicate crash-based exploitation attempts.

Compensating Controls: Implement strict network access control lists to restrict management access to the router to known, trusted administrative IP addresses. Utilize a firewall to block unauthorized external traffic from reaching the administrative web interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up at the referenced GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its potential for remote code execution via a standard HTTP request.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized access to networking infrastructure. Administrators must restrict management access to the affected devices and prioritize the application of firmware updates as soon as they are provided by Tenda to mitigate the risk of remote exploitation.

Description Summary:
A SQL injection vulnerability in the CodeAstro Student Grading System 1.0 allows remote, unauthenticated attackers to manipulate the staffId argument in adminLogin.php.

Executive Summary:
The CodeAstro Student Grading System 1.0 contains a critical SQL injection vulnerability that permits unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11118

Affected Software: CodeAstro Student Grading System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered via the staffId parameter within the adminLogin.php script. The vulnerability is exploitable by unauthenticated remote attackers, allowing for direct interaction with the backend database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to or manipulation of sensitive grading and student data. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to unauthorized administrative access or database corruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the application by placing it behind a VPN or IP whitelist. If possible, disable the affected adminLogin.php functionality until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous HTTP requests targeting adminLogin.php, specifically searching for SQL syntax or unusual characters in the staffId parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up at https://github.com/Clw309/CVE/issues/2.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the lack of complex requirements for execution.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this SQL injection necessitates immediate defensive action. Organizations utilizing CodeAstro Student Grading System 1.0 must prioritize restricting network access to the application and implementing strict WAF filtering to mitigate the risk of exploitation while awaiting a permanent vendor patch.

Description Summary:
A buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1 allows remote code execution via the formWrlExtraGet function.

Executive Summary:
A remote buffer overflow vulnerability in Tenda CH22 firmware version 1.0.0.1 poses a high risk of system compromise through memory corruption.

Vulnerability Details

CVE-ID: CVE-2025-11117

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: This vulnerability is a buffer overflow occurring within the formWrlExtraGet function in the /goform/GstDhcpSetSer file. An authenticated attacker can trigger this memory corruption by manipulating the dips argument, potentially leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability can result in the complete compromise of the affected Tenda device, leading to unauthorized access, potential lateral movement within the network, or persistent denial of service. With a CVSS score of 8.8, this flaw represents a significant security risk that could facilitate further attacks against the broader infrastructure if the device is positioned at the network edge.

Remediation Plan

Immediate Action: Contact the vendor to verify if a patch is available for firmware version 1.0.0.1 and apply it immediately; if no patch exists, restrict access to the device management interface.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/GstDhcpSetSer endpoint and review system logs for signs of service crashes or unauthorized configuration changes.

Compensating Controls: Implement strict network access control lists to limit management access to the device to trusted internal IP addresses only, effectively mitigating the risk of remote exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the research write-up at https://github.com/zhaoyinshan/CVE/issues/2.

Analyst Notes: As of September 29, 2025, there is no public information indicating active exploitation in the wild, though a functional proof-of-concept has been disclosed. The nature of this memory corruption flaw makes it a high-value target for attackers seeking to gain control over network infrastructure.

Analyst Recommendation

Given the severity of this vulnerability and the availability of public proof-of-concept code, immediate action is required to reduce the attack surface. Organizations using the Tenda CH22 device should prioritize restricting access to management interfaces and monitor vendor channels closely for firmware updates to address this buffer overflow.

Description Summary:
A SQL injection vulnerability exists in code-projects Simple Scheduling System 1.0 via the faculty parameter in add.home.php, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 allows for unauthenticated remote exploitation, posing a significant risk of unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2025-11116

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the add.home.php file. An unauthenticated remote attacker can inject malicious SQL commands via the faculty argument to potentially access or manipulate backend data.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized data exposure, potential modification of scheduling information, and loss of data integrity. With a CVSS score of 7.3, this flaw is considered High severity due to the ease of remote, unauthenticated access to the underlying database, which may contain sensitive administrative or user information.

Remediation Plan

Immediate Action: Since no official patch is available, administrators should restrict access to the application via network controls or, if possible, disable the vulnerable component until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns, specifically targeting the add.home.php endpoint and the faculty parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block common SQL injection payloads in incoming HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the research write-up at https://github.com/yihaofuweng/cve/issues/42.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application fails to properly sanitize user-supplied input before processing it in a database query.

Analyst Recommendation

Given the public availability of a proof-of-concept and the ease of remote, unauthenticated exploitation, this vulnerability presents a credible threat to the security of the Simple Scheduling System. Organizations currently running version 1.0 should treat this as a priority, implementing WAF protections immediately and monitoring for signs of unauthorized database interaction until a definitive software patch is released by the vendor.

Description Summary:
A SQL injection vulnerability in the Simple Scheduling System addtime.php file allows remote attackers to manipulate starttime and endtime arguments.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Simple Scheduling System 1.0 exposes the application to remote data manipulation by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-11115

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input within the /addtime.php script, specifically targeting the starttime and endtime arguments. This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive scheduling data, potential modification of application records, or database enumeration. With a CVSS score of 7.3, this represents a significant security risk, as the lack of authentication requirements makes the system highly susceptible to automated exploitation attempts.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /addtime.php endpoint or disable the affected scheduling functionality until a secure update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /addtime.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns, which can provide temporary protection while the vulnerability remains unpatched.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided via the GitHub reference.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a credible threat to the integrity of the Simple Scheduling System. Organizations currently running version 1.0 are urged to implement network-level access controls or WAF protections immediately to mitigate the risk of unauthorized database interaction until the vendor provides a formal security patch.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Advanced Online Voting Management System 1.0, specifically within the /admin/candidates_edit.php file, allowing for remote exploitation.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Advanced Online Voting Management System 1.0 poses a significant risk of unauthorized database interaction and data compromise.

Vulnerability Details

CVE-ID: CVE-2025-11111

Affected Software: Campcodes Advanced Online Voting Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered via the ID argument in the /admin/candidates_edit.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this flaw represents a High severity risk, as it allows remote attackers to interact with the application database without requiring prior authentication.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should immediately restrict access to the /admin directory using IP allowlisting or by implementing additional authentication layers at the web server level.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION statements or unexpected character escaping, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub reference provided in the vulnerability disclosure.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require user interaction or pre-existing privileges.

Analyst Recommendation

The presence of a public proof-of-concept and the ease of remote exploitation make this vulnerability an immediate concern for organizations utilizing the Campcodes Advanced Online Voting Management System. Administrators must apply the recommended compensating controls immediately and monitor vendor channels for the release of a permanent security patch to fully remediate this risk.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the school_year parameter in the /admin/school_year.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11110

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the school_year argument within the /admin/school_year.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to view, modify, or delete sensitive data stored within the database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to unauthorized access to administrative functions or student information. Such a breach could result in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests containing SQL syntax patterns targeting the school_year.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical documentation provided at the GitHub reference link.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize restricting network access to the affected administrative interface until an official vendor patch is released and verified.

Description Summary:
A SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to manipulate the ID argument in /pages/us_edit.php.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to remote unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-11109

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability occurring within the /pages/us_edit.php script, triggered by manipulating the ID parameter. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exposure or modification. Given the CVSS score of 7.3, this represents a high risk to the confidentiality and integrity of business records stored within the inventory system.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or place the application behind a robust Web Application Firewall (WAF) configured to block SQL injection patterns.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /pages/us_edit.php file, specifically monitoring for SQL syntax characters such as single quotes or comment sequences in the ID parameter.

Compensating Controls: Implement strict input validation and parameterized queries in the source code to neutralize the injection vector, and ensure the database user account used by the application has the minimum necessary privileges.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof of concept elevates the risk of this vulnerability significantly. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must treat this as a high priority, applying network-level restrictions immediately until a vendor-supplied patch is released.

Description Summary:
Simple Scheduling System 1.0 is vulnerable to remote SQL injection via the room argument in /schedulingsystem/addroom.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 allows remote, unauthenticated attackers to compromise database integrity and potentially access sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-11108

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) within the addroom.php file, where the room parameter fails to properly sanitize user-supplied input. This flaw is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to a complete breach of application data or service disruption.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict network access to the /schedulingsystem/addroom.php endpoint or disable the affected scheduling functionality entirely.

Proactive Monitoring: Security teams should monitor web access logs for unusual patterns or characters indicative of SQL injection attempts, such as single quotes, double dashes, or SQL keywords in the room parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of remote exploitation without requiring authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a verified vendor patch, this vulnerability poses a significant risk to affected installations. Organizations using Simple Scheduling System 1.0 must prioritize isolating the application or implementing robust WAF filtering to prevent exploitation until a security update is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in Simple Scheduling System 1.0, specifically within the addcourse.php file, allowing unauthenticated remote attackers to manipulate the corcode argument.

Executive Summary:
A critical SQL injection vulnerability in the Simple Scheduling System 1.0 application allows unauthenticated attackers to execute arbitrary database queries remotely.

Vulnerability Details

CVE-ID: CVE-2025-11107

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the corcode parameter in the /schedulingsystem/addcourse.php endpoint. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the database backend.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive scheduling data, potential data modification, or complete database compromise. With a CVSS score of 7.3, this high severity flaw poses a significant risk to the confidentiality and integrity of the system, potentially resulting in operational disruption and unauthorized administrative access.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the Simple Scheduling System until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting addcourse.php, particularly those containing SQL syntax characters like quotes, semicolons, or comments.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to block SQL injection patterns to mitigate the risk of exploitation while the vulnerability remains unpatched.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept is available via the GitHub issue referenced in the CVE record.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the lack of required authentication, making it trivial for remote attackers to exploit.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a clear and present danger to affected environments. Organizations currently running Simple Scheduling System 1.0 must prioritize isolating the affected component or applying strict perimeter controls to prevent unauthorized access until a vendor-supplied patch is made available.

Description Summary:
A SQL injection vulnerability in code-projects Simple Scheduling System 1.0 allows remote attackers to manipulate the falname argument via the addfaculty.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Simple Scheduling System 1.0 product presents a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-11106

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) occurring in the addfaculty.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands through the falname parameter.

Business Impact

The ability to perform remote SQL injection allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 7.3, this flaw represents a high risk to data confidentiality and integrity. Successful exploitation could compromise the entire scheduling database, leading to significant operational disruption and loss of sensitive information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected addfaculty.php endpoint or disable the vulnerable module until a security update is released by the vendor.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting addfaculty.php that contain SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the specified parameter to mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability disclosure.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication and allows direct manipulation of backend database queries.

Analyst Recommendation

This vulnerability is critical due to the lack of required authentication and the presence of a public proof-of-concept. Organizations utilizing Simple Scheduling System 1.0 must treat this as a high priority, implementing network-level access controls or WAF filtering immediately to prevent exploitation while awaiting a vendor-supplied patch.

Description Summary:
A SQL injection vulnerability exists in code-projects Simple Scheduling System 1.0 via the subcode parameter in the addsubject.php file, allowing unauthenticated remote attackers to execute SQL commands.

Executive Summary:
A critical SQL injection vulnerability in code-projects Simple Scheduling System 1.0 permits unauthenticated remote attackers to compromise backend database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11105

Affected Software: code-projects Simple Scheduling System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the addsubject.php file, specifically through the subcode argument. This flaw allows an unauthenticated remote attacker to manipulate database queries without requiring prior system access.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized data exfiltration, modification of application records, or potential denial of service. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized administrative or user account manipulation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the addsubject.php endpoint or disable the affected functionality until a vendor-supplied security update is released.

Proactive Monitoring: Review web server and database logs for suspicious HTTP requests containing SQL syntax, such as UNION, SELECT, or OR statements, directed at the addsubject.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently running Simple Scheduling System 1.0 should prioritize implementing the suggested compensating controls and monitor for vendor updates, as the lack of a formal patch leaves the system exposed to automated exploitation attempts.

Description Summary:
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the /admin/edit_content.php file, allowing remote attackers to manipulate the Title argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows for unauthenticated remote data manipulation and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11102

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered via the Title argument in the /admin/edit_content.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high risk of unauthorized database interaction. Successful exploitation could lead to unauthorized data access, modification of educational content, or potential full database compromise, which may result in significant reputational damage and loss of system integrity for the institution.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /admin/edit_content.php, particularly those containing SQL syntax characters in the Title parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize inputs containing common SQL injection payloads targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication for the vulnerable endpoint.

Analyst Recommendation

Given the availability of a public exploit and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to any deployment of Campcodes Online Learning Management System 1.0. Organizations should prioritize isolating the affected application from public-facing network segments and implement strict input validation via a WAF until a secure update is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in itsourcecode Open Source Job Portal 1.0 due to improper input sanitization of the ID argument in the company edit function.

Executive Summary:
The itsourcecode Open Source Job Portal 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11101

Affected Software: itsourcecode Open Source Job Portal

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection (CWE-89) flaw located in the file /jobportal/admin/company/index.php. An unauthenticated remote attacker can manipulate the ID parameter to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this flaw allows attackers to perform unauthorized database operations, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the confidentiality and integrity of applicant and company data stored within the portal.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /jobportal/admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns targeting the /jobportal/admin/company/index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in the ID query parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security research documented at https://github.com/yihaofuweng/cve/issues/37.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, organizations must treat this vulnerability with urgency. If the Open Source Job Portal cannot be secured via network-level controls or a WAF, it should be taken offline until a secure version is released by the developer.

Description Summary:
A SQL injection vulnerability exists in version 1.0 of the code-projects E-Commerce Website, allowing remote attackers to manipulate the prod_id argument via the admin_product_details.php script.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects E-Commerce Website allows remote attackers to execute arbitrary database queries, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-11094

Affected Software: code-projects E-Commerce Website

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the prod_id parameter within the /pages/admin_product_details.php script, resulting in a SQL injection vulnerability. An unauthenticated attacker can exploit this flaw remotely to interact with the underlying database.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information stored within the database, including customer data or administrative credentials. Given the CVSS score of 7.3, this flaw is categorized as High severity, as it facilitates unauthorized data modification or exfiltration that could result in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected endpoint /pages/admin_product_details.php or take the application offline until a secure version is released.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or unexpected administrative access attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block common SQL injection payloads targeting the prod_id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 29, 2025, there is no public information indicating active exploitation in the wild; however, a public proof-of-concept exists, and the vulnerability is confirmed to be remotely exploitable by unauthenticated users. The flaw is inherently dangerous due to the ease of injecting malicious commands into the database backend.

Analyst Recommendation

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, this vulnerability presents an elevated risk. Organizations currently utilizing code-projects E-Commerce Website 1.0 must prioritize isolating the affected component and applying strict network-level access controls to prevent unauthorized exploitation.

Description Summary:
A code injection vulnerability in WSO2 products allows authenticated users with elevated privileges to execute arbitrary code via the GraalJS and NashornJS Script Mediator engines.

Executive Summary:
WSO2 products are vulnerable to arbitrary code execution, posing a critical risk to the integration runtime environment for organizations using these platforms.

Vulnerability Details

CVE-ID: CVE-2025-11093

Affected Software: WSO2 (Multiple Products)

Affected Versions: See enrichment data for specific build numbers across WSO2 Micro Integrator, API Manager, Enterprise Integrator, Universal Gateway, API Control Plane, and Traffic Manager.

Vulnerability: The flaw stems from insufficient security restrictions within the GraalJS and NashornJS Script Mediator engines. Authenticated users with administrative or API creator privileges can leverage these engines to perform unauthorized code execution within the integration runtime.

Business Impact

The ability to execute arbitrary code allows an attacker to gain full control over the integration runtime, potentially leading to total system compromise, data exfiltration, or the disruption of critical API and integration services. With a CVSS score of 8.4, this vulnerability represents a high-severity threat that could lead to significant operational downtime and the loss of sensitive data processed by WSO2 middleware.

Remediation Plan

Immediate Action: Upgrade all affected WSO2 components to the patched build versions specified in the official WSO2 security advisory (WSO2-2025-4510).

Proactive Monitoring: Review administrative audit logs for any unusual activity involving script mediator configurations or unexpected code execution patterns within the integration runtime.

Compensating Controls: Restrict administrative and API creator access to the minimum set of necessary personnel to reduce the attack surface for this authenticated-only flaw.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 6, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires elevated privileges, the potential for total system impact makes it a significant concern for administrators.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise, organizations must prioritize patching these WSO2 products immediately. Security teams should verify their current build versions against the list provided in the vendor advisory and apply the necessary updates to ensure the security of their integration infrastructure.

Description Summary:
A buffer overflow vulnerability in Tenda AC21 allows remote attackers to execute arbitrary code via the sscanf function in the /goform/SetStaticRouteCfg endpoint.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC21 firmware allows remote attackers to achieve remote code execution, posing a significant risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2025-11091

Affected Software: Tenda AC21

Affected Versions: 16.03.08.0, 16.03.08.1, 16.03.08.2, 16.03.08.3, 16.03.08.4, 16.03.08.5, 16.03.08.6, 16.03.08.7

Vulnerability: This is a memory corruption flaw caused by an improper buffer overflow in the sscanf function within the /goform/SetStaticRouteCfg file. The vulnerability is exploitable by an authenticated user with low privileges who can trigger the overflow remotely through crafted input.

Business Impact

Successful exploitation of this buffer overflow can lead to a complete compromise of the affected router, potentially allowing attackers to intercept traffic, modify network configurations, or pivot into internal network segments. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could result in significant operational disruption and unauthorized access to sensitive data flowing through the device.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, administrators should restrict management interface access to trusted internal IP addresses only and disable remote management features.

Proactive Monitoring: Review system and firewall logs for unusual traffic patterns directed at the /goform/SetStaticRouteCfg endpoint or unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to inspect and block requests containing malformed input strings directed at the router configuration forms.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of memory corruption vulnerabilities often makes them suitable for weaponization by malicious actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a severe threat to network infrastructure. IT administrators must prioritize the containment of the Tenda AC21 management interface and monitor vendor channels for the release of a permanent security firmware update.

Description Summary:
The kidaze CourseSelectionSystem is vulnerable to remote SQL injection via the cbranch argument in /Profilers/PriProfile/COUNT3s4.php, potentially allowing unauthorized database manipulation.

Executive Summary:
A critical SQL injection vulnerability in the kidaze CourseSelectionSystem allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-11089

Affected Software: kidaze CourseSelectionSystem

Affected Versions: Up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the cbranch parameter within the /Profilers/PriProfile/COUNT3s4.php file. The vulnerability is remotely exploitable without authentication, as confirmed by the CVSS attack vector (AV:N/AC:L/PR:N/UI:N).

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data exposure, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could compromise the integrity and confidentiality of the course management system, potentially leading to unauthorized administrative actions or data breaches.

Remediation Plan

Immediate Action: Since no specific patch version is available due to the continuous delivery model, users should audit the source code in /Profilers/PriProfile/COUNT3s4.php and apply input validation to the cbranch argument, or contact the vendor for the latest secure commit hash.

Proactive Monitoring: Monitor web server access logs for anomalous requests to the identified PHP file, particularly those containing SQL syntax or unusual query patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection attempts targeting query parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept, the risk of exploitation is elevated. Administrators must treat this vulnerability with urgency by implementing input sanitization or restricting access to the affected endpoint until a vendor-provided update is confirmed.

Description Summary:
The Zegen Core plugin for WordPress is vulnerable to CSRF, allowing unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution.

Executive Summary:
The Zegen Core plugin for WordPress contains a critical Cross-Site Request Forgery vulnerability that enables attackers to execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-11087

Affected Software: Zozothemes Zegen Core

Affected Versions: 0 through 2.0.1

Vulnerability: This vulnerability occurs due to missing nonce and file type validation within the custom-fonts-uploads.php file, which allows unauthenticated attackers to upload malicious files. By tricking an administrator into clicking a link, an attacker can trigger a forged request to achieve remote code execution.

Business Impact

Successful exploitation poses a severe risk to the entire WordPress environment, as it grants attackers the ability to execute arbitrary code with the privileges of the web server. This can lead to full site compromise, unauthorized data exfiltration, and the potential for lateral movement within the network. Given the CVSS score of 8.8, this vulnerability is classified as High severity and requires immediate attention to prevent total system takeover.

Remediation Plan

Immediate Action: Since a specific patched version is currently unknown, administrators should immediately deactivate and remove the Zegen Core plugin from all WordPress installations until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious POST requests targeting the custom-fonts-uploads.php file or unexpected file creation events in the uploads directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized file uploads and mitigate CSRF attempts by verifying origin headers.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of November 21, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability requires user interaction via a forged request, its potential for remote code execution makes it a high-priority target for threat actors.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path to server compromise. Organizations utilizing the Zegen Core plugin must prioritize the immediate removal or deactivation of the component. Continuous monitoring for unauthorized file activity is essential until the vendor provides a verified security patch.

Description Summary:
A privilege escalation vulnerability in the Academy LMS Pro plugin for WordPress allows unauthenticated attackers to register as an Administrator via the Social Login addon.

Executive Summary:
The Academy LMS Pro plugin for WordPress is affected by a critical privilege escalation vulnerability that permits unauthenticated attackers to gain full administrative control of the site.

Vulnerability Details

CVE-ID: CVE-2025-11086

Affected Software: Academy LMS, Academy LMS Pro

Affected Versions: 0 through 3.3.7

Vulnerability: This flaw stems from improper validation of user roles during the registration process within the Social Login addon, allowing unauthenticated remote attackers to elevate their privileges to Administrator.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high risk of total system compromise. Unauthorized administrative access allows an attacker to manipulate site content, exfiltrate sensitive user data, install malicious plugins, or redirect traffic, leading to significant reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: If a security update is available from the vendor, apply it immediately. If no update is available, deactivate the Social Login addon within the Academy LMS Pro plugin until a patch is provided.

Proactive Monitoring: Monitor WordPress user registration logs for suspicious activity, specifically looking for new users created with administrative roles that were not explicitly authorized by site management.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block registration requests that attempt to modify user role parameters during the authentication flow.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication, which lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the severity of this privilege escalation, administrators must treat this as a high-priority incident. If you are currently utilizing the Academy LMS Pro plugin, verify the version in use immediately and take the recommended steps to disable the vulnerable Social Login functionality until a verified vendor patch is applied to neutralize the risk of unauthorized administrative takeover.

Description Summary:
A SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to manipulate the Title argument in admin/add_content.php.

Executive Summary:
A critical SQL injection vulnerability exists in Campcodes Online Learning Management System 1.0, posing a significant risk of unauthorized database interaction and data exposure.

Vulnerability Details

CVE-ID: CVE-2025-11077

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/add_content.php file. An unauthenticated remote attacker can inject malicious SQL commands via the Title parameter, potentially leading to unauthorized database access.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to the confidentiality, integrity, and availability of the underlying database. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative data, or modify system content, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin directory and ensure that all input fields are properly sanitized or parameterized at the source code level.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the /admin/add_content.php endpoint, specifically looking for common SQL injection patterns like single quotes, union selects, or comment characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts, which can provide a necessary layer of protection until the vendor provides a formal update.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability record.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct exposure of the vulnerable endpoint.

Analyst Recommendation

Given the availability of public proof-of-concept code and the high potential for database compromise, this vulnerability requires immediate attention. Security teams must prioritize restricting access to the affected management interfaces and implement robust WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to SQL injection via the department argument in the /admin/edit_teacher.php file, allowing for potential remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries.

Vulnerability Details

CVE-ID: CVE-2025-11076

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/edit_teacher.php script. An unauthenticated attacker can supply malicious input to the department parameter to execute arbitrary SQL commands against the database.

Business Impact

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation may allow an attacker to unauthorizedly access, modify, or delete sensitive information stored within the learning management system database. Given the CVSS score of 7.3, this flaw represents a high risk to organizational assets, potentially leading to total system compromise or unauthorized data exfiltration.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/edit_teacher.php endpoint to trusted network segments or authorized personnel only.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting /admin/edit_teacher.php that contain SQL syntax, such as UNION, SELECT, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the department argument.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's write-up at https://github.com/xiaolonr/cve/issues/1.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability presents a high risk to deployments of Campcodes Online Learning Management System 1.0. Organizations should immediately restrict access to the affected administrative interface and implement robust WAF filtering. Prioritize migrating to a more secure platform or applying vendor-provided security updates as soon as they are released.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the /admin/de_activate.php file via the ID argument.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-11075

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/de_activate.php file. An unauthenticated attacker can manipulate the ID argument to perform unauthorized database operations remotely.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could lead to unauthorized access to sensitive educational data, potential modification of administrative records, or complete compromise of the underlying database, causing significant reputational and operational damage to the institution.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable functionality if it is not business critical.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/de_activate.php, specifically monitoring for SQL syntax patterns or unexpected characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this specific endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the simplicity of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation for unauthenticated users, this vulnerability poses a significant risk. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules and access restrictions, until the vendor provides a permanent security update.

Description Summary:
A SQL injection vulnerability exists in the login.php file of Project Monitoring System 1.0, allowing unauthenticated remote attackers to manipulate database queries via the username or password fields.

Executive Summary:
Project Monitoring System 1.0 is vulnerable to unauthenticated SQL injection, which may allow remote attackers to extract sensitive database information.

Vulnerability Details

CVE-ID: CVE-2025-11074

Affected Software: code-projects Project Monitoring System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user-supplied input in the username and password parameters within the login.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands directly into the backend database, potentially leading to unauthorized data disclosure.

Business Impact

A successful exploit of this vulnerability could lead to the complete compromise of the underlying database, resulting in the unauthorized access or exfiltration of sensitive organizational data. Given the CVSS score of 7.3, this represents a significant risk to confidentiality and integrity, potentially leading to regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Since an official patch is currently unavailable, administrators should restrict access to the login.php endpoint using network-level controls or by disabling the affected module if it is not business-critical.

Proactive Monitoring: Security teams should monitor web access logs for suspicious POST requests to login.php containing SQL syntax characters, such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in a security research repository on GitHub.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the application concatenates user input directly into SQL statements without any input validation or parameterization.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability creates an urgent need for defensive action. Organizations using Project Monitoring System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and restrict network access to the vulnerable login interface until the vendor releases a secure version.

Description Summary:
Projectworlds Online Shopping System 1.0 is vulnerable to SQL injection via the ID argument in the store/cart_add.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
Projectworlds Online Shopping System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries and potentially compromise system data.

Vulnerability Details

CVE-ID: CVE-2025-11070

Affected Software: Projectworlds Online Shopping System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the store/cart_add.php file. The lack of proper input validation on the ID argument allows an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

The ability to perform SQL injection poses a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity flaw could allow attackers to exfiltrate sensitive customer data, modify order information, or gain unauthorized access to the underlying database management system, leading to severe reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict access to the vulnerable store/cart_add.php file or disable the affected shopping module until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for suspicious patterns, specifically looking for URL parameters containing SQL syntax or unusual GET/POST requests directed at the /store/cart_add.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced security report.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability represents a significant risk to the application environment. Organizations currently utilizing Projectworlds Online Shopping System 1.0 should prioritize the implementation of compensating controls such as WAF rules immediately, as no official vendor patch is currently available to remediate the underlying flaw.

Description Summary:
A SQL injection vulnerability exists in the Online Bidding System 1.0, allowing unauthenticated remote attackers to manipulate database queries via the id parameter in bidlist.php.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Bidding System 1.0 allows unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-11066

Affected Software: code-projects Online Bidding System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user-supplied input in the id parameter within the bidlist.php file. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access, data exfiltration, or modification.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the system. An attacker can gain full access to the database, leading to potential sensitive data leakage, unauthorized modification of bid information, and complete system compromise. Given the CVSS score of 7.3, this vulnerability represents a high-risk entry point that could lead to significant reputational damage and business disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /administrator/ directory and implement strict input validation for the id parameter.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting bidlist.php, specifically looking for SQL syntax patterns like UNION, SELECT, or SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept and detailed attack vectors are documented in the researcher's report on GitHub.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the lack of a vendor-provided security patch, users of the Online Bidding System 1.0 are strongly advised to implement strict network-level access controls and WAF filtering immediately. Organizations should prioritize migrating away from this software if it is not actively maintained, as the identified SQL injection flaw provides an easy pathway for unauthorized database access.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the department argument within the admin/teachers.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-11064

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the department argument of the admin/teachers.php script. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or faculty information, potential modification of database records, or a complete compromise of the learning management platform. Given the CVSS score of 7.3, this represents a high-severity threat that requires immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/teachers.php endpoint or disable the affected module until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the /admin/teachers.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until an official fix is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the ease of exploitation via simple URL manipulation.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication for exploitation. Security teams must prioritize restricting access to the vulnerable endpoint immediately. Organizations should actively monitor vendor communications for a security patch and apply it as soon as it becomes available to remediate the underlying code vulnerability.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the d argument in the /admin/edit_department.php file, allowing unauthenticated attackers to manipulate data.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-11063

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) residing in the /admin/edit_department.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the d parameter to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL queries creates a significant threat to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative records, or modify database contents. Such unauthorized access can lead to severe reputational damage and regulatory non-compliance regarding data privacy.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the /admin/edit_department.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the edit_department.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the vulnerable d parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's write-up at https://github.com/luyisi-7/CVE/issues/3.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so the exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of vendor-supplied patches, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize immediate mitigation via network segmentation or WAF rules to prevent exploitation until the vendor releases a secure version. Continuous monitoring of application logs is essential to detect any early signs of compromise.

Description Summary:
Campcodes Online Learning Management System version 1.0 contains a SQL injection vulnerability in the admin/save_student.php file via the class_id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-11062

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/save_student.php script. An unauthenticated remote attacker can manipulate the class_id parameter to inject malicious SQL commands into the application database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this represents a high-risk security flaw that could compromise the integrity and confidentiality of student records and administrative data stored within the system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the affected script to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected union-based queries originating from the /admin/save_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the class_id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it does not require authentication to interact with the vulnerable parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability poses a significant risk to the integrity of the application. Organizations should prioritize restricting access to the administrative interface and implement robust input validation as a stopgap measure until the vendor releases a secure update.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the edit_student.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database interaction and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2025-11061

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/edit_student.php file via the cys parameter. This vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive student or system data stored in the database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in full database compromise, data exfiltration, or loss of system integrity. Such an incident poses significant risks to institutional data privacy and operational continuity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/edit_student.php file to trusted IP addresses only or disable the affected module entirely.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the edit_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://github.com/luyisi-7/CVE/issues/5).

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute malicious database queries.

Analyst Recommendation

The presence of a public proof-of-concept and the lack of a vendor-supplied patch necessitate immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize isolating the affected component to prevent unauthorized access. Monitor for updates from the vendor and apply them as soon as they become available to permanently remediate this SQL injection flaw.

Description Summary:
A SQL injection vulnerability exists in the print_inv.php file of SourceCodester Pet Grooming Management Software 1.0, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 enables remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11057

Affected Software: SourceCodester Pet Grooming Management Software

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection via the ID parameter in the /admin/print_inv.php file. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL queries poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive pet grooming records, customer information, or potential administrative account takeover. Given the CVSS score of 7.3, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable print_inv.php functionality if it is not business critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed toward the /admin/print_inv.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue linked in the vulnerability references.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of required authentication, making it trivial for remote attackers to weaponize.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, organizations must treat this as a high-priority risk. If the software cannot be patched or the specific vulnerable file removed, the application should be isolated from public-facing networks until a secure update is provided by the vendor.

Description Summary:
SourceCodester Online Hotel Reservation System 1.0 is vulnerable to remote SQL injection via the address argument in the /admin/updateaddress.php file.

Executive Summary:
A critical SQL injection vulnerability in the SourceCodester Online Hotel Reservation System 1.0 allows unauthenticated remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-11055

Affected Software: SourceCodester Online Hotel Reservation System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /admin/updateaddress.php file. An unauthenticated attacker can manipulate the address parameter to inject malicious SQL queries, leading to unauthorized database interaction.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive guest or administrative data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially resulting in full database compromise or operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/updateaddress.php endpoint or disable the affected module entirely.

Proactive Monitoring: Review web server access logs for anomalous patterns, specifically looking for SQL-related syntax or characters within POST requests directed at the updateaddress.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically configured to sanitize or block input containing SQL injection payloads targeting the address parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the vulnerability report on GitHub (https://github.com/diy777/cve/issues/4).

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its ease of exploitation via remote, unauthenticated access.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates urgent attention. Organizations running version 1.0 of the Online Hotel Reservation System must implement the suggested compensatory controls immediately, as the lack of a vendor-provided patch leaves the application exposed to potential data exfiltration or administrative account compromise.

Description Summary:
PHPGurukul Small CRM 4.0 is vulnerable to remote SQL injection via the email parameter in the forgot-password.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Small CRM 4.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11053

Affected Software: PHPGurukul Small CRM

Affected Versions: 4.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located within the forgot-password.php script. Unauthenticated attackers can inject malicious SQL commands via the email argument to interact with the backend database.

Business Impact

The ability to perform unauthorized SQL injection attacks poses a severe risk to the confidentiality and integrity of the organization. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration, database manipulation, or potential service disruption. Successful exploitation allows an attacker to bypass authentication mechanisms and gain unauthorized access to sensitive user information stored within the CRM database.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict access to the forgot-password.php endpoint or disable the affected functionality until the vendor releases a security update.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the forgot-password.php file, specifically looking for characters indicative of SQL injection such as single quotes, semicolons, or SQL keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the application's input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its remote, unauthenticated nature and the lack of complex requirements for execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Security teams should prioritize limiting exposure of the Small CRM instance to the public internet and implementing stringent input validation at the WAF level until the vendor provides a formal patch. Failure to mitigate this flaw increases the likelihood of unauthorized database access and data compromise.

Description Summary:
An SQL injection vulnerability exists in the kidaze CourseSelectionSystem within the /Profilers/PriProfile/COUNT3s5.php file, allowing remote attackers to manipulate the csslc argument.

Executive Summary:
A remote SQL injection vulnerability in the kidaze CourseSelectionSystem allows unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11052

Affected Software: kidaze CourseSelectionSystem

Affected Versions: 1.0, 5.php

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by improper input validation of the csslc argument within the /Profilers/PriProfile/COUNT3s5.php file. The vulnerability is remotely exploitable and does not require authentication.

Business Impact

Successful exploitation of this flaw could allow an attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this represents a high-severity risk that could compromise the confidentiality and integrity of student or system information stored within the CourseSelectionSystem.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict network access to the vulnerable /Profilers/PriProfile/COUNT3s5.php endpoint until a security update is released.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the COUNT3s5.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious payloads targeting SQL injection patterns in the csslc URL parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the researcher write-up at the provided GitHub issue tracker.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, organizations must treat this as a high-priority risk. Immediately isolate the affected component from external networks or apply stringent WAF filtering to prevent unauthorized database access. Prioritize monitoring for signs of intrusion and seek communication from the vendor regarding a definitive patch.

Description Summary:
A Server-Side Request Forgery vulnerability exists in Tencent WeKnora version 0.1.0, specifically within the testEmbeddingModel function, allowing remote attackers to manipulate the baseUrl argument.

Executive Summary:
A critical Server-Side Request Forgery vulnerability in Tencent WeKnora 0.1.0 allows for unauthenticated remote exploitation, posing a significant risk to internal network resources.

Vulnerability Details

CVE-ID: CVE-2025-11046

Affected Software: Tencent WeKnora

Affected Versions: 0.1.0

Vulnerability: The application is susceptible to Server-Side Request Forgery (CWE-918) via the testEmbeddingModel function located in the /api/v1/initialization/embedding/test endpoint. An unauthenticated attacker can manipulate the baseUrl parameter to force the server to make unauthorized requests to internal or external network resources.

Business Impact

Successful exploitation allows an attacker to bypass firewalls and interact with internal services that are not exposed to the public internet. With a CVSS score of 7.3, this flaw presents a high risk, as it can lead to information disclosure or the exploitation of other internal services, potentially resulting in unauthorized data access or service disruption.

Remediation Plan

Immediate Action: As the vendor states the issue does not exist in the latest releases, administrators must verify their current deployment version and upgrade to the most recent version of WeKnora immediately.

Proactive Monitoring: Security teams should monitor network traffic for unusual outbound requests originating from the application server, specifically looking for connections to internal IP addresses or sensitive infrastructure.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block requests containing suspicious URL patterns or unexpected domains in the baseUrl parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for unauthorized internal network access, this vulnerability requires immediate attention. Organizations currently running version 0.1.0 must prioritize migrating to the latest stable release to eliminate the risk of exploitation.

Description Summary:
A command injection vulnerability in WAYOS LQ series routers allows remote attackers to execute arbitrary commands via the Name argument in the /usb_paswd.asp endpoint.

Executive Summary:
A critical command injection vulnerability in multiple WAYOS router models exposes devices to remote unauthorized command execution.

Vulnerability Details

CVE-ID: CVE-2025-11045

Affected Software: WAYOS LQ_04, LQ_05, LQ_06, LQ_07, and LQ_09

Affected Versions: 22.03.17

Vulnerability: The vulnerability exists in the /usb_paswd.asp script, where the Name parameter fails to properly sanitize user input, leading to command injection. This flaw is remotely exploitable by unauthenticated attackers.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands on the affected router with the privileges of the web server. This could lead to full device compromise, unauthorized access to internal network traffic, or the redirection of traffic for malicious purposes. Given the CVSS score of 7.3, this represents a significant risk to network integrity and confidentiality.

Remediation Plan

Immediate Action: Restrict access to the web management interface of the affected devices and monitor for official vendor firmware updates.

Proactive Monitoring: Review system logs for suspicious activity involving the /usb_paswd.asp file and monitor network traffic for unexpected outbound connections from the router.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress filtering rules to block requests directed at the /usb_paswd.asp endpoint.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced security research (VulDB).

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of command injection flaws in edge networking equipment makes this a high-priority target for automated exploitation tools.

Analyst Recommendation

Organizations utilizing the identified WAYOS router models must treat this vulnerability with high urgency. Given the availability of a public proof-of-concept and the potential for remote command execution, network administrators should isolate these devices from the public internet immediately and apply vendor-provided patches as soon as they become available.

Description Summary:
An improper certificate validation flaw in the B&R Automation Studio OPC-UA and ANSL clients allows unauthenticated network attackers to intercept and interfere with data exchanges.

Executive Summary:
A critical certificate validation vulnerability in B&R Automation Studio allows unauthenticated attackers to perform man-in-the-middle attacks and compromise data integrity.

Vulnerability Details

CVE-ID: CVE-2025-11043

Affected Software: B&R Industrial Automation GmbH Automation Studio

Affected Versions: 4, 6 up to (excluding) 6.5

Vulnerability: This vulnerability involves Improper Certificate Validation (CWE-295) within the OPC-UA and ANSL over TLS client implementations. An unauthenticated attacker positioned on the local network can bypass standard security checks to intercept or manipulate sensitive communication streams.

Business Impact

The ability to intercept and interfere with data exchanges poses a significant risk to operational technology environments. Successful exploitation could lead to unauthorized control over industrial processes, data corruption, or the loss of process visibility, potentially causing physical safety hazards or production downtime. Given the CVSS score of 7.4, this vulnerability represents a high-severity risk that requires immediate prioritization in industrial control system environments.

Remediation Plan

Immediate Action: Upgrade B&R Automation Studio to version 6.5 or later, as specified in the vendor security advisory.

Proactive Monitoring: Inspect network traffic for unauthorized OPC-UA or ANSL communication patterns and review system logs for unexpected connection attempts or certificate errors.

Compensating Controls: Isolate affected systems within restricted network segments and implement strict firewall rules to limit access to authorized management stations only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for an attacker to be positioned on the network to intercept traffic, yet it remains a significant concern for critical infrastructure security.

Analyst Recommendation

Organizations utilizing B&R Automation Studio must treat this vulnerability with high urgency due to the potential for direct manipulation of industrial data flows. Please verify your current software version against the affected range and apply the vendor-provided update immediately to eliminate the underlying certificate validation defect.

Description Summary:
A SQL injection vulnerability in the Hostel Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the ID argument in index.php.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Hostel Management System 1.0 poses a severe risk of unauthorized database manipulation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-11040

Affected Software: code-projects Hostel Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability residing in the /justines/admin/mod_users/index.php file. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to or modification of sensitive data within the application database. Given the CVSS score of 7.3, this represents a high-risk security gap that could lead to full database compromise, unauthorized administrative account creation, or the exfiltration of personally identifiable information, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the affected web directory or disable the vulnerable module.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for URL parameters containing SQL syntax or encoded characters targeting the index.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts against the target URI.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided via the GitHub repository at https://github.com/iflame28/CVE/issues/3.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk profile of this vulnerability. Organizations using the Hostel Management System must prioritize restricting public network access to the application immediately. Given the lack of a vendor-supplied patch, implementing strict WAF filtering is the most effective temporary measure to prevent potential exploitation of this injection flaw.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to SQL injection via the ID parameter in the /pages/us_edit1.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity and access.

Vulnerability Details

CVE-ID: CVE-2025-11039

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/us_edit1.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification of inventory records, or potential administrative account takeover within the application. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the underlying database, which may contain sensitive business or user information.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the vulnerable /pages/us_edit1.php endpoint or disable the affected module entirely if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual activity targeting the /pages/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute, making it highly accessible to remote actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected systems. Organizations running Campcodes Computer Sales and Inventory System 1.0 must prioritize implementing network-level blocks or WAF rules immediately to prevent unauthorized database access until an official vendor patch is released.

Description Summary:
A SQL injection vulnerability in the E-Commerce Website 1.0 admin_index_search.php file allows unauthenticated attackers to execute malicious queries via the search parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects E-Commerce Website 1.0 poses a critical risk of full database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-11037

Affected Software: code-projects E-Commerce Website

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the search parameter within the admin_index_search.php file, which is processed directly in SQL queries. This allows an unauthenticated attacker to inject arbitrary SQL commands to manipulate database operations.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to bypass authentication, exfiltrate sensitive customer or administrative data, and potentially modify or delete database contents. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches and total loss of confidentiality regarding the application database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /pages/admin_index_search.php endpoint at the web server level to prevent external reach.

Proactive Monitoring: Review web server access logs for anomalous POST requests to admin_index_search.php, particularly those containing SQL syntax characters such as single quotes, dashes, or SQL keywords like SELECT, UNION, and SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the search parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the researcher's GitHub repository.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible, as it requires no prior authentication to execute.

Analyst Recommendation

Due to the lack of an official vendor patch and the availability of a functional proof-of-concept, this vulnerability must be treated with high priority. Organizations currently running E-Commerce Website 1.0 should immediately restrict network access to the vulnerable script or consider migrating to a more secure, supported e-commerce platform to mitigate the risk of unauthorized database manipulation.

Description Summary:
An unauthenticated SQL injection vulnerability exists in the admin_account_update.php file of code-projects E-Commerce Website 1.0, allowing remote attackers to manipulate the user_id parameter.

Executive Summary:
The code-projects E-Commerce Website 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise the backend database.

Vulnerability Details

CVE-ID: CVE-2025-11036

Affected Software: code-projects E-Commerce Website

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the user_id parameter within the admin_account_update.php script, which is processed directly in SQL queries. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands against the database.

Business Impact

A successful exploit of this vulnerability grants an attacker unauthorized access to the underlying database, which may contain sensitive customer information, administrative credentials, and transaction records. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete data exfiltration, unauthorized modification of records, or total system compromise, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the admin_account_update.php endpoint or disable the affected functionality entirely until a secure update is provided.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as UNION statements, time-based sleep commands, or unexpected error-based injection attempts originating from the application.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious payloads targeting the user_id parameter.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in a published security research report.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the simplicity of the attack vector.

Analyst Recommendation

Due to the lack of a formal vendor patch and the availability of public proof-of-concept material, this vulnerability poses an immediate risk to any deployment of E-Commerce Website 1.0. Organizations are strongly advised to implement the aforementioned compensating controls immediately and prioritize the migration to a more secure platform or the manual application of prepared statements to the vulnerable source code.

Description Summary:
The kidaze CourseSelectionSystem is vulnerable to remote SQL injection via the cbe argument in the /Profilers/PriProfile/COUNT3s7.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the kidaze CourseSelectionSystem allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11033

Affected Software: kidaze CourseSelectionSystem

Affected Versions: Up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464

Vulnerability: The application fails to properly sanitize the cbe argument within the /Profilers/PriProfile/COUNT3s7.php file, resulting in SQL injection. This flaw can be triggered by an unauthenticated attacker remotely.

Business Impact

Successful exploitation of this vulnerability allows unauthorized interaction with the underlying database, potentially leading to data exfiltration, unauthorized modification of records, or service disruption. With a CVSS score of 7.3, this represents a significant security risk that could facilitate further system compromise or administrative account takeover within the educational environment.

Remediation Plan

Immediate Action: Since this product utilizes a rolling release model without specific versioned patches, users must monitor the official repository for updates and apply the latest commit immediately.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the /Profilers/PriProfile/COUNT3s7.php endpoint, specifically looking for SQL syntax patterns in the cbe parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious input directed at the vulnerable endpoint until a permanent fix is integrated into the codebase.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability findings.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of the SQL injection flaw makes it highly accessible to automated scanning tools.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability poses a clear and present danger to affected systems. Administrators should prioritize identifying instances of this software and applying the latest available repository updates to negate the injection risk.

Description Summary:
A SQL injection vulnerability exists in kidaze CourseSelectionSystem that allows remote, unauthenticated attackers to manipulate the CPU argument via /Profilers/PriProfile/COUNT3s6.php.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in the kidaze CourseSelectionSystem poses a significant risk to data integrity and system security.

Vulnerability Details

CVE-ID: CVE-2025-11032

Affected Software: kidaze CourseSelectionSystem

Affected Versions: Up to commit 42cd892b40a18d50bd4ed1905fa89f939173a464

Vulnerability: The application is susceptible to SQL injection via the CPU argument in the /Profilers/PriProfile/COUNT3s6.php file. This flaw permits unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject SQL queries can lead to unauthorized data exposure, potential modification of database records, or complete compromise of the underlying application database. With a CVSS score of 7.3, this high severity vulnerability demands immediate attention to prevent unauthorized access to sensitive educational or user data managed by the system.

Remediation Plan

Immediate Action: Since no specific patch version is disclosed for this rolling release software, administrators should restrict network access to the affected script or implement strict input validation on the CPU parameter.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax or unusual query strings directed at the /Profilers/PriProfile/COUNT3s6.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable argument.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize auditing their deployments of the kidaze CourseSelectionSystem and apply restrictive filtering or temporary disabling of the affected file until a formal security update is provided by the developers.

Description Summary:
A vulnerability in the Employee Management System allows remote, unauthenticated attackers to bypass authorization checks through the /admin/all-applied-leave.php endpoint.

Executive Summary:
An unauthenticated authorization bypass vulnerability in the Tutorials-Website Employee Management System poses a significant risk to sensitive administrative data and system integrity.

Vulnerability Details

CVE-ID: CVE-2025-11030

Affected Software: Tutorials-Website Employee Management System

Affected Versions: Up to 611887d8f8375271ce8abc704507d46340837a60

Vulnerability: The application suffers from improper authorization (CWE-285) within the /admin/all-applied-leave.php file. This flaw allows an unauthenticated remote attacker to access administrative functionality without valid credentials.

Business Impact

Successful exploitation permits unauthorized users to access administrative pages, leading to potential data exposure, unauthorized modification of employee records, and loss of confidentiality. With a CVSS score of 7.3, this high-severity vulnerability represents a substantial risk to organizational security and compliance postures regarding internal employee data.

Remediation Plan

Immediate Action: Since no specific patch version is provided due to the continuous delivery model, administrators must restrict network access to the /admin/ directory and monitor for unauthorized requests to the affected script.

Proactive Monitoring: Security teams should audit web server access logs for requests to /admin/all-applied-leave.php originating from non-administrative IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or challenge all requests to the /admin/all-applied-leave.php endpoint until an official update is applied.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the provided researcher write-up (VulDB ID 325969).

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation in the wild, though a functional proof-of-concept is publicly available. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated authorization bypass necessitates immediate defensive action. Organizations using this system must prioritize restricting access to the vulnerable endpoint and coordinate with the vendor to determine if a fix has been integrated into the current rolling release.

Description Summary:
The Akilli Commerce E-Commerce Website is susceptible to Blind SQL Injection, allowing attackers to manipulate database queries via special characters.

Executive Summary:
A Blind SQL injection vulnerability in the Akilli Commerce E-Commerce Website allows attackers to extract sensitive database information through improper input neutralization.

Vulnerability Details

CVE-ID: CVE-2025-11024

Affected Software: Akilli Commerce, E-Commerce Website

Affected Versions: Before 4.5.001

Vulnerability: The application fails to properly neutralize special elements in SQL commands. This allows unauthenticated attackers to execute blind SQL injection attacks, potentially leading to unauthorized data extraction.

Business Impact

The CVSS score of 9.8 underscores the critical nature of this vulnerability. Successful exploitation permits an attacker to bypass authentication, access sensitive customer data, and potentially compromise the underlying database, leading to severe regulatory and financial consequences.

Remediation Plan

Immediate Action: Update the Akilli Commerce E-Commerce Website to version 4.5.001 or higher immediately.

Proactive Monitoring: Review database query logs for suspicious patterns, such as unexpected use of SQL keywords or character sequences indicative of injection attempts.

Compensating Controls: Deploy a WAF configured with SQL injection protection rules to filter malicious input requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical severity of this SQL injection flaw, immediate remediation is required to safeguard customer data. Administrators must apply the vendor-provided security update as the primary defense against this high-impact risk.

Description Summary:
A PHP remote file inclusion vulnerability in ArkSigner AcBakImzala allows unauthenticated attackers to execute arbitrary code via improper control of filenames in include or require statements.

Executive Summary:
An unauthenticated remote file inclusion vulnerability in ArkSigner AcBakImzala poses a critical risk of complete system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11023

Affected Software: ArkSigner Software and Hardware Inc. AcBakImzala

Affected Versions: All versions before v5.1.4

Vulnerability: This vulnerability is caused by improper handling of filenames within PHP include or require statements, falling under CWE-829 and CWE-98. The vulnerability is exploitable by an unauthenticated attacker over the network with no user interaction required.

Business Impact

The ability to perform remote file inclusion allows an attacker to execute arbitrary PHP code on the server, leading to a total loss of confidentiality, integrity, and availability. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could result in full server takeover, data exfiltration, or the deployment of malicious payloads within the production environment.

Remediation Plan

Immediate Action: Update the ArkSigner AcBakImzala software to version v5.1.4 or later to remediate the vulnerable code path.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or attempts to include remote resources in PHP file parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block path traversal attempts and unauthorized file inclusion patterns as a temporary defense-in-depth measure.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Oct 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication and the potential for direct code execution.

Analyst Recommendation

This vulnerability presents a severe risk to organizational infrastructure due to its high CVSS score and the ease of exploitation. Administrators must prioritize upgrading to version v5.1.4 immediately to prevent potential remote code execution attacks. If an immediate update is not feasible, restrict network access to the affected application and monitor logs for signs of malicious activity.

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability in Personal Project Panilux allows unauthenticated attackers to achieve remote command injection.

Executive Summary:
A critical CSRF vulnerability in the Panilux application allows unauthenticated attackers to execute arbitrary system commands, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11022

Affected Software: Personal Project Panilux

Affected Versions: 0 up to (excluding) 0.10.0

Vulnerability: The application is susceptible to a Cross-Site Request Forgery (CWE-352) flaw that allows an attacker to perform unauthorized actions on behalf of a user. The vulnerability is further escalated by a command injection flaw, allowing unauthenticated attackers to execute arbitrary OS commands via the application.

Business Impact

The ability to perform remote command injection grants an attacker full control over the host system, leading to potential data exfiltration, system destruction, and lateral movement within the network. With a CVSS score of 9.6, this vulnerability represents a critical threat to organizational security and compliance, as it facilitates complete unauthorized access to backend resources.

Remediation Plan

Immediate Action: Upgrade to version 0.10.0 or later immediately to resolve the identified vulnerability. If an update is not available from the source, consider decommissioning the service until a secure version is established.

Proactive Monitoring: Monitor system logs and process activity for unauthorized command execution or unusual child processes spawned by the web server service.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict CSRF protection rules and enforce SameSite cookie attributes to mitigate the risk of cross-site request forgery attacks.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of Dec 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vendor has reportedly denied ownership of the product, the technical risk remains severe due to the potential for unauthenticated command execution.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for total system compromise, immediate action is required to secure the environment. Organizations currently utilizing Panilux should prioritize patching to version 0.10.0 or isolating affected systems from the network to prevent potential exploitation.

Description Summary:
A flaw in the libsoup HTTP library's cookie date handling logic allows for an out-of-bounds memory read when processing specially crafted expiration dates, potentially exposing sensitive process memory.

Executive Summary:
The libsoup HTTP library contains an out-of-bounds memory read vulnerability that could allow unauthenticated attackers to disclose sensitive information from memory.

Vulnerability Details

CVE-ID: CVE-2025-11021

Affected Software: GNOME libsoup

Affected Versions: 0 through 3.6.5

Vulnerability: This vulnerability is an out-of-bounds read (CWE-125) triggered by the improper parsing of cookie expiration dates. An unauthenticated attacker can exploit this by sending a specially crafted HTTP response to a client or application utilizing the library, leading to the potential leakage of sensitive memory contents.

Business Impact

The exploitation of this vulnerability poses a significant risk to data confidentiality. Because libsoup is widely integrated into various desktop and web-based applications, successful memory disclosure could expose authentication tokens, session identifiers, or other private data stored within the application process. Given the CVSS score of 7.5, this high-severity flaw requires prompt attention to prevent unauthorized access to sensitive information.

Remediation Plan

Immediate Action: Update the libsoup library to the fixed versions provided by your distribution vendor, specifically noting the patches released by Red Hat for RHEL 7, 8, and 10.

Proactive Monitoring: Monitor system logs for unusual application crashes or memory access errors that may indicate an attempt to trigger an out-of-bounds read condition.

Compensating Controls: While specific network-level blocking is difficult, ensure that endpoints are protected by robust endpoint security solutions that monitor for abnormal process memory access patterns.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists in the referenced GitHub repository.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild. Per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows for remote, unauthenticated information disclosure through standard network communication flows.

Analyst Recommendation

This vulnerability represents a significant risk to applications relying on libsoup for network communication. Security teams should prioritize the application of vendor-supplied security updates across all affected systems. Failure to patch may expose sensitive process memory to remote attackers, and immediate remediation is strongly advised to maintain the confidentiality of application data.

Description Summary:
MarkAny SafePC Enterprise is vulnerable to path traversal, SQL injection, and unrestricted file upload, allowing attackers to obtain server information and potentially execute arbitrary code.

Executive Summary:
A critical vulnerability chain in MarkAny SafePC Enterprise allows unauthenticated attackers to perform path traversal, SQL injection, and dangerous file uploads, creating a significant risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11020

Affected Software: MarkAny SafePC Enterprise

Affected Versions: V7.0.* (V7.0.YYYY.MM.DD) before V7.0.1, V5..

Vulnerability: The software contains a chain of vulnerabilities: path traversal (CWE-22), SQL injection (CWE-89), and unrestricted file upload (CWE-434). These flaws can be triggered by an unauthenticated attacker to extract sensitive server information and potentially achieve remote code execution.

Business Impact

The combination of these vulnerabilities poses a severe threat to data integrity, confidentiality, and availability. With a CVSS score of 8.8, this flaw could allow unauthorized actors to gain full control over the affected server, leading to complete database compromise and the installation of persistent malicious backdoors.

Remediation Plan

Immediate Action: Contact MarkAny support or monitor the official vendor security portal to obtain the latest patch for SafePC Enterprise, as the specific fixed version for the V5 series is not currently documented.

Proactive Monitoring: Review database access logs for unusual queries and inspect file upload directories for unauthorized or suspicious executable files.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict rules to block path traversal sequences and suspicious file upload attempts, and restrict network access to the management interface to trusted segments only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 3, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The severity of this flaw is elevated by the lack of required authentication, making it a high priority for organizations running affected versions.

Analyst Recommendation

Given the potential for total system compromise, organizations should prioritize the identification of all instances of MarkAny SafePC Enterprise within their environment. Apply the necessary updates as soon as they are made available by the vendor, and ensure that network-level restrictions are in place to minimize the attack surface until the software is fully patched.