Description Summary:
A SQL injection vulnerability in the Beauty Parlour Management System allows remote unauthenticated attackers to manipulate the delid argument in the all-appointment.php file.

Executive Summary:
The PHPGurukul Beauty Parlour Management System is vulnerable to a remote SQL injection attack, which could allow an unauthenticated attacker to compromise system data.

Vulnerability Details

CVE-ID: CVE-2025-10459

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is susceptible to SQL injection via the delid parameter in the /admin/all-appointment.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow unauthorized actors to interact with the underlying database, potentially leading to data exfiltration or corruption. Given the CVSS score of 7.3, this flaw is categorized as High severity, posing a significant risk to the confidentiality and integrity of the management system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/all-appointment.php file or the entire application until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for suspicious patterns involving the delid parameter, especially requests containing SQL syntax or unusual characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the vulnerability reporter at the referenced GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its accessibility without authentication.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of this SQL injection vulnerability. Organizations utilizing this system must prioritize restricting external access to the affected components and monitor for signs of unauthorized database queries until a formal vendor patch is released and applied.

Description Summary:
The Zephyr RTOS suffers from improper input validation of length parameters, potentially leading to memory corruption or service disruption during internal operations.

Executive Summary:
A critical vulnerability in the Zephyr RTOS allows unauthenticated attackers on the local network to trigger memory corruption or system instability due to missing input sanitization.

Vulnerability Details

CVE-ID: CVE-2025-10458

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: All versions through 4.1.0

Vulnerability: This flaw is classified as CWE-130, representing improper handling of length parameter inconsistency. The vulnerability is reachable by an unauthenticated attacker positioned on the adjacent network (AV:A), who can trigger the flaw to cause high impact on system availability.

Business Impact

The exploitation of this vulnerability can lead to significant system instability or denial of service, which is particularly concerning for critical infrastructure and embedded systems running Zephyr. With a CVSS score of 7.6, the vulnerability is classified as High, reflecting the risk to system integrity and availability in environments where Zephyr is deployed.

Remediation Plan

Immediate Action: Organizations should update to the version of Zephyr RTOS that includes the security fix provided by the vendor, as referenced in the official GitHub advisory.

Proactive Monitoring: Security teams should monitor network traffic for anomalous length parameters or unexpected device reboots that may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation to isolate devices running Zephyr from untrusted network segments, thereby limiting the attack surface to the local network.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor capable of communicating with the device over the local network segment.

Analyst Recommendation

Given the potential for denial of service and system disruption, it is imperative that developers and system integrators verify their current Zephyr RTOS version. Projects utilizing affected versions should move to apply the necessary security patches immediately to protect against potential exploitation of this memory-handling flaw.

Description Summary:
A vulnerability in the Zephyr RTOS Bluetooth Low Energy stack handling of fixed channels allows for memory corruption or system crashes via unauthorized disconnection attempts.

Executive Summary:
A high-severity vulnerability in the Zephyr RTOS Bluetooth stack allows unauthenticated attackers to cause system instability or memory corruption.

Vulnerability Details

CVE-ID: CVE-2025-10456

Affected Software: Zephyr Project Zephyr RTOS

Affected Versions: Zephyr RTOS up to 4.1.0

Vulnerability: This vulnerability, classified as CWE-190, involves improper handling of Bluetooth Low Energy fixed channels where an attacker can trigger an invalid disconnection request. The flaw is exploitable by an unauthenticated attacker within physical proximity to the target device.

Business Impact

The exploitation of this flaw can lead to denial of service through assertion failures or system crashes, which significantly impacts the availability of embedded devices. Given the CVSS score of 7.1, the risk is elevated for industrial or critical infrastructure deployments where system uptime is paramount. Potential memory corruption may also be leveraged to compromise device integrity or bypass security controls in specific implementations.

Remediation Plan

Immediate Action: Review the official security advisory at the provided GitHub repository and apply the necessary patches or configuration changes as soon as they are made available by the vendor.

Proactive Monitoring: Monitor Bluetooth traffic logs and system performance metrics for unexpected device reboots or abnormal memory usage patterns in BLE-enabled components.

Compensating Controls: If patching is not immediately feasible, restrict the physical exposure of BLE-enabled devices and disable Bluetooth functionality where it is not strictly required for operation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its potential to trigger memory corruption within the low-level Bluetooth stack of an RTOS.

Analyst Recommendation

Given the potential for denial of service and memory corruption, organizations utilizing Zephyr RTOS should prioritize tracking the vendor security advisory for the release of a corrective patch. Immediate action is required to assess exposure and implement hardening measures to mitigate the risk of unauthorized BLE channel manipulation.

Description Summary:
A missing authentication vulnerability in the Gotac Statistical Database System allows unauthenticated remote attackers to perform unauthorized read, modify, and delete operations on the database.

Executive Summary:
A critical missing authentication vulnerability in the Gotac Statistical Database System permits unauthenticated remote attackers to achieve full control over database records.

Vulnerability Details

CVE-ID: CVE-2025-10452

Affected Software: Gotac Statistical Database System

Affected Versions: 0 up to 1.0.1 (exclusive)

Vulnerability: This flaw stems from a lack of proper authentication checks for critical database functions, classified as CWE-306. Unauthenticated attackers can interact with the backend database with high-level privileges, effectively bypassing all access controls.

Business Impact

The ability for an unauthenticated user to read, modify, or delete database contents poses a severe risk to data integrity and confidentiality. Given the CVSS score of 9.8, this vulnerability could lead to catastrophic data loss, unauthorized exposure of sensitive information, or complete operational downtime for systems relying on this database.

Remediation Plan

Immediate Action: Update the Gotac Statistical Database System to version 1.0.1 or later to implement the necessary authentication controls.

Proactive Monitoring: Review database access logs for unusual queries or unauthorized modifications occurring from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to the database management interface to trusted internal IP addresses until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature and the lack of required user interaction or authentication.

Analyst Recommendation

Due to the critical severity and the potential for full database compromise, organizations must prioritize patching this vulnerability immediately. Upgrading to version 1.0.1 is the only effective way to remediate the lack of authentication; failure to do so leaves the database exposed to trivial exploitation by remote, unauthenticated actors.

Description Summary:
An unchecked output buffer in InsydeH2O firmware allows for potential arbitrary code execution and memory corruption within System Management Mode (SMM).

Executive Summary:
A critical vulnerability in InsydeH2O firmware enables high-privileged attackers to achieve arbitrary code execution and memory corruption within System Management Mode.

Vulnerability Details

CVE-ID: CVE-2025-10451

Affected Software: Insyde Software InsydeH2O

Affected Versions: InsydeH2O HP feature version before 20C1

Vulnerability: This vulnerability is an out-of-bounds write (CWE-787) caused by an unchecked output buffer. It requires high privileges (PR:H) to exploit, as the attacker must operate within a context capable of interacting with System Management Mode.

Business Impact

The ability to execute arbitrary code within SMM is a severe security failure that bypasses standard operating system protections. Successful exploitation could lead to full system compromise, persistent firmware-level infection, and total loss of confidentiality, integrity, and availability. Given the CVSS score of 8.2, this flaw poses a significant risk to organizational infrastructure that relies on secure boot and hardware-level integrity.

Remediation Plan

Immediate Action: Update your system firmware to the latest version provided by your hardware vendor, specifically ensuring the InsydeH2O feature version is 20C1 or higher.

Proactive Monitoring: Monitor system logs for unexpected firmware-related errors or signs of unauthorized access to administrative or kernel-level interfaces.

Compensating Controls: Ensure that Secure Boot is enabled and properly configured, and maintain strict physical and logical access controls to prevent unauthorized users from reaching the high-privilege state required for exploitation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires local high-level privileges, the impact on System Management Mode makes it a high-value target for sophisticated threat actors.

Analyst Recommendation

This vulnerability represents a significant risk to hardware integrity and system security. Administrators should prioritize identifying affected hardware within their environment and coordinate with their respective hardware manufacturers to obtain and apply the necessary firmware updates as soon as they are released. Failure to remediate could result in deep, persistent, and difficult-to-detect system compromises.

Description Summary:
A path traversal vulnerability in Saysis Web Portal allows unauthenticated attackers to access restricted directories on the server.

Executive Summary:
A critical path traversal vulnerability in the Saysis Web Portal exposes sensitive files to unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-10449

Affected Software: Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal

Affected Versions: 3.1.9, 3.2.0

Vulnerability: This is a path traversal vulnerability (CWE-22) that allows an unauthenticated attacker to bypass directory restrictions. By manipulating input parameters, an attacker can access arbitrary files on the underlying server filesystem.

Business Impact

The ability for an unauthenticated user to read arbitrary files poses a severe risk of data exfiltration, including the exposure of configuration files, credentials, or sensitive business data. With a CVSS score of 8.6, this vulnerability represents a high risk to organizational confidentiality and could lead to full system compromise if sensitive environment variables or keys are retrieved.

Remediation Plan

Immediate Action: Update the Saysis Web Portal to version 3.2.1 or higher as soon as the vendor makes the security update available.

Proactive Monitoring: Review web server access logs for requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at non-public files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts to prevent exploitation while awaiting a permanent patch.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly accessible due to its lack of authentication requirements, making it an attractive target for automated scanning tools.

Analyst Recommendation

Organizations utilizing the Saysis Web Portal must prioritize this vulnerability due to its high CVSS score and the potential for unauthenticated access to sensitive system files. Administrators should monitor vendor channels for the release of version 3.2.1 and apply the update immediately upon availability to mitigate the risk of unauthorized data access.

Description Summary:
Campcodes Online Job Finder System 1.0 contains a SQL injection vulnerability via the searchfor parameter in index.php, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10448

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the index.php file. An unauthenticated remote attacker can inject malicious SQL commands via the searchfor argument, enabling unauthorized database interaction.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potential modification of application records, or service disruption. With a CVSS score of 7.3, this flaw represents a significant risk, as it requires no prior authentication and can be executed remotely to bypass standard security controls.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable index.php endpoint or disable the search functionality until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or sleep commands, targeting the searchfor parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious input directed at the vulnerable application parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/HAO-RAY/HCR-CVE/issues/7.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to the confidentiality and integrity of the system. Organizations should prioritize isolating affected instances from public networks and implementing robust WAF filtering to mitigate the threat until a formal update is provided.

Description Summary:
Campcodes Online Job Finder System 1.0 contains an unrestricted file upload vulnerability in the applicationform.php file, which may allow remote attackers to upload malicious files.

Executive Summary:
A critical file upload vulnerability in the Campcodes Online Job Finder System 1.0 allows remote, unauthenticated attackers to potentially execute arbitrary code on the affected server.

Vulnerability Details

CVE-ID: CVE-2025-10447

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: This vulnerability is an unrestricted file upload flaw (CWE-434) located in the /eris/applicationform.php file. The application fails to properly validate the picture argument, allowing an unauthenticated remote attacker to upload arbitrary files to the system.

Business Impact

The ability to upload arbitrary files to a web server typically leads to full system compromise via remote code execution. Given the CVSS score of 7.3, this represents a significant risk of data exfiltration, unauthorized system access, and complete service disruption. Organizations relying on this software face severe reputational and operational damage if the application is exploited.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected application or disable the file upload functionality in the applicationform.php file until an official fix is released by the vendor.

Proactive Monitoring: Monitor server logs for unusual file creation events in the upload directories and review HTTP request logs for attempts to access non-image files within the application's upload path.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing suspicious file extensions or non-image MIME types directed at the applicationform.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of input validation on the file upload mechanism.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a high risk to any organization running Campcodes Online Job Finder System 1.0. If you cannot immediately patch or update the software, you must isolate the instance from public network access to prevent unauthorized file uploads. Prioritize the replacement or mitigation of this system as soon as possible.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /pages/cust_searchfrm.php file, potentially allowing unauthorized database access.

Executive Summary:
The Campcodes Computer Sales and Inventory System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10446

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the ID parameter of the /pages/cust_searchfrm.php file during edit actions. This SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary database commands.

Business Impact

This vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could allow attackers to bypass authentication, extract sensitive customer or inventory data, or modify database contents, leading to potential operational disruption and loss of trust. The CVSS score of 7.3 reflects the high risk posed by an unauthenticated remote attack vector.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /pages/cust_searchfrm.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as SQL syntax characters or unexpected queries targeting the cust_searchfrm.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting query parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the security researcher's submission on GitHub.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Computer Sales and Inventory System 1.0 must implement network-level access controls or WAF protections to mitigate the risk of unauthorized database interaction until the vendor provides a formal security update.

Description Summary:
Campcodes Computer Sales and Inventory System version 1.0 contains an unauthenticated SQL injection vulnerability in the Username parameter of the /pages/us_transac.php script.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-10445

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection (CWE-89) vulnerability occurring in the Username argument of the /pages/us_transac.php file. The vulnerability is exploitable by an unauthenticated remote attacker via simple HTTP GET or POST requests.

Business Impact

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application database. Organizations relying on this system for inventory management face potential operational disruption if the underlying database is compromised.

Remediation Plan

Immediate Action: No official patch is currently available from the vendor. Administrators should immediately restrict access to the affected web directory or disable the vulnerable functionality until a security update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /pages/us_transac.php endpoint, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in incoming request parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/e1evensu/cve/issues/2.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization on the Username parameter.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations should prioritize isolating the affected system or implementing strict WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.

Description Summary:
Campcodes Online Job Finder System 1.0 is vulnerable to remote SQL injection via the Username parameter in advancesearch.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-10444

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the advancesearch.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL queries into the backend database.

Business Impact

The ability to perform unauthenticated SQL injection permits attackers to bypass application logic, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this vulnerability represents a high risk to the confidentiality and integrity of the system, which could result in significant reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the online job search functionality entirely until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to advancesearch.php, specifically monitoring for patterns containing SQL syntax such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the Username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher write-up at https://github.com/HAO-RAY/HCR-CVE/issues/5.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be treated as a high priority. Organizations utilizing Campcodes Online Job Finder System 1.0 must implement strict WAF filtering immediately and monitor for unauthorized database activity while awaiting an official security update from the vendor.

Description Summary:
A buffer overflow vulnerability in Tenda AC9 and AC15 routers allows remote attackers to execute arbitrary code via the cmdinput argument in the formexeCommand function.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC9 and AC15 routers allows for remote code execution, posing a significant risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10443

Affected Software: Tenda AC9 and AC15

Affected Versions: 15.03.05.14, 15.03.05.18

Vulnerability: This memory corruption flaw exists within the formexeCommand function of the /goform/exeCommand endpoint. The vulnerability is triggered by manipulating the cmdinput argument, which allows an authenticated attacker to perform a buffer overflow and execute arbitrary commands remotely.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting a high risk of total system compromise. A successful exploit grants an attacker the ability to execute arbitrary code, potentially leading to unauthorized network access, data exfiltration, or the transformation of the device into a botnet node. This represents a severe threat to internal network integrity and overall organizational security posture.

Remediation Plan

Immediate Action: Contact Tenda support or check the official vendor portal for available firmware updates, as no specific patch version is currently identified. If no update is available, isolate the affected devices from external network access to prevent remote exploitation.

Proactive Monitoring: Monitor network traffic for unusual requests directed at the /goform/exeCommand endpoint and inspect system logs for signs of anomalous process execution or unexpected device reboots.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) to filter and block malicious payloads targeting the cmdinput parameter on the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct memory manipulation via a web interface.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high severity of the vulnerability, organizations must treat this as a priority. Administrators should restrict management interface access to trusted administrative segments only and immediately apply any forthcoming firmware updates to remediate the buffer overflow condition.

Description Summary:
Yordam Library Automation System is susceptible to an unauthenticated SQL injection vulnerability via improper neutralization of special elements in SQL commands.

Executive Summary:
An unauthenticated SQL injection vulnerability in Yordam Library Automation System allows remote attackers to execute arbitrary database commands, posing a critical risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2025-10439

Affected Software: Yordam Informatics Yordam Library Automation System

Affected Versions: 21.5, 21.6 (prior to 21.7)

Vulnerability: This vulnerability involves an SQL injection flaw (CWE-89) that permits unauthenticated remote attackers to manipulate backend database queries. Because the CVSS vector (AV:N/AC:L/PR:N) indicates no authentication is required to trigger the exploit, the risk to the confidentiality, integrity, and availability of the system is total.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands represents a severe risk, as it can lead to the unauthorized extraction of sensitive library data, modification of records, or potential administrative access to the underlying database. Given the CVSS score of 9.8, this vulnerability should be treated as a critical threat to organizational data security and system integrity.

Remediation Plan

Immediate Action: Update the Yordam Library Automation System to version 21.7 or the latest available release provided by Yordam Informatics.

Proactive Monitoring: Review database and application logs for unusual query patterns, particularly those containing SQL syntax characters, which may indicate attempts to exploit this vulnerability.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the application endpoints.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of September 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SQL injection flaws of this nature are highly dangerous due to their potential for full database compromise without requiring valid user credentials.

Analyst Recommendation

This vulnerability is critical due to the lack of authentication requirements and the high potential for total system impact. Organizations running affected versions of the Yordam Library Automation System must prioritize patching to version 21.7 immediately to prevent unauthorized database access.

Description Summary:
A path traversal vulnerability in Yordam Katalog allows unauthenticated attackers to access sensitive files via directory traversal sequences.

Executive Summary:
A critical path traversal vulnerability in Yordam Katalog allows unauthenticated remote attackers to read unauthorized files, posing a significant risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-10438

Affected Software: Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog

Affected Versions: 0 up to (excluding) 21.7

Vulnerability: This is a path traversal flaw (CWE-27) occurring within the application directory handling logic. The vulnerability is exploitable by unauthenticated remote attackers who can craft malicious requests to access files outside of the intended directory.

Business Impact

The ability for an unauthenticated user to perform path traversal represents a severe security risk, as it may lead to the unauthorized disclosure of sensitive configuration files, credentials, or system data. With a CVSS score of 8.6, this vulnerability is categorized as high severity due to its potential for full unauthorized access to system files, which could lead to complete system compromise or further lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade Yordam Katalog to version 21.7 or later as soon as the vendor provides the update. In the absence of a direct patch, restrict network access to the application to only trusted IP addresses.

Proactive Monitoring: Review web server access logs for anomalous directory traversal patterns, such as sequences containing multiple dots and slashes, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts, specifically targeting patterns involving dot-dot-slash sequences.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 26, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's design allows for trivial exploitation because it does not require authentication, making it a high priority for remediation once a fix is available.

Analyst Recommendation

Given the high CVSS score and the unauthenticated nature of the attack vector, organizations running Yordam Katalog must prioritize this vulnerability. Ensure that monitoring is active to detect any potential reconnaissance or unauthorized access attempts while awaiting the official patch release from the vendor.

Description Summary:
An SQL injection vulnerability in the Eksagate Webpack Management System allows unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
The Eksagate Webpack Management System is vulnerable to unauthenticated SQL injection, which could allow a remote attacker to gain full control over the backend database.

Vulnerability Details

CVE-ID: CVE-2025-10437

Affected Software: Eksagate Electronic Engineering and Computer Industry Trade Inc. Webpack Management System

Affected Versions: 0 through 20251119

Vulnerability: This is an SQL injection flaw (CWE-89) where improper neutralization of special elements in input allows an unauthenticated attacker to manipulate backend database queries.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to sensitive data, potential modification or deletion of database contents, and full system compromise. With a CVSS score of 9.8, this flaw is categorized as critical, representing an immediate risk to the confidentiality, integrity, and availability of the affected infrastructure.

Remediation Plan

Immediate Action: Contact the vendor, Eksagate Electronic Engineering and Computer Industry Trade Inc., to obtain and apply the latest security update or patch for the Webpack Management System.

Proactive Monitoring: Review application and database access logs for suspicious query patterns, such as unexpected use of SQL syntax characters or unauthorized data export attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious traffic targeting the Webpack Management System until a permanent patch is applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Nov 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of input sanitization makes this component highly susceptible to automated exploitation tools.

Analyst Recommendation

Given the critical CVSS severity of 9.8 and the unauthenticated nature of this vulnerability, immediate remediation is required. Organizations using the Eksagate Webpack Management System should prioritize patching as soon as the vendor provides a resolution and restrict network access to the management interface to authorized personnel only.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to unauthenticated SQL injection via the ID parameter in the sup_searchfrm.php file.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 poses a significant risk to database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2025-10436

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/sup_searchfrm.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries remotely.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands into the backend database presents a severe risk of unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this flaw is categorized as High severity and could lead to complete compromise of the application data layer, potentially resulting in significant operational disruption and loss of sensitive inventory information.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the affected directory /pages/sup_searchfrm.php or disable the vulnerable module until a fix is released by Campcodes.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the sup_searchfrm.php endpoint, specifically looking for URL parameters containing SQL syntax or encoded payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it does not require authentication or user interaction.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for mitigation. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must implement strict access controls and WAF filtering immediately to prevent potential database compromise until an official security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Computer Sales and Inventory System 1.0, specifically within the cust_edit1.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Computer Sales and Inventory System 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10435

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/cust_edit1.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the ID argument, which is then processed by the application without sufficient sanitization.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive customer and inventory data stored within the database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or modification.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or disable the vulnerable module until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns in the ID parameter of requests directed at /pages/cust_edit1.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently running the affected version of the Campcodes system must prioritize the implementation of compensating controls or network isolation to prevent exploitation, as the lack of a vendor patch leaves the system directly exposed to remote attackers.

Description Summary:
A stack-based buffer overflow in the Tenda AC1206 router allows unauthenticated remote attackers to achieve remote code execution or a denial of service via a crafted HTTP request.

Executive Summary:
A critical stack-based buffer overflow vulnerability in Tenda AC1206 firmware version 15.03.06.23 permits unauthenticated remote attackers to execute arbitrary code or crash the device.

Vulnerability Details

CVE-ID: CVE-2025-10432

Affected Software: Tenda AC1206

Affected Versions: 15.03.06.23

Vulnerability: The vulnerability exists within the check_param_changed function of the /goform/AdvSetMacMtuWan HTTP endpoint, where insufficient bounds checking during the copy of the wanMTU parameter leads to a stack-based buffer overflow. This flaw is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this vulnerability allows for full system compromise, including the ability to execute arbitrary code on the affected router. Given the CVSS score of 9.8, this represents a critical risk that could lead to unauthorized network access, interception of traffic, or complete service disruption. The potential for unauthenticated remote code execution makes this a high-priority threat for any environment utilizing these devices.

Remediation Plan

Immediate Action: Update the Tenda AC1206 firmware to the latest available version provided by the manufacturer. If an update is not immediately available, disable remote management features and restrict access to the web interface to trusted management networks.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at the /goform/AdvSetMacMtuWan endpoint. Review system logs for signs of unexpected process restarts or crashes of the httpd service.

Compensating Controls: Implement a Web Application Firewall or network-level access control list to block unauthorized access to the router web management interface. Ensure the device is placed behind a secure firewall to minimize exposure to untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the technical write-up provided by Red-Shield Security Lab.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the lack of boundary checking in a critical network-facing function.

Analyst Recommendation

Given the availability of a functional proof-of-concept and the critical nature of remote code execution, organizations must prioritize the remediation of affected Tenda devices. Apply firmware updates as soon as they are released by the vendor, and ensure that all administrative interfaces remain isolated from the public internet to prevent exploitation attempts.

Description Summary:
A SQL injection vulnerability in the login.php file of itsourcecode Online Laundry Management System 1.0 allows remote, unauthenticated attackers to manipulate the Username argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Online Laundry Management System 1.0 exposes the application to unauthorized database manipulation and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-10426

Affected Software: itsourcecode Online Laundry Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the login.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands by manipulating the Username parameter.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the underlying database, potentially resulting in the compromise of user credentials or sensitive system information. With a CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the laundry management platform, as the attack vector is network-based and requires no authentication.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the login interface and implement strict input validation on the Username field.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting login.php, particularly those containing SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its ease of exploitation from an unauthenticated, remote position.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, organizations using this software should prioritize isolating the affected system from public networks. Immediate implementation of input sanitization or WAF rules is necessary to mitigate the risk of unauthorized database access until a formal update is released.

Description Summary:
A vulnerability in 1000projects Online Student Project Report Submission and Evaluation System 1.0 allows for unrestricted file uploads via the new_image argument in student_controller.php.

Executive Summary:
An unrestricted file upload vulnerability in the 1000projects Online Student Project Report Submission and Evaluation System allows remote, unauthenticated attackers to execute arbitrary file uploads.

Vulnerability Details

CVE-ID: CVE-2025-10425

Affected Software: 1000projects Online Student Project Report Submission and Evaluation System

Affected Versions: 1.0

Vulnerability: The application fails to properly validate file uploads within the /admin/controller/student_controller.php file. An unauthenticated remote attacker can manipulate the new_image argument to upload arbitrary files to the server.

Business Impact

The ability to perform unrestricted file uploads presents a severe risk of remote code execution or server compromise. Successful exploitation could lead to full system takeover, unauthorized access to sensitive student data, or the deployment of malicious scripts, justifying the high CVSS score of 7.3.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected script or disable the upload functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/controller/student_controller.php and monitor the file system for unexpected files uploaded to the web directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious file extensions or malicious payloads directed at the vulnerable controller endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research documented in the referenced GitHub issue.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept, this vulnerability poses an immediate threat to the confidentiality and integrity of the hosting environment. Organizations using this software must treat this as a high-priority issue and apply strict access controls or disable the vulnerable component until an official security update is provided by the vendor.

Description Summary:
A vulnerability in the Online Student Project Report Submission and Evaluation System allows for unrestricted file uploads via the faculty_controller.php file.

Executive Summary:
A critical unrestricted file upload vulnerability in the 1000projects Online Student Project Report Submission and Evaluation System allows remote attackers to execute malicious file uploads.

Vulnerability Details

CVE-ID: CVE-2025-10424

Affected Software: 1000projects Online Student Project Report Submission and Evaluation System

Affected Versions: 1.0

Vulnerability: The application is susceptible to an unrestricted file upload vulnerability within the /admin/controller/faculty_controller.php file, which can be exploited by an unauthenticated remote attacker by manipulating the new_image argument.

Business Impact

Successful exploitation of this vulnerability permits unauthorized file uploads to the server, which can lead to remote code execution or complete system compromise depending on the server configuration. While the CVSS score of 7.3 indicates a High severity, the ability for an unauthenticated attacker to inject arbitrary files poses a significant risk to the integrity and availability of the host infrastructure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin directory and ensure that the application is not accessible from the public internet.

Proactive Monitoring: Monitor server logs for unusual file upload activity or requests directed at the /admin/controller/faculty_controller.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing suspicious file extensions or malicious payloads targeting the upload functionality.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept has been published via the referenced GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it allows remote, unauthenticated access.

Analyst Recommendation

Given the availability of a public proof of concept and the nature of the flaw, this vulnerability presents a high risk to the environment. IT teams should prioritize isolating the affected system from external networks and implement strict file validation controls until a vendor-provided update is released to address the underlying security flaw.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /ajax.php endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise the database.

Vulnerability Details

CVE-ID: CVE-2025-10417

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by the improper sanitization of the ID argument within the /ajax.php file. The attack is remotely exploitable and does not require authentication, allowing an adversary to interact directly with the backend database.

Business Impact

The ability to perform unauthorized SQL queries poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this flaw enables attackers to extract sensitive inventory or user data, modify records, or potentially disrupt service, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should immediately restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /ajax.php, particularly those containing SQL syntax characters like single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests to /ajax.php that contain suspicious patterns characteristic of SQL injection attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote access vector.

Analyst Recommendation

Given the availability of a public exploit and the lack of a formal vendor patch, this vulnerability presents a high risk to the environment. Security teams must prioritize isolating the affected system or implementing strict network-level access controls to prevent unauthorized interaction with the vulnerable endpoint while awaiting further guidance from the vendor.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Grocery Sales and Inventory System 1.0, specifically within the ajax.php file via the ID argument.

Executive Summary:
The Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to unauthenticated remote SQL injection, which could allow an attacker to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10416

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /ajax.php endpoint via the ID parameter. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability can result in unauthorized access to sensitive data stored within the system database. With a CVSS score of 7.3, this flaw presents a high risk, as it allows for potential data exfiltration or modification without requiring any prior authentication, which could lead to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the affected endpoint or disable the vulnerable functionality until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for requests directed to /ajax.php that contain suspicious characters or SQL syntax patterns, such as UNION, SELECT, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter in URL queries.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations must prioritize restricting access to the vulnerable system and implement robust input validation at the WAF level until an official security patch is provided by Campcodes.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to SQL injection via the ID argument in the /ajax.php?action=save_supplier endpoint, which can be exploited by remote, unauthenticated users.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2025-10415

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the ID argument within the /ajax.php?action=save_supplier endpoint, leading to CWE-89 SQL Injection. This vulnerability is remotely exploitable by an unauthenticated attacker.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive information, modify database records, or disrupt system operations, leading to potential data breaches and system downtime. Given the CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized access to the underlying database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor web server logs for suspicious requests to the /ajax.php file, specifically looking for unusual patterns or characters in the ID parameter that resemble SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing SQL injection payloads targeting the specified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct exposure of the vulnerable argument in the URL.

Analyst Recommendation

Given the public availability of exploit material and the unauthenticated nature of this vulnerability, organizations currently running Campcodes Grocery Sales and Inventory System 1.0 are at elevated risk. We strongly recommend implementing immediate network-level restrictions to the affected file and maintaining heightened vigilance until the vendor provides an official security patch.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /ajax.php?action=save_customer endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10414

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input within the ID parameter of the /ajax.php?action=save_customer endpoint. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.

Business Impact

Successful exploitation of this SQL injection vulnerability poses a significant risk to the confidentiality and integrity of sensitive business data stored within the inventory system. With a CVSS score of 7.3, this flaw is categorized as High severity, indicating that the potential for unauthorized data exfiltration or database manipulation is substantial and requires immediate mitigation to prevent operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the /ajax.php endpoint via network controls or isolate the application from the public internet.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept exists as documented in the referenced GitHub issue (https://github.com/zzb1388/cve/issues/81).

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it is remotely exploitable without authentication, making it a prime target for automated scanning tools.

Analyst Recommendation

The presence of a public proof of concept significantly increases the risk of automated exploitation attempts. Organizations utilizing Campcodes Grocery Sales and Inventory System must prioritize restricting access to the application immediately and continue monitoring vendor communications for an official security update to address this SQL injection flaw.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 contains a SQL injection vulnerability in the delete_customer function within ajax.php, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows for unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10413

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) triggered via the ID argument in the /ajax.php?action=delete_customer endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive customer or inventory records, potential data exfiltration, or modification of application database contents, which may result in significant operational disruption and loss of trust. The CVSS score of 7.3 reflects the high risk posed by the ease of remote exploitation.

Remediation Plan

Immediate Action: Since an official patch is not currently available, administrators should restrict network access to the affected web application and disable the vulnerable endpoint if it is not business critical.

Proactive Monitoring: Monitor server access logs for requests directed at /ajax.php containing suspicious characters or SQL syntax in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the specified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the technical write-up published on GitHub.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication requirements and the direct exposure of the database interface through a public URL parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate mitigation is required. Organizations utilizing this software must implement strict access controls and WAF filtering to prevent exploitation until a vendor-supplied security update is released and applied.

Description Summary:
The Uni CPO Premium plugin for WooCommerce allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution.

Executive Summary:
A critical arbitrary file upload vulnerability in the Uni CPO Premium plugin allows unauthenticated attackers to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-10412

Affected Software: MooMoo Product Options and Price Calculation Formulas for WooCommerce (Uni CPO Premium)

Affected Versions: 0 through 4.9.55

Vulnerability: This flaw exists due to improper file type validation within the uni_cpo_upload_file function. An unauthenticated attacker can exploit this to upload malicious files to the server.

Business Impact

The ability for an unauthenticated user to upload arbitrary files typically results in a complete compromise of the web server. With a CVSS score of 9.8, this vulnerability poses a critical threat to data confidentiality, integrity, and availability. Successful exploitation could lead to full site takeover, unauthorized access to sensitive customer data, and potential lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently not specified, administrators should deactivate the Uni CPO Premium plugin immediately if it is not business-critical. If the plugin must remain active, contact the vendor for an urgent security update or migrate to a secure alternative.

Proactive Monitoring: Review web server access logs for requests directed at the uploads directory or unusual file extensions. Monitor system integrity for unexpected script execution or file modifications in the WordPress uploads folder.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block file upload attempts containing executable extensions or suspicious request parameters targeting the uni_cpo_upload_file endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 23, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's unauthenticated nature makes it highly attractive for automated scanning and mass exploitation campaigns.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation, immediate action is required to neutralize this risk. Organizations utilizing this plugin must prioritize the removal or update of the vulnerable component to prevent potential remote code execution. Continue to monitor vendor communications for the release of a stable, patched version.

Description Summary:
A SQL injection vulnerability exists in itsourcecode Baptism Information Management System 1.0 via the bapt_id parameter in listbaptism.php, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-10405

Affected Software: itsourcecode Baptism Information Management System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) within the listbaptism.php file. An unauthenticated remote attacker can trigger this flaw by manipulating the bapt_id parameter.

Business Impact

The vulnerability allows an attacker to execute arbitrary SQL commands against the underlying database. Successful exploitation could lead to unauthorized data exfiltration, modification of records, or potential service disruption. With a CVSS score of 7.3, this represents a high-severity risk that requires immediate attention to protect sensitive information.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators must restrict access to the affected web application by placing it behind a secure VPN or firewall. Disable or remove the vulnerable component if it is not strictly required for business operations.

Proactive Monitoring: Review web server access logs for suspicious patterns in the bapt_id parameter, specifically looking for SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the listbaptism.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up at the referenced GitHub repository.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote attack vector and ease of execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a verified vendor patch, this vulnerability presents an elevated risk to organizations hosting the Baptism Information Management System. Security teams should prioritize isolating the affected system from public-facing networks and implementing robust WAF filtering to prevent exploitation until the vendor releases a secure update.

Description Summary:
The Baptism Information Management System 1.0 contains a SQL injection vulnerability in the rptbaptismal.php script, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in itsourcecode Baptism Information Management System 1.0 exposes the application to remote data manipulation and unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2025-10404

Affected Software: itsourcecode Baptism Information Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the rptbaptismal.php file. The vulnerability is exploitable by an unauthenticated remote attacker through the manipulation of the ID parameter.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the database. This could result in unauthorized access to sensitive baptismal records, data modification, or potential loss of data integrity. With a CVSS score of 7.3, this flaw presents a significant risk to the confidentiality and integrity of the information managed by the system.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict access to the affected file via web server configuration or disable the module if it is not business-critical.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based SQL patterns or unexpected error messages originating from the rptbaptismal.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the ID parameter in the specified script.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at the referenced GitHub repository.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected installations. Administrators should prioritize isolating the vulnerable component and implementing strict input validation or WAF protections immediately to prevent unauthorized database access.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the viewid argument in view-enquiry.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 exposes the application to remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10403

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: This vulnerability is a SQL injection (CWE-89) triggered via the viewid parameter in the /admin/view-enquiry.php file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive parlor data, including customer inquiries and administrative information. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data breaches or unauthorized system control.

Remediation Plan

Immediate Action: Since no official patch is currently available from the vendor, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN authentication.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters directed at the view-enquiry.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the viewid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced in the GitHub issue tracker.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a credible risk to all installations of PHPGurukul Beauty Parlour Management System 1.1. Organizations must implement strict network-level access controls to the administrative interface immediately to mitigate the risk of unauthorized database access until the vendor releases a secure version.

Description Summary:
A SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate the delid argument in /admin/readenq.php.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-10402

Affected Software: PHPGurukul Beauty Parlour Management System

Affected Versions: 1.1

Vulnerability: The application is susceptible to SQL injection via the delid parameter in the /admin/readenq.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a severe risk to data confidentiality, integrity, and availability. Successful exploitation could lead to unauthorized access to sensitive administrative data or complete database compromise. With a CVSS score of 7.3, this flaw represents a significant security risk, especially given the ease of remote execution.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until a vendor fix is released.

Proactive Monitoring: Security teams should audit web server access logs for suspicious input patterns, specifically looking for SQL syntax or unusual characters within the delid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given that this vulnerability is remotely exploitable without authentication and a public proof-of-concept is available, organizations should prioritize isolating the affected system. It is imperative to monitor for signs of unauthorized database interaction and implement strict access controls until the vendor provides an official security patch.

Description Summary:
A SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 allows unauthenticated remote attackers to manipulate database queries via the id parameter in edit_role.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Pet Grooming Management Software 1.0 poses a critical risk of full database compromise and unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10396

Affected Software: SourceCodester Pet Grooming Management Software

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the id parameter in the /admin/edit_role.php file, allowing an unauthenticated attacker to inject malicious SQL commands. This flaw supports various injection techniques including boolean-based blind, time-based blind, and stacked queries.

Business Impact

Successful exploitation of this vulnerability allows unauthorized actors to execute arbitrary SQL commands against the backend database. This can lead to the exfiltration of sensitive customer and administrative data, unauthorized modification of system records, or complete service disruption. Given the CVSS score of 7.3, this represents a significant risk to organizational data integrity and operational continuity.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict network access to the /admin/edit_role.php endpoint to trusted internal networks only.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically looking for SQL syntax characters or time-based sleep commands originating from unexpected sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rulesets designed to detect and block SQL injection payloads targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up on GitHub.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate defensive action. Organizations utilizing this software should implement strict network-level access controls or WAF filtering to prevent exploitation until the vendor releases an official security update.

Description Summary:
A stack-based buffer overflow vulnerability in the Mercury KM08-708H GiGA WiFi Wave2 HTTP Header Handler allows remote, unauthenticated attackers to execute arbitrary code via the Host header.

Executive Summary:
A critical stack-based buffer overflow in Mercury KM08-708H GiGA WiFi Wave2 firmware allows remote, unauthenticated attackers to potentially achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10392

Affected Software: Mercury KM08-708H GiGA WiFi Wave2

Affected Versions: 1.1.14

Vulnerability: This vulnerability is a stack-based buffer overflow (CWE-121) triggered within the HTTP Header Handler component. An unauthenticated remote attacker can supply a malicious Host header to corrupt memory and potentially execute arbitrary code.

Business Impact

The CVSS score of 9.8 indicates a critical severity level, reflecting the potential for total system compromise without requiring user interaction or authentication. Successful exploitation may lead to full device takeover, enabling attackers to intercept network traffic, pivot into internal environments, or disrupt critical connectivity services.

Remediation Plan

Immediate Action: As no patch version is currently specified, administrators should restrict network access to the management interface of the affected device and consider disabling remote HTTP access if possible.

Proactive Monitoring: Monitor device logs for unusual HTTP traffic patterns, specifically focusing on excessively long or malformed Host header strings originating from untrusted sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) rule to inspect and block inbound HTTP requests containing suspicious or oversized Host header fields.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of September 14, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept is available, which significantly increases the risk of exploitation by opportunistic actors. Given the nature of stack-based buffer overflows, this device is highly susceptible to remote code execution attacks if left exposed to the internet.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it provides a direct path for remote, unauthenticated code execution. Organizations utilizing the Mercury KM08-708H GiGA WiFi Wave2 must prioritize isolating these devices from external networks until a vendor-supplied firmware update is verified and applied.

Description Summary:
A buffer overflow vulnerability exists in the Mercury KM08-708H GiGA WiFi Wave2 router, specifically within the sub_450B2C function, allowing remote attackers to trigger memory corruption.

Executive Summary:
A high-severity buffer overflow vulnerability in Mercury KM08-708H GiGA WiFi Wave2 routers allows remote attackers to compromise device integrity, necessitating immediate attention.

Vulnerability Details

CVE-ID: CVE-2025-10385

Affected Software: Mercury KM08-708H GiGA WiFi Wave2

Affected Versions: 1.1

Vulnerability: This flaw is a buffer overflow (CWE-120) located in the /goform/mcr_setSysAdm endpoint. The vulnerability is triggered by manipulating the ChgUserId argument, which passes unsanitized input to a vulnerable strcpy function, requiring low-privileged authenticated access to exploit.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the router, potentially allowing an attacker to gain unauthorized control over network traffic or disrupt communications. Given the CVSS score of 8.8, the risk to business continuity and data confidentiality is high, particularly for organizations relying on these devices for secure network infrastructure.

Remediation Plan

Immediate Action: As no official vendor patch is currently identified, administrators should restrict access to the web management interface to trusted internal networks only. If possible, disable remote management features entirely until a firmware update is released by the manufacturer.

Proactive Monitoring: Monitor device logs for unusual activity associated with the /goform/mcr_setSysAdm endpoint and investigate any unexpected system reboots or service interruptions.

Compensating Controls: Implement a Web Application Firewall (WAF) or network-level access control lists (ACLs) to block malicious payloads directed at the vulnerable management interface.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of bounds checking in the strcpy implementation.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk. Administrators must prioritize isolating affected devices from public-facing networks and monitor for vendor firmware updates, applying them as soon as they become available to remediate the underlying memory corruption flaw.

Description Summary:
The Advanced Views WordPress plugin is vulnerable to Server-Side Template Injection via the Model panel, allowing authenticated attackers with author-level access to execute arbitrary PHP code.

Executive Summary:
An authenticated Server-Side Template Injection vulnerability in the Advanced Views WordPress plugin permits remote code execution, posing a high risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2025-10380

Affected Software: WPLake Advanced Views – Display Posts, Custom Fields, and More

Affected Versions: 0 through 3.7.19

Vulnerability: The vulnerability is a Server-Side Template Injection (CWE-1336) caused by insufficient input sanitization and a lack of access control within the Model panel. Authenticated attackers with author-level privileges or higher can leverage this flaw to execute arbitrary PHP code and commands on the underlying server.

Business Impact

The ability for an attacker to execute arbitrary code on the server represents a critical security failure, as it allows for full system compromise. With a CVSS score of 8.8, this vulnerability enables unauthorized data access, potential lateral movement within the network, and complete loss of server confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the Advanced Views plugin to version 3.7.20 or the latest available release immediately to patch the template injection flaw.

Proactive Monitoring: Monitor server logs for unusual PHP execution patterns or requests directed at the plugin's Model panel functionality.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block suspicious template-related syntax or unauthorized access attempts to administrative plugin endpoints.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the available data.

Analyst Notes: As of September 24, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability requires authenticated access, the impact is severe, and the attack vector is straightforward for a compromised author account.

Analyst Recommendation

Given the potential for remote code execution, organizations using the Advanced Views plugin must prioritize this update. Administrators should verify their plugin version immediately and restrict access to author-level administrative panels to trusted users until the patch is applied.

Description Summary:
A remote improper authorization vulnerability exists in the Shenzhen Sixun Business Management System versions 7 and 11, allowing attackers to manipulate system operators.

Executive Summary:
An improper authorization flaw in the Shenzhen Sixun Business Management System allows unauthenticated remote attackers to manipulate system operations and gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2025-10374

Affected Software: Shenzhen Sixun Business Management System

Affected Versions: 7, 11

Vulnerability: The vulnerability resides in the /Adm/OperatorStop file, which fails to properly enforce authorization checks. This allows an unauthenticated remote attacker to perform unauthorized actions by manipulating the system state.

Business Impact

The exploitation of this flaw can lead to unauthorized operational changes within the business management system, potentially resulting in unauthorized administrative actions or service disruption. Given the CVSS score of 7.3, this is a High severity vulnerability that poses a significant risk to the integrity and availability of managed business processes.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected management interface, specifically the /Adm/ directory, using a firewall or VPN to prevent unauthorized remote access.

Proactive Monitoring: Security teams should monitor server access logs for requests directed at /Adm/OperatorStop and investigate any anomalous traffic patterns originating from unauthorized or external IP addresses.

Compensating Controls: Deploy Web Application Firewall rules to block direct access to the vulnerable endpoint and implement stricter authentication requirements for all administrative paths.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists via the referenced technical write-up.

Analyst Notes: As of September 14, 2025, there is no confirmed active exploitation in the wild, but a published proof of concept exists via the research write-up on Yuque. The lack of authentication requirements for the vulnerable endpoint makes this flaw highly accessible to remote attackers.

Analyst Recommendation

Due to the availability of proof of concept material and the lack of a vendor-provided patch, this vulnerability presents a credible risk to organizations running versions 7 or 11 of the Shenzhen Sixun Business Management System. Administrators must prioritize isolating the vulnerable application from public-facing networks until a formal security update is released and verified.

Description Summary:
A security flaw in eCharge Hardy Barth Salia PLCC devices allows remote, unauthenticated attackers to perform an unrestricted file upload via the setrfidlist argument in api.php.

Executive Summary:
A critical, unauthenticated file upload vulnerability in eCharge Hardy Barth Salia PLCC devices allows remote attackers to execute arbitrary commands on the affected system.

Vulnerability Details

CVE-ID: CVE-2025-10371

Affected Software: eCharge Hardy Barth Salia PLCC

Affected Versions: eCharge Hardy Barth Salia PLCC up to 2.3.81

Vulnerability: This is an unrestricted file upload vulnerability occurring in the /api.php file. An unauthenticated remote attacker can manipulate the setrfidlist argument to upload and execute arbitrary code on the target device.

Business Impact

The vulnerability carries a CVSS score of 7.3, representing a high risk to organizational security. Successful exploitation allows an attacker to achieve remote code execution, which may lead to full device compromise, unauthorized access to internal networks, and potential disruption of industrial charging operations.

Remediation Plan

Immediate Action: As no patch is currently available, administrators should isolate affected Salia PLCC units from the public internet immediately to prevent remote exploitation.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /api.php, particularly those containing JSON payloads with shell commands or unexpected file structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing malicious payloads in the setrfidlist argument and restrict access to the device management interface to trusted IP ranges only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the linked GitHub repository by the vulnerability researcher.

Analyst Notes: As of September 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no authentication and targets a common API endpoint.

Analyst Recommendation

Given the lack of a vendor-supplied patch and the public availability of exploit code, this vulnerability poses a significant threat to affected infrastructure. Organizations must prioritize network segmentation and strict access control to isolate vulnerable devices from external reach until the vendor provides a firmware update.

Description Summary:
Wavlink WL-WN578W2 firmware version 221110 contains an unauthenticated OS command injection vulnerability in the /cgi-bin/wireless.cgi endpoint, allowing remote code execution.

Executive Summary:
An unauthenticated remote command injection vulnerability in the Wavlink WL-WN578W2 wireless range extender poses a critical risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2025-10359

Affected Software: Wavlink WL-WN578W2

Affected Versions: 221110

Vulnerability: The device fails to perform adequate authentication and input sanitization within the /cgi-bin/wireless.cgi script. Specifically, the macAddr parameter is passed directly into system commands, allowing an unauthenticated attacker to execute arbitrary OS commands via a crafted HTTP POST request.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain full control over the affected wireless range extender. This level of access enables the attacker to intercept network traffic, pivot into the internal network, or utilize the device as a persistent foothold for further malicious activity, potentially leading to significant data breaches and network instability.

Remediation Plan

Immediate Action: As no vendor patch is currently available, immediately isolate affected devices from the public internet and restrict access to the device management interface to trusted administrative subnets only.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /cgi-bin/wireless.cgi, specifically monitoring for unusual characters or command strings within the macAddr parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect traffic targeting the /cgi-bin/wireless.cgi endpoint, specifically filtering for command separators such as semicolons or other shell metacharacters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's write-up on GitHub.

Analyst Notes: As of September 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The absence of a vendor-supplied patch necessitates immediate defensive action to prevent exploitation. Organizations should prioritize isolating these devices from external access to mitigate the risk of remote command execution. Security teams must treat this vulnerability as high priority until the manufacturer releases firmware updates to address the underlying injection flaw.

Description Summary:
An unauthenticated OS command injection vulnerability in the Wavlink WL-WN578W2 wireless range extender allows remote attackers to execute arbitrary commands via the delete_list parameter.

Executive Summary:
The Wavlink WL-WN578W2 wireless range extender is vulnerable to unauthenticated remote command injection, posing a critical risk of full device compromise.

Vulnerability Details

CVE-ID: CVE-2025-10358

Affected Software: Wavlink WL-WN578W2

Affected Versions: 221110

Vulnerability: This is an OS command injection vulnerability (CWE-78) residing in the /cgi-bin/wireless.cgi endpoint. An unauthenticated attacker can supply malicious input to the delete_list parameter, which is then concatenated into a system command and executed with root privileges.

Business Impact

Successful exploitation grants an attacker complete control over the affected network device. This allows for unauthorized network access, data exfiltration, or the deployment of the device as a persistent pivot point within the local network infrastructure. Given the CVSS score of 7.3 and the nature of the flaw, this represents a significant security risk to any environment relying on these devices.

Remediation Plan

Immediate Action: As no patch is currently available, immediately isolate the affected Wavlink devices from public-facing network segments or disable the management interface until the vendor releases a firmware update.

Proactive Monitoring: Monitor network traffic for unusual POST requests directed at /cgi-bin/wireless.cgi and audit device logs for evidence of unexpected system commands or unauthorized process execution.

Compensating Controls: Implement strict firewall rules to restrict access to the device management interface to trusted internal IP addresses only. Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing command injection characters, such as semicolons or pipe symbols, within the delete_list parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the technical write-up published on the n0ps1ed GitHub repository.

Analyst Notes: As of September 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication or special privileges.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of authentication required to execute root-level commands makes this a high-priority risk. Administrators should treat these devices as compromised if they have been exposed to the internet and proceed with immediate network isolation until a formal firmware update is provided by Wavlink.

Description Summary:
A critical command injection vulnerability in the Wavlink WL-WN578W2 allows unauthenticated remote attackers to execute arbitrary root commands via the firewall configuration interface.

Executive Summary:
An unauthenticated command injection vulnerability in the Wavlink WL-WN578W2 firmware allows remote attackers to execute arbitrary system commands, posing a severe risk of total device compromise.

Vulnerability Details

CVE-ID: CVE-2025-10324

Affected Software: Wavlink WL-WN578W2

Affected Versions: 221110

Vulnerability: The vulnerability exists within the sub_401C5C function of the firewall.cgi script, where multiple parameters are processed without adequate sanitization. An unauthenticated attacker can send a crafted POST request to the device to inject and execute arbitrary shell commands with root privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected wireless range extender. This level of access enables the attacker to exfiltrate sensitive network traffic, plant persistent backdoors for long-term espionage, or pivot into the internal network. Given the CVSS score of 7.3, this flaw presents a high risk to organizational security, particularly if these devices are deployed in sensitive segments of the corporate infrastructure.

Remediation Plan

Immediate Action: As there is currently no official patch available from the vendor, administrators should immediately restrict access to the device management interface to trusted internal IP addresses only. If possible, disconnect affected devices from the public-facing network segments until a vendor-supplied firmware update is released.

Proactive Monitoring: Monitor firewall and network access logs for suspicious POST requests directed at the /cgi-bin/firewall.cgi endpoint. Look specifically for payloads containing shell metacharacters such as semicolons, ampersands, or pipe symbols.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) rule to inspect and block incoming traffic containing malicious command injection strings targeting the vulnerable firewall configuration parameters.

Exploitation Status

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher write-up on GitHub.

Analyst Notes: As of September 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the ease of injecting commands via the documented endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, this vulnerability must be treated with high urgency. Organizations should prioritize isolating these devices from the network and implementing strict access controls to prevent unauthorized command execution until the vendor provides a remediation path.

Description Summary:
Wavlink WL-WN578W2 firmware version 221110 contains an unauthenticated command injection vulnerability in the sel_EncrypTyp parameter, allowing remote attackers to execute arbitrary system commands.

Executive Summary:
A critical unauthenticated command injection vulnerability in Wavlink WL-WN578W2 firmware allows remote attackers to execute arbitrary commands with root privileges.

Vulnerability Details

CVE-ID: CVE-2025-10323

Affected Software: Wavlink WL-WN578W2

Affected Versions: 221110

Vulnerability: The device fails to properly sanitize user input in the sel_EncrypTyp parameter within the wizard_rep.shtml page, which is processed by the /cgi-bin/adm.cgi endpoint. Because the input filter is insufficient and does not require authentication, an unauthenticated remote attacker can inject system commands that execute with root-level permissions.

Business Impact

Successful exploitation of this vulnerability allows for full device compromise, potentially resulting in unauthorized data exfiltration, the installation of persistent backdoors, or complete loss of network control. Given the CVSS score of 7.3, this represents a significant risk to the integrity and availability of the affected network infrastructure.

Remediation Plan

Immediate Action: As no vendor patch is currently available, disconnect the affected device from the public internet immediately to prevent remote access.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from the device, particularly those originating from the /cgi-bin/adm.cgi endpoint, which may indicate command injection attempts.

Compensating Controls: Restrict access to the device management interface to trusted internal IP addresses only via firewall rules, and disable remote management features to mitigate the risk of unauthenticated exploitation.

Exploitation Status

Public Exploit Available: Yes — a functional proof-of-concept exists as detailed in the technical write-up by n0ps1ed.

Analyst Notes: As of September 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the bypassable nature of the existing input filters.

Analyst Recommendation

This vulnerability presents a severe risk due to the potential for unauthenticated remote code execution with root privileges. Since the vendor has not provided a security update, administrators must prioritize network isolation and the implementation of strict access controls to prevent unauthorized access to the device. Ensure that all management interfaces are inaccessible from untrusted networks until a vendor-supplied firmware fix is applied.

Description Summary:
Mitsubishi Electric FREQSHIP-mini for Windows contains an incorrect default permissions vulnerability, potentially allowing unauthorized local users to gain elevated system privileges.

Executive Summary:
Mitsubishi Electric FREQSHIP-mini for Windows is affected by an incorrect default permissions vulnerability that could allow local attackers to compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2025-10314

Affected Software: Mitsubishi Electric FREQSHIP-mini

Affected Versions: Windows versions 8; See vendor advisory for specific affected versions

Vulnerability: This vulnerability stems from incorrect default permissions within the FREQSHIP-mini software environment. A local, authenticated attacker could exploit these weak access controls to modify sensitive files or escalate privileges on the host Windows system.

Business Impact

A successful exploit of this vulnerability could lead to unauthorized access to industrial communication data or the underlying operating system. Given the CVSS score of 8.8, the risk is high; an attacker with local access could disrupt industrial workflows, compromise data integrity, or facilitate further lateral movement within the corporate network, leading to significant operational downtime.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Mitsubishi Electric for FREQSHIP-mini immediately to correct the file system permissions.

Proactive Monitoring: Review Windows security logs for unauthorized permission changes or unusual account activity originating from local users.

Compensating Controls: Implement the principle of least privilege (PoLP) by restricting local interactive login access to the Windows host to only essential personnel.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the high CVSS score of 8.8 and the critical nature of industrial software, the potential for exploitation remains significant if systems are left unpatched.

Analyst Recommendation

The high severity rating (8.8) necessitates immediate remediation to prevent local privilege escalation. IT and OT administrators should prioritize the deployment of the vendor-supplied security patch to ensure that default permissions are hardened against unauthorized modification.

Description Summary:
The Find And Replace content for WordPress plugin is vulnerable to unauthenticated stored cross-site scripting and arbitrary content replacement due to a missing capability check.

Executive Summary:
The Find And Replace content for WordPress plugin contains an authorization flaw that allows unauthenticated attackers to perform stored cross-site scripting and content manipulation, posing a high risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2025-10313

Affected Software: Jankimoradiya Find And Replace content for WordPress

Affected Versions: 0 through 1.1

Vulnerability: The plugin fails to perform a capability check on the far_admin_ajax_fun function, allowing unauthenticated attackers to execute arbitrary web scripts and perform unauthorized content replacements.

Business Impact

Successful exploitation allows an attacker to inject malicious scripts into pages, which can lead to privilege escalation and unauthorized redirects. Given the CVSS score of 7.2, this vulnerability represents a significant risk to site security and user trust, potentially resulting in complete compromise of site content and visitor sessions.

Remediation Plan

Immediate Action: Since a patched version is currently unknown, administrators should immediately deactivate and remove the Find And Replace content for WordPress plugin from their environment until a secure update is released.

Proactive Monitoring: Monitor server logs for unauthorized access to ajax endpoints and review site content for unexpected modifications or injected script tags.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious traffic targeting WordPress ajax functions, particularly requests that attempt to modify site content without proper authorization.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of October 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of an authorization check in an ajax function makes this flaw inherently easy to exploit, as the attack vector is network-based and does not require authentication.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication for sensitive content modification functions. Organizations must prioritize the removal of the vulnerable plugin immediately to prevent potential exploitation and maintain the integrity of their WordPress installations.

Description Summary:
An authorization bypass vulnerability in Utarit Informatics SoliClub allows unauthenticated remote attackers to access restricted functionality via user-controlled keys.

Executive Summary:
A critical authorization bypass vulnerability in Utarit Informatics SoliClub exposes the application to unauthorized functionality access by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-1031

Affected Software: Utarit Informatics SoliClub

Affected Versions: 5.2.4 up to (excluding) 5.3.7

Vulnerability: This flaw is identified as an Authorization Bypass Through User-Controlled Key (CWE-639). It allows an unauthenticated attacker to manipulate parameters to gain unauthorized access to system functions that should otherwise be restricted.

Business Impact

The ability for an unauthenticated user to bypass authorization controls represents a significant security risk. Successful exploitation could lead to unauthorized access to sensitive application features or data, potentially resulting in data exposure or operational disruption. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to protect the integrity of the affected software.

Remediation Plan

Immediate Action: Administrators should update SoliClub to version 5.3.7 or the latest available version provided by Utarit Informatics.

Proactive Monitoring: Security teams should review application access logs for unusual patterns or attempts to access administrative functions from unauthorized sources.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block malicious traffic patterns attempting to manipulate user-controlled keys or bypass standard authentication flows.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and ease of exploitation over a network.

Analyst Recommendation

Given the high CVSS score and the potential for unauthenticated access to system functionality, organizations utilizing SoliClub must prioritize upgrading to version 5.3.7. Failure to patch creates a clear vector for unauthorized system interaction, and immediate remediation is strongly advised to eliminate this exposure.

Description Summary:
A vulnerability in Utarit Informatics SoliClub allows unauthenticated actors to access private personal information via the query system.

Executive Summary:
An unauthenticated information exposure vulnerability in Utarit Informatics SoliClub poses a significant risk to user data privacy.

Vulnerability Details

CVE-ID: CVE-2025-1030

Affected Software: Utarit Informatics SoliClub

Affected Versions: 5.2.4 up to (excluding) 5.3.7

Vulnerability: This vulnerability involves the exposure of private personal information (CWE-359) through the application query system. The vulnerability is exploitable by an unauthenticated remote attacker with no user interaction required.

Business Impact

The successful exploitation of this flaw allows unauthorized actors to access sensitive private data, leading to potential data breaches, privacy violations, and regulatory non-compliance. With a CVSS score of 7.5, the vulnerability is classified as High severity because it allows for the remote, unauthenticated harvesting of internal information, which could facilitate further targeted attacks against the organization.

Remediation Plan

Immediate Action: Update the SoliClub application to version 5.3.7 or the latest available version provided by the vendor to remediate the exposure.

Proactive Monitoring: Review application access logs for unusual query patterns or spikes in requests directed at the information retrieval endpoints.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the affected query system until the software patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its lack of authentication requirements and its ability to leak sensitive user information directly from the backend system.

Analyst Recommendation

Given the High severity of this information exposure vulnerability, immediate action is required to protect sensitive data. Organizations running affected versions of SoliClub must prioritize upgrading to version 5.3.7 to close this security gap. If an immediate update is not feasible, restrict access to the vulnerable system to prevent unauthorized exploitation.

Description Summary:
The WPBifröst WordPress plugin is vulnerable to privilege escalation because it lacks a capability check on the ctl_create_link AJAX action, allowing authenticated users to create admin accounts.

Executive Summary:
A critical privilege escalation vulnerability in the WPBifröst WordPress plugin allows authenticated attackers to create administrative accounts, potentially leading to a full site compromise.

Vulnerability Details

CVE-ID: CVE-2025-10299

Affected Software: hakik WPBifröst – Instant Passwordless Temporary Login Links

Affected Versions: 0 through 1.0.7

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862) within the ctl_create_link AJAX action. This flaw permits any authenticated user, including those with minimal Subscriber-level access, to execute administrative functions and create new privileged accounts.

Business Impact

The ability for a low-privileged user to escalate their access to administrative status poses a severe threat to business operations. An attacker gaining administrative control can exfiltrate sensitive data, modify website content, or install malicious backdoors. With a CVSS score of 8.8, this vulnerability is classified as High and requires immediate attention to prevent unauthorized system takeover.

Remediation Plan

Immediate Action: As there is no confirmed patched version available at this time, administrators should immediately deactivate and remove the WPBifröst plugin from their WordPress environment until the vendor releases a secure update.

Proactive Monitoring: Security teams should review WordPress user account creation logs and audit administrative user lists for any unauthorized or unrecognized accounts that may have been created recently.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block unauthorized requests to AJAX endpoints, specifically monitoring for anomalous traffic directed at the ctl_create_link function.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ease with which an attacker can bypass authorization to gain full administrative control.

Analyst Recommendation

Given the severity of this privilege escalation flaw, organizations currently utilizing the WPBifröst plugin must treat this as a high-priority risk. Because a patch is not currently confirmed, removal of the plugin is the only effective way to eliminate the exposure. Administrators should audit their WordPress user database immediately to ensure no unauthorized accounts have already been established by malicious actors.

Description Summary:
The OwnID Passwordless Login plugin for WordPress fails to validate authentication secrets, allowing unauthenticated attackers to log in as any user, including administrators.

Executive Summary:
The OwnID Passwordless Login plugin for WordPress contains a critical authentication bypass vulnerability that allows unauthenticated attackers to hijack administrative accounts.

Vulnerability Details

CVE-ID: CVE-2025-10294

Affected Software: victornavarro OwnID Passwordless Login

Affected Versions: 0 through 1.3.4

Vulnerability: The plugin fails to verify if the ownid_shared_secret value is empty before processing JWT authentication, which enables unauthenticated attackers to bypass identity verification and gain unauthorized access to the application.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of exploitation. Successful exploitation grants an attacker full administrative access to the WordPress site, leading to complete system compromise, unauthorized data exfiltration, and potential site defacement or malware injection.

Remediation Plan

Immediate Action: Since a specific patched version is not yet provided, administrators should immediately deactivate and uninstall the OwnID Passwordless Login plugin until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous login patterns or unauthorized access to administrative endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block traffic targeting the plugin's authentication endpoints, though deactivation remains the only guaranteed mitigation at this time.

Exploitation Status

Public Exploit Available: Unknown (no confirmed public exploit exists in the provided data).

Analyst Notes: As of Oct 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the lack of required authentication, making it a prime target for automated scanning tools.

Analyst Recommendation

Given the critical severity of this authentication bypass and the ability for an attacker to gain administrative control without credentials, the risk is severe. We strongly recommend immediate removal of the affected plugin from all production WordPress environments to prevent unauthorized account takeover while awaiting a vendor patch.

Description Summary:
The Keyy Two Factor Authentication plugin for WordPress is susceptible to privilege escalation and account takeover due to improper authentication token validation.

Executive Summary:
A critical authentication bypass flaw in the Keyy Two Factor Authentication plugin allows authenticated attackers to perform account takeovers, including unauthorized administrative access.

Vulnerability Details

CVE-ID: CVE-2025-10293

Affected Software: WordPress Keyy Two Factor Authentication (like Clef) plugin

Affected Versions: 0 through 1.2.3

Vulnerability: The plugin fails to properly validate user identities associated with generated tokens, allowing authenticated users with subscriber-level access or higher to generate tokens and authenticate as other users, including administrators.

Business Impact

Successful exploitation of this vulnerability permits an attacker to gain full control over targeted user accounts, including those with administrative privileges. Given the CVSS score of 8.8, this poses a severe risk of complete system compromise, unauthorized data access, and potential manipulation of the entire WordPress environment, justifying high-priority remediation.

Remediation Plan

Immediate Action: Since a patched version is not explicitly confirmed, administrators should immediately deactivate and remove the Keyy Two Factor Authentication plugin from their WordPress environment until an official security update is released by the vendor.

Proactive Monitoring: Review authentication logs and user activity reports for anomalous login patterns, especially those involving unexpected administrative account access or unusual token generation events.

Compensating Controls: Implement robust multi-factor authentication via alternative, actively maintained plugins and ensure that administrative access is restricted to trusted IP ranges where possible.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on improper token validation makes it a high-value target for attackers looking to escalate privileges within a WordPress installation.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for full administrative account takeover, requires immediate attention. Organizations currently utilizing the Keyy Two Factor Authentication plugin must prioritize its removal to prevent exploitation. Monitor vendor communication channels closely for the release of a secure version before considering re-installation.

Description Summary:
SoliClub contains a hard-coded credentials vulnerability that allows unauthenticated attackers to read sensitive constants within the application executable.

Executive Summary:
A critical hard-coded credential vulnerability in Utarit Information Services Inc SoliClub allows unauthenticated remote attackers to extract sensitive data from the system.

Vulnerability Details

CVE-ID: CVE-2025-1029

Affected Software: Utarit Information Services Inc SoliClub

Affected Versions: 5.2.4 up to (excluding) 5.3.7

Vulnerability: The application is susceptible to a hard-coded credentials flaw, classified as CWE-798, which allows an unauthenticated attacker to access sensitive constants directly. The CVSS vector of AV:N/AC:L/PR:N confirms that this attack requires no authentication and can be performed remotely over a network.

Business Impact

The ability for an unauthenticated actor to read sensitive constants can lead to the exposure of encryption keys, API secrets, or configuration data. Given the CVSS score of 7.5, this represents a high risk to data confidentiality, potentially facilitating further unauthorized access or lateral movement within the network. Such exposure undermines the integrity of the application environment and could lead to significant regulatory and reputational damage.

Remediation Plan

Immediate Action: Administrators must restrict network access to the affected SoliClub instances and contact the vendor to obtain the latest security update to remediate the hard-coded credentials.

Proactive Monitoring: Security teams should monitor network traffic for unauthorized access requests to configuration files or sensitive application endpoints and review system logs for anomalous authentication attempts.

Compensating Controls: Deploy a Web Application Firewall to filter traffic and block suspicious requests targeting sensitive application paths until the official patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication, making it a high priority for remediation despite the absence of known public exploits.

Analyst Recommendation

Due to the nature of hard-coded credentials, this vulnerability poses a severe risk to the confidentiality of sensitive system data. Organizations should prioritize updating their SoliClub installations to version 5.3.7 or higher immediately upon availability from the vendor to eliminate the exposure. Until the patch is verified and applied, implement strict network segmentation to minimize the attack surface.

Description Summary:
The BBOT unarchive module is vulnerable to path traversal when processing malicious archive files, allowing attackers to perform arbitrary file writes and achieve remote code execution.

Executive Summary:
A critical path traversal vulnerability in the BBOT unarchive module enables unauthenticated remote code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-10284

Affected Software: BLSOPS, LLC BBOT

Affected Versions: 0.0.0 through 2.6.1

Vulnerability: This is a path traversal flaw (CWE-22) residing in the unarchive module, which fails to properly sanitize filenames within archive structures. An unauthenticated attacker can supply a specially crafted archive file to trigger arbitrary file writes during the extraction process.

Business Impact

The ability to write files to arbitrary locations on the host system leads to full remote code execution, effectively granting an attacker complete control over the affected environment. Given the CVSS score of 9.6, this vulnerability represents a critical threat that could lead to unauthorized data access, system compromise, and significant operational disruption.

Remediation Plan

Immediate Action: Upgrade the BBOT package to the latest secure version immediately to resolve the path traversal flaw.

Proactive Monitoring: Review system logs for suspicious file system activity, particularly patterns indicating unexpected directory traversal attempts or anomalous file writes in restricted paths.

Compensating Controls: Implement strict input validation for any archive files being processed by the application and ensure the service runs with the least privilege necessary to limit the impact of potential file system writes.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Oct 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires the processing of a malicious file, the potential for remote code execution makes this a high-priority security item.

Analyst Recommendation

Due to the critical nature of this vulnerability, organizations utilizing BBOT must prioritize patching their environments to version 2.6.2 or later. Given the high CVSS severity, failure to address this flaw leaves systems exposed to complete compromise via remote code execution. Apply the update as soon as possible to mitigate the risk of exploitation.