Description Summary:
The gitdumper module in BBOT is vulnerable to a path traversal flaw that allows unauthenticated attackers to achieve remote code execution via a malicious git repository.

Executive Summary:
A critical path traversal vulnerability in the BBOT gitdumper module allows unauthenticated remote attackers to execute arbitrary commands, creating a severe risk of system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10283

Affected Software: BLSOPS, LLC BBOT

Affected Versions: 0.0.0 through 2.6.1

Vulnerability: This vulnerability is caused by an improper limitation of a pathname to a restricted directory (CWE-22) within the gitdumper module. The flaw can be triggered by an unauthenticated attacker who provides a malicious git repository, leading to command execution.

Business Impact

The vulnerability carries a CVSS score of 9.6, indicating a critical severity level. Successful exploitation grants an attacker the ability to execute commands on the host system, which could lead to full system compromise, exfiltration of sensitive data, and potential lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade the BBOT software to a version beyond 2.6.1 as soon as possible to patch the vulnerable gitdumper module.

Proactive Monitoring: Review application logs for unusual repository processing patterns or unexpected command execution attempts originating from the BBOT process.

Compensating Controls: Restrict network access to systems running BBOT and ensure they are isolated from critical infrastructure to minimize the impact of potential command execution.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the Black Lantern Security advisory referenced in the official CVE record.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild. However, given the availability of a published technical write-up detailing the attack vector, the risk of exploitation is elevated and immediate remediation is strongly advised.

Analyst Recommendation

Given the critical CVSS score of 9.6 and the nature of the vulnerability, organizations utilizing BBOT must prioritize this update. The potential for unauthenticated remote code execution makes this an urgent security priority, and failing to patch could lead to total system compromise.

Description Summary:
SailPoint IdentityIQ allows improper Content-Type handling for certain web services, enabling reflected Cross-Site Scripting (XSS) attacks by forcing browsers to interpret non-HTML content as HTML.

Executive Summary:
A Cross-Site Scripting vulnerability in SailPoint IdentityIQ allows authenticated users to potentially execute arbitrary scripts within a user session.

Vulnerability Details

CVE-ID: CVE-2025-10280

Affected Software: SailPoint Technologies IdentityIQ

Affected Versions: 8.5, 8.4 prior to 8.4p4, 8.3 through 8.3p5, and all prior versions

Vulnerability: This vulnerability involves improper neutralization of input during web page generation (CWE-79). Specifically, the application serves non-HTML content via a path that forces a browser to interpret the data as HTML, which allows an authenticated user with low privileges to trigger an XSS attack.

Business Impact

The exploitation of this vulnerability could lead to unauthorized script execution in the context of a victim's session, potentially resulting in session hijacking or the theft of sensitive identity data. With a CVSS score of 7.1, the risk is significant due to the potential for total impact on confidentiality, integrity, and availability if an attacker successfully bypasses security controls.

Remediation Plan

Immediate Action: Upgrade to the latest patched version of IdentityIQ as specified in the official SailPoint security advisory.

Proactive Monitoring: Review web server and application access logs for unusual URL patterns or requests that attempt to force content type rendering.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and sanitize HTTP responses for malicious script injections or unexpected content-type headers.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 4, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is 7.1, the requirement for user interaction and specific authentication levels limits the attack surface, though it remains a critical concern for identity management environments.

Analyst Recommendation

Given the potential for XSS to compromise administrative or user accounts within the identity management ecosystem, administrators should prioritize applying the vendor-supplied patches. Organizations unable to patch immediately should implement strict WAF rules to filter potentially malicious content-type behaviors and restrict access to sensitive web service endpoints.

Description Summary:
A vulnerability in MLflow version 2 could lead to unauthorized access or data manipulation within the machine learning lifecycle platform.

Executive Summary:
MLflow version 2 is affected by a High-severity vulnerability that could allow attackers to compromise machine learning experiments and data.

Vulnerability Details

CVE-ID: CVE-2025-10279

Affected Software: MLflow

Affected Versions: Version 2

Vulnerability: This vulnerability affects MLflow, an open-source platform for the machine learning lifecycle. With a CVSS score of 7.0, the flaw likely involves insecure deserialization, path traversal, or improper access control within the MLflow tracking server or UI.

Business Impact

The compromise of an MLflow instance can lead to the loss or corruption of machine learning models, training parameters, and sensitive datasets. This impacts the integrity of AI-driven decision-making and can result in significant intellectual property theft.

Remediation Plan

Immediate Action: Update MLflow to the latest patched version immediately to address the identified security flaw.

Proactive Monitoring: Audit the MLflow tracking server for unauthorized experiment creation or unexpected modifications to existing model artifacts.

Compensating Controls: Deploy MLflow behind an authentication proxy (like Nginx with OIDC) to ensure that only authorized users can interact with the API and UI.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation. MLflow is a critical tool in the MLOps pipeline, making it a high-value target for industrial espionage.

Analyst Recommendation

Organizations relying on MLflow for their AI workflows must prioritize this update. Applying the latest patch is essential to maintaining the confidentiality and integrity of the machine learning research and deployment pipeline.

Description Summary:
The Spirit Framework WordPress plugin is vulnerable to Local File Inclusion, allowing authenticated attackers with Subscriber-level access to execute arbitrary PHP code on the server.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the Spirit Framework plugin allows authenticated attackers to achieve remote code execution, posing a significant risk to site integrity.

Vulnerability Details

CVE-ID: CVE-2025-10269

Affected Software: Theme-Spirit Spirit Framework

Affected Versions: 0 through 1.2.13

Vulnerability: The plugin suffers from improper control of filenames in include statements, which permits authenticated users with Subscriber-level privileges or higher to include and execute arbitrary PHP files on the host server.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code, which can lead to full site compromise, unauthorized access to sensitive database information, and the potential for lateral movement within the hosting environment. Given the CVSS score of 7.5, this vulnerability represents a substantial security risk that could facilitate data theft or persistent backdoor installation.

Remediation Plan

Immediate Action: As no specific patch version is currently confirmed, administrators should immediately deactivate and remove the Spirit Framework plugin from all WordPress installations until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences or attempts to include unexpected file extensions in plugin-specific directories.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and restrict file system access for the web server process.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the required authentication level is limited to registered users, the impact of arbitrary code execution makes this a high-priority item for remediation.

Analyst Recommendation

Given the potential for remote code execution, this vulnerability should be treated with urgency. Administrators must prioritize the removal or containment of the Spirit Framework plugin to prevent unauthorized access. Monitor vendor communications closely for the release of a patched version before considering re-installation.

Description Summary:
A SQL injection vulnerability in NewType Infortech NUP Portal allows unauthenticated remote attackers to execute arbitrary SQL commands to manipulate database contents.

Executive Summary:
An unauthenticated SQL injection vulnerability in the NewType Infortech NUP Portal poses a critical risk of full database compromise.

Vulnerability Details

CVE-ID: CVE-2025-10266

Affected Software: NewType Infortech NUP Portal

Affected Versions: 0 through SP5.0

Vulnerability: The application fails to properly neutralize special elements used in SQL commands, which allows an unauthenticated remote attacker to inject malicious queries into the backend database. This flaw exists due to improper input validation, enabling unauthorized read, modification, or deletion of sensitive database information.

Business Impact

The potential for unauthorized database manipulation represents a severe threat to data integrity, confidentiality, and availability. With a CVSS score of 9.8, this vulnerability allows for total compromise of the application data layer, which could lead to unauthorized access to user credentials, sensitive business information, or complete system disruption.

Remediation Plan

Immediate Action: Update all instances of the NUP Portal to version SP5.1 or later to resolve the underlying SQL injection vulnerability.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as unexpected SQL syntax or high volumes of query errors that may indicate automated injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns until the application can be patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no public exploit is confirmed, the nature of SQL injection flaws makes them highly susceptible to automated scanning and exploitation.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for unauthenticated remote exploitation, organizations must prioritize patching the NUP Portal to version SP5.1 immediately. Failure to address this flaw leaves the database environment exposed to complete unauthorized control and data exfiltration.

Description Summary:
Digiever NVR devices are vulnerable to OS command injection, which allows authenticated remote attackers to execute arbitrary system commands on the affected hardware.

Executive Summary:
A critical OS command injection vulnerability in Digiever NVR devices allows authenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10265

Affected Software: Digiever NVR

Affected Versions: Digiever DS-1200, DS-2100 Pro, DS-2100 Pro+, DS-2100 UHD, DS-2200 UHD, DS-2200 UHD+ (all versions through *.78)

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) flaw that permits an authenticated remote attacker to bypass input sanitization and execute arbitrary commands with system level privileges.

Business Impact

The ability for an attacker to execute arbitrary OS commands poses a severe risk to organizational security, potentially leading to unauthorized data access, complete system takeover, and the potential for lateral movement within the network. Although the vulnerability requires authentication, the CVSS score of 9.8 reflects the high risk of total system compromise, including loss of confidentiality, integrity, and availability of the NVR and its associated video surveillance data.

Remediation Plan

Immediate Action: Update the NVR firmware to version x.x.x.79 or later immediately to address the underlying injection flaw.

Proactive Monitoring: Review system logs for unusual command execution patterns or unexpected administrative activity originating from authenticated user accounts.

Compensating Controls: Implement strict network segmentation to isolate NVR devices from critical internal infrastructure and deploy a Web Application Firewall (WAF) to inspect traffic for malicious command injection signatures.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 29, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The vulnerability is highly exploitable once an attacker has gained access to a valid user account, making the application of firmware updates a high priority.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for complete system compromise, administrators must prioritize updating all affected Digiever NVR units to the latest firmware release. Ensure that administrative access to these devices is strictly controlled and that only authorized personnel have the credentials necessary to access the management interface.

Description Summary:
Digiever NVRs are vulnerable to an exposure of sensitive information, allowing unauthenticated remote attackers to retrieve system configuration files containing plaintext credentials.

Executive Summary:
A critical vulnerability in Digiever NVR firmware allows unauthenticated remote attackers to extract sensitive system configuration files and plaintext credentials, posing a severe risk to network security.

Vulnerability Details

CVE-ID: CVE-2025-10264

Affected Software: Digiever NVR (DS-1200, DS-2100 Pro, DS-2100 Pro+, DS-2100 UHD, DS-2200 UHD, DS-2200 UHD+)

Affected Versions: 0 through ..*.78

Vulnerability: The device suffers from an exposure of sensitive system information (CWE-497) that permits unauthenticated remote attackers to access configuration files containing credentials for the NVR and connected cameras.

Business Impact

Successful exploitation allows unauthorized parties to obtain administrative credentials for the NVR and attached surveillance hardware. This facilitates complete system compromise, potential lateral movement into the internal network, and the loss of physical security monitoring capabilities. Given the CVSS score of 10.0, this flaw represents a total compromise of system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update the firmware of all affected Digiever NVR models to version x.x.x.79 or later immediately to close the information exposure vector.

Proactive Monitoring: Review system access logs for anomalous requests to configuration files or unexpected administrative login attempts from external IP addresses.

Compensating Controls: If an immediate firmware update is not feasible, isolate the affected NVR devices from public-facing networks using a firewall or VPN to restrict access to authorized management interfaces only.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of Sep 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently documented, the vulnerability is highly automatable, which increases the likelihood of opportunistic scanning by malicious actors.

Analyst Recommendation

This vulnerability is classified as critical due to the ease of access and the sensitivity of the exposed data. Organizations utilizing affected Digiever NVRs must prioritize the deployment of the vendor-provided firmware update. Failure to remediate this issue leaves the entire surveillance infrastructure vulnerable to full administrative takeover by remote, unauthenticated attackers.

Description Summary:
Autodesk Fusion is vulnerable to stored cross-site scripting (XSS) via maliciously crafted HTML payloads, potentially allowing local file access or arbitrary code execution.

Executive Summary:
A stored cross-site scripting vulnerability in Autodesk Fusion creates a high-severity risk of arbitrary code execution or unauthorized local file access.

Vulnerability Details

CVE-ID: CVE-2025-10244

Affected Software: Autodesk Fusion

Affected Versions: 2602.1.25 up to (excluding) 2604.1.25

Vulnerability: This is a stored cross-site scripting (XSS) flaw (CWE-79) triggered when the application renders a maliciously crafted HTML payload. The vulnerability requires an authenticated user with low privileges to interact with the malicious content, which subsequently executes within the context of the current process.

Business Impact

Successful exploitation allows an attacker to bypass standard security boundaries, leading to potential disclosure of sensitive local files or the execution of unauthorized code. Given the CVSS score of 8.7, this is a high-severity threat that could lead to full system compromise if an attacker gains control over the user session. Such an event would result in significant data loss, intellectual property theft, and potential disruption of engineering workflows.

Remediation Plan

Immediate Action: Update the Autodesk Fusion desktop application to version 2604.1.25 or later as specified in the vendor security advisory.

Proactive Monitoring: Review application logs for unusual HTML content or unexpected script execution patterns within the local environment.

Compensating Controls: Ensure that endpoint security solutions are configured to detect and block suspicious child processes spawned by the Autodesk Fusion executable.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 24, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability relies on the successful delivery and rendering of malicious HTML within the user environment.

Analyst Recommendation

This vulnerability represents a significant security risk due to the potential for arbitrary code execution. Administrators should prioritize the deployment of the vendor-provided update across all workstations running the affected versions of Autodesk Fusion to eliminate the attack surface immediately.

Description Summary:
A cross-site scripting (XSS) vulnerability in Progress Flowmon allows an attacker to execute unintended actions within an authenticated user session via a malicious link.

Executive Summary:
Progress Flowmon versions prior to 12.5.5 are susceptible to a cross-site scripting vulnerability that could lead to unauthorized actions within an active user session.

Vulnerability Details

CVE-ID: CVE-2025-10240

Affected Software: Progress Software Flowmon

Affected Versions: Versions prior to 12.5.5

Vulnerability: This is a cross-site scripting (XSS) vulnerability, classified as CWE-79, which occurs when input is improperly neutralized. An unauthenticated attacker can leverage this flaw by tricking an authenticated user into clicking a malicious link, thereby triggering unauthorized actions in the user context.

Business Impact

Successful exploitation of this vulnerability can result in significant security breaches, including session hijacking, unauthorized data modification, or the execution of administrative actions without user consent. Given the CVSS score of 8.8, this flaw poses a high risk to organizational integrity and confidentiality, particularly if the affected users possess elevated privileges within the Flowmon appliance.

Remediation Plan

Immediate Action: Update the Progress Flowmon appliance to version 12.5.5 or later to resolve the underlying input neutralization flaw.

Proactive Monitoring: Review web access logs for suspicious URL parameters or unusual activity originating from external referrers that may indicate attempts to deliver malicious payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to intercept and block malformed requests containing script-based payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 10, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the high CVSS score necessitates prompt patching to prevent potential weaponization.

Analyst Recommendation

Organizations utilizing Progress Flowmon must prioritize the update to version 12.5.5 immediately to mitigate the risk of cross-site scripting attacks. Failure to apply this patch leaves the application and its users vulnerable to session-based compromise, which could be leveraged to gain further access into the management environment.

Description Summary:
A command injection vulnerability in Progress Software Flowmon allows authenticated administrators to execute unauthorized OS commands via troubleshooting scripts.

Executive Summary:
A command injection vulnerability in Progress Software Flowmon, affecting versions prior to 12.5.5, allows authenticated administrators to execute unauthorized system commands.

Vulnerability Details

CVE-ID: CVE-2025-10239

Affected Software: Progress Software Flowmon

Affected Versions: Versions prior to 12.5.5

Vulnerability: This is an OS command injection flaw (CWE-78) occurring within scripts intended for troubleshooting. It requires an attacker to have administrator privileges and access to the management interface to trigger the vulnerability.

Business Impact

The ability to execute arbitrary OS commands poses a severe risk to the integrity and availability of the Flowmon appliance. With a CVSS score of 7.2, this high-severity vulnerability could allow an attacker to gain full control over the management system, leading to potential data exfiltration, lateral movement within the network, or complete service disruption.

Remediation Plan

Immediate Action: Upgrade to Flowmon version 12.5.5 or later as specified in the Progress Software security advisory.

Proactive Monitoring: Review management interface access logs for unusual administrative activity or unexpected execution of system scripts.

Compensating Controls: Restrict access to the management interface to authorized personnel only, utilizing network-level access control lists or VPNs to minimize exposure to untrusted networks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires administrative privileges, the potential for total system compromise makes prompt patching essential for maintaining a secure environment.

Analyst Recommendation

Given the potential for OS command injection, administrators should prioritize updating their Flowmon appliances to version 12.5.5 immediately. Limiting administrative access to the management console remains a critical defense-in-depth strategy to mitigate the risk of unauthorized command execution while the update is being deployed.

Description Summary:
A command injection vulnerability in Samba WINS hook handling allows unauthenticated remote attackers to execute arbitrary commands as the Samba process.

Executive Summary:
A critical command injection vulnerability in Samba allows unauthenticated remote attackers to achieve full system compromise via malicious NetBIOS registration packets.

Vulnerability Details

CVE-ID: CVE-2025-10230

Affected Software: Samba

Affected Versions: 0 up to (excluding) 4.21.9, 4.22.0 up to (excluding) 4.21.5, 4.23.0 up to (excluding) 4.23.2

Vulnerability: This is a command injection flaw (CWE-78) occurring when NetBIOS names from registration packets are passed to a shell without proper validation. The vulnerability is exploitable by an unauthenticated network attacker who can trigger command execution via the WINS hook.

Business Impact

The ability for an unauthenticated attacker to execute remote commands with the privileges of the Samba process poses an extreme risk to organizational infrastructure. This flaw allows for full system takeover, potential data exfiltration, and lateral movement within the network. Given the CVSS score of 10.0, this represents the highest level of severity and requires immediate attention to prevent catastrophic operational disruption.

Remediation Plan

Immediate Action: Update affected Samba installations to versions 4.21.9, 4.21.5 (for the 4.22 branch), or 4.23.2 immediately.

Proactive Monitoring: Monitor network traffic for anomalous NetBIOS registration packets and review system logs for unexpected shell command executions originating from the Samba service.

Compensating Controls: Implement network segmentation to restrict access to WINS services and utilize a Web Application Firewall or Intrusion Detection System to identify and block malformed NetBIOS payloads.

Exploitation Status

Public Exploit Available: Yes, multiple public proof-of-concept repositories exist on GitHub.

Analyst Notes: As of Nov 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of authentication requirements and the direct interaction with system shells.

Analyst Recommendation

This vulnerability is critical and presents a significant risk to any environment running Samba Active Directory Domain Controllers. Organizations must prioritize patching as the primary mitigation strategy. Failure to address this vulnerability promptly leaves systems exposed to trivial remote code execution attacks from unauthenticated network entities.

Description Summary:
Rolantis Information Technologies Agentis is susceptible to a session fixation vulnerability that allows unauthorized attackers to hijack valid user sessions.

Executive Summary:
A high-severity session fixation vulnerability in Rolantis Information Technologies Agentis allows attackers to hijack user sessions, leading to unauthorized account access.

Vulnerability Details

CVE-ID: CVE-2025-10228

Affected Software: Rolantis Information Technologies Agentis

Affected Versions: Agentis: before 4.44

Vulnerability: The application fails to properly regenerate session identifiers after a successful authentication event. This allows an attacker to pre-set a session ID and subsequently hijack the session of an authenticated user, bypassing standard login security controls.

Business Impact

With a CVSS score of 8.8, this flaw represents a major threat to user account security. Successful exploitation allows for complete account takeover, enabling attackers to access sensitive corporate data, perform unauthorized transactions, and impersonate legitimate users within the Agentis platform.

Remediation Plan

Immediate Action: Upgrade Agentis to version 4.44 or later, which addresses the session management flaw.

Proactive Monitoring: Monitor for anomalous session activity, such as a single session ID associated with multiple IP addresses or abnormal login geographic patterns.

Compensating Controls: Enforce short session timeouts and require re-authentication for sensitive actions to limit the window of opportunity for an attacker holding a hijacked session.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of June 7, 2026, public information confirms the existence of exploit methods for this vulnerability. The risk of session hijacking remains high until the patch is applied.

Analyst Recommendation

Session fixation is a critical security oversight that undermines the entire authentication process. Organizations should prioritize updating to version 4.44 to ensure session tokens are securely handled and regenerated upon authentication.

Description Summary:
AxxonSoft Axxon One (C-Werk) versions 2.0.8 and earlier contain a vulnerable PostgreSQL backend, allowing unauthenticated remote attackers to execute arbitrary code or cause denial of service.

Executive Summary:
A critical vulnerability in the AxxonSoft Axxon One PostgreSQL backend allows unauthenticated remote attackers to achieve full system compromise via arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-10226

Affected Software: AxxonSoft Axxon One (C-Werk)

Affected Versions: 2.0.8 and earlier

Vulnerability: The application utilizes a vulnerable third party PostgreSQL component (CWE-1395) that contains multiple known security flaws. An unauthenticated remote attacker can leverage these flaws to escalate privileges or execute arbitrary commands on the underlying host operating system.

Business Impact

The potential for remote code execution represents a total compromise of the affected server, which could lead to unauthorized data exfiltration, lateral movement within the network, or complete operational disruption. Given the CVSS score of 9.8, this vulnerability is classified as critical, requiring immediate attention to prevent exploitation of the insecure database backend.

Remediation Plan

Immediate Action: Upgrade the bundled or external PostgreSQL instance to version 17.4 or later to address the underlying component vulnerabilities.

Proactive Monitoring: Monitor system logs for unusual process spawning or unexpected database connection patterns that deviate from established operational baselines.

Compensating Controls: Deploy a Web Application Firewall or network-based intrusion detection system to filter malicious traffic targeting the database management port until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While there is no confirmed exploit, the nature of the flaw, which involves outdated third party software, makes it highly susceptible to exploitation by opportunistic threat actors.

Analyst Recommendation

This vulnerability presents a severe risk due to the ease of remote exploitation and the potential for full system compromise. Security teams must prioritize upgrading the PostgreSQL component to version 17.4 or later immediately. Failure to address this dependency risk leaves the Axxon One environment exposed to well-documented exploits targeting older database versions.

Description Summary:
AxxonSoft Axxon One VMS 2.0.0 through 2.0.4 contains unmaintained NuGet dependencies, allowing a remote, unauthenticated attacker to execute arbitrary code.

Executive Summary:
AxxonSoft Axxon One VMS is vulnerable to remote code execution due to the use of outdated third-party NuGet components, posing a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-10220

Affected Software: AxxonSoft Axxon One VMS

Affected Versions: 2.0.0 through 2.0.4

Vulnerability: The software utilizes unmaintained third-party NuGet dependencies, including Google.Protobuf and System.Runtime.CompilerServices.Unsafe, which allow an unauthenticated remote attacker to execute arbitrary code or bypass security features.

Business Impact

The reliance on vulnerable third-party components facilitates potential remote code execution, which could lead to a total compromise of the video management system. Given the CVSS score of 9.8, the risk of unauthorized system access, data exfiltration, or complete service disruption is extreme, potentially impacting physical security operations managed by the platform.

Remediation Plan

Immediate Action: Update Axxon One VMS to version 2.0.5 or later, which includes updated and secure versions of the affected NuGet dependencies.

Proactive Monitoring: Monitor server logs for anomalous process execution or unexpected outbound network connections originating from the VMS host.

Compensating Controls: Implement strict network segmentation and restrict access to the VMS management interface to authorized IP ranges via a firewall or VPN to limit the attack surface.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's high exploitability stems from the inherent nature of vulnerable third-party dependencies, which often provide established paths for remote code execution.

Analyst Recommendation

Due to the critical severity of this vulnerability and the potential for remote code execution, organizations must prioritize the update to version 2.0.5 immediately. Failure to patch these dependencies leaves the infrastructure exposed to unauthenticated attackers. Verify that all components have been updated to the specified secure versions to fully remediate the risk.

Description Summary:
ABB FLXEON is susceptible to an improper input validation vulnerability that may lead to significant security compromise.

Executive Summary:
The ABB FLXEON product is affected by an input validation vulnerability that could allow an authenticated attacker with high privileges to cause a total impact on system integrity, confidentiality, and availability.

Vulnerability Details

CVE-ID: CVE-2025-10207

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability, classified as CWE-1287, involves the improper validation of specified input types within the FLXEON software. The vulnerability requires the attacker to possess high privileges (PR:H) to successfully exploit the flaw.

Business Impact

The exploitation of this vulnerability poses a severe risk to operational continuity, as it allows for a total impact on the affected system. Given the CVSS score of 7.2, this vulnerability is categorized as High severity, indicating that successful exploitation could result in unauthorized data access or disruption of critical business processes. Organizations relying on FLXEON for industrial or infrastructure management must prioritize this risk to prevent potential service degradation or unauthorized control.

Remediation Plan

Immediate Action: Consult the official ABB security advisory to identify and apply the necessary firmware or software updates as soon as they become available.

Proactive Monitoring: Monitor system access logs for any unauthorized configuration changes or anomalous activity originating from high-privilege user accounts.

Compensating Controls: Implement strict network segmentation and restrict administrative access to the management interfaces to minimize the attack surface until a patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of September 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires high privileges, the total impact on system resources warrants immediate attention once a vendor patch is released.

Analyst Recommendation

The severity of this flaw requires diligent monitoring of the ABB security portal for the release of a definitive patch. Security teams should ensure that access control lists are hardened to prevent unauthorized high-privilege access, which is a prerequisite for exploiting this vulnerability. Immediate remediation is required upon the release of vendor updates to mitigate the risk of total system compromise.

Description Summary:
ABB FLXEON is susceptible to a vulnerability involving the use of a one-way hash with a predictable salt, potentially compromising credential integrity.

Executive Summary:
A critical security vulnerability in ABB FLXEON allows for the use of predictable salts in cryptographic hashing, which could facilitate unauthorized credential access.

Vulnerability Details

CVE-ID: CVE-2025-10205

Affected Software: ABB FLXEON

Affected Versions: 0 through 9.3.5

Vulnerability: This vulnerability involves the use of a one-way hash with a predictable salt (CWE-759). The vulnerability is unauthenticated (AV:A/PR:N/UI:N), meaning an attacker with adjacent network access can potentially exploit the predictable salt to perform brute-force or dictionary attacks against stored credentials.

Business Impact

The use of predictable salts significantly reduces the computational effort required to reverse password hashes. Successful exploitation could lead to unauthorized access to the FLXEON system, resulting in a complete loss of confidentiality and integrity for user credentials, potentially leading to broader system compromise or unauthorized control. Given the CVSS 8.8 score, this represents a high-severity risk that demands immediate attention to prevent credential harvesting.

Remediation Plan

Immediate Action: Review the provided ABB security advisory (Document ID 9AKK108471A7121) to determine if a patch or configuration workaround is available for your specific deployment version.

Proactive Monitoring: Monitor network traffic for unusual authentication patterns and review system logs for repeated failed login attempts or unauthorized access requests.

Compensating Controls: Ensure that the FLXEON system is isolated within a secure network segment to restrict adjacent network access, thereby limiting the pool of potential attackers.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires adjacent network access, the underlying flaw is inherently dangerous because it undermines the fundamental security of the system authentication mechanism.

Analyst Recommendation

The vulnerability in ABB FLXEON represents a significant risk to credential security due to the predictable nature of the cryptographic salt implementation. Administrators should prioritize reviewing the official ABB documentation to identify if an update is available and implement network-level isolation to mitigate the risk of unauthorized access from adjacent network segments until a permanent resolution can be applied.

Description Summary:
A relative path traversal vulnerability in Digilent WaveForms allows for arbitrary code execution when a user opens a malicious .DWF3WORK file.

Executive Summary:
Digilent WaveForms is vulnerable to arbitrary code execution via a relative path traversal flaw, which can be triggered when a user opens a specially crafted project file.

Vulnerability Details

CVE-ID: CVE-2025-10203

Affected Software: Digilent WaveForms

Affected Versions: 0 through 3.24.3

Vulnerability: The application suffers from a relative path traversal vulnerability (CWE-23) due to improper validation of input within the software. An attacker can achieve arbitrary code execution by tricking a user into opening a malicious .DWF3WORK file, requiring no authentication from the attacker if the user interaction is successful.

Business Impact

The potential for arbitrary code execution poses a severe risk to organizational security, as it could allow an attacker to gain control over the local system where the software is installed. With a CVSS score of 7.8, this vulnerability is classified as High, indicating that successful exploitation could lead to full loss of confidentiality, integrity, and availability on the affected host.

Remediation Plan

Immediate Action: Users should exercise extreme caution when opening .DWF3WORK files from untrusted sources and monitor the vendor support portal for the release of a security patch.

Proactive Monitoring: Security teams should monitor workstation activity for suspicious child processes spawned by the WaveForms application and review access logs for unexpected file interactions.

Compensating Controls: Implement endpoint protection policies that restrict the execution of untrusted files and utilize file integrity monitoring to detect unauthorized modifications to application directories.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of September 16, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw relies on social engineering, as it requires a user to interact with a malicious file to trigger the underlying path traversal mechanism.

Analyst Recommendation

Given the potential for arbitrary code execution, this vulnerability represents a significant risk to end-user workstations. Organizations should prioritize updating Digilent WaveForms as soon as the vendor issues a patch and should advise users to avoid opening .DWF3WORK files received from unverified or suspicious external parties until remediation is applied.

Description Summary:
A vulnerability in the Mojo component of Google Chrome allows remote attackers to bypass site isolation protections via a crafted HTML page.

Executive Summary:
Google Chrome versions prior to 140.0.7339.127 contain an implementation flaw in the Mojo component that permits remote attackers to bypass site isolation, creating a high risk of cross-site data exposure.

Vulnerability Details

CVE-ID: CVE-2025-10201

Affected Software: Google Chrome

Affected Versions: Versions prior to 140.0.7339.127

Vulnerability: This is an inappropriate implementation vulnerability within the Mojo inter-process communication system. An unauthenticated remote attacker can exploit this flaw by enticing a user to navigate to a specifically crafted HTML page to bypass site isolation security boundaries.

Business Impact

The ability to bypass site isolation poses a significant threat to browser-based security, as it allows malicious sites to potentially access data belonging to other origins. Given the CVSS score of 8.8, this vulnerability is considered High severity, as it undermines the fundamental security architecture designed to protect sensitive user information and session integrity.

Remediation Plan

Immediate Action: Update Google Chrome to version 140.0.7339.127 or later across all affected platforms, including Android, Linux, and ChromeOS.

Proactive Monitoring: Review security logs for unusual browser activity or frequent navigation errors that might indicate an attempt to trigger site isolation failures.

Compensating Controls: While no direct virtual patch exists, ensuring that the browser is kept up to date via centralized policy management is the primary defense against this class of exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's reliance on user interaction to facilitate the bypass somewhat limits its utility in automated mass-exploitation campaigns.

Analyst Recommendation

Organizations should prioritize the deployment of the Chrome 140 update immediately. Because this vulnerability targets the core site isolation mechanism of the browser, failure to patch leaves users vulnerable to sophisticated cross-site data theft attacks that are difficult to detect through traditional endpoint monitoring.

Description Summary:
A use after free vulnerability in the Google Chrome Serviceworker component allows a remote attacker to trigger heap corruption via a specially crafted HTML page.

Executive Summary:
A critical use after free vulnerability in Google Chrome allows remote attackers to trigger heap corruption, potentially leading to arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-10200

Affected Software: Google Chrome

Affected Versions: Google Chrome versions prior to 140.0.7339.127

Vulnerability: This is a use after free flaw (CWE-416) within the Serviceworker component of Google Chrome. It requires no specific authentication (unauthenticated) but does require user interaction, such as visiting a malicious web page.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for high impact on system integrity and confidentiality. Successful exploitation could allow a remote attacker to corrupt heap memory, which often serves as a precursor to remote code execution or application crashes, thereby threatening both organizational data security and end user productivity.

Remediation Plan

Immediate Action: Update Google Chrome to version 140.0.7339.127 or later across all managed desktop environments.

Proactive Monitoring: Monitor endpoint logs for unusual browser crashes or unexpected process behavior associated with the Chrome executable.

Compensating Controls: Utilize endpoint protection platforms to block access to known malicious domains and ensure that browser security settings, such as site isolation, are strictly enforced via group policy.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation in the wild. The existence of a public proof-of-concept repository necessitates that this vulnerability be treated with urgency, as it lowers the barrier for potential attackers to develop functional exploits.

Analyst Recommendation

Given the critical severity of heap corruption vulnerabilities in web browsers, immediate patching is required. IT administrators should prioritize the deployment of the updated Chrome version to all workstations to neutralize the risk of remote exploitation via malicious web content.

Description Summary:
LizardByte Sunshine for Windows contains an unquoted service path vulnerability that allows a local user to escalate privileges to administrative levels.

Executive Summary:
A local privilege escalation vulnerability in LizardByte Sunshine for Windows poses a significant risk to system integrity by allowing low-privileged users to gain administrative control.

Vulnerability Details

CVE-ID: CVE-2025-10199

Affected Software: LizardByte Sunshine

Affected Versions: v2025.122.141614 and likely prior versions

Vulnerability: The application utilizes an unquoted service path, which is a flaw where the system search path for an executable is not properly delimited. This allows an authenticated low-privileged attacker to place a malicious executable in a parent directory, which the service will then execute with elevated privileges.

Business Impact

Successful exploitation of this vulnerability grants an attacker full administrative access to the affected Windows host. This facilitates complete system compromise, including the ability to install persistent backdoors, exfiltrate sensitive data, or disrupt business operations, justifying the high CVSS score of 7.8.

Remediation Plan

Immediate Action: Administrators should review the official LizardByte GitHub security advisory for the latest version and apply the recommended update as soon as it is released.

Proactive Monitoring: Monitor system logs for the creation of unexpected executable files within the service installation directory or any parent directories in the system search path.

Compensating Controls: Ensure that directory permissions are strictly enforced on the affected installation path to prevent unauthorized users from creating or modifying files in those locations.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown).

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any local user with basic file system write access to the application directory.

Analyst Recommendation

Given the potential for full system compromise, this vulnerability represents a high-priority risk for Windows environments hosting the Sunshine service. Organizations should verify their current deployment version immediately and restrict local user permissions on the installation directory until a vendor-supplied patch can be implemented.

Description Summary:
LizardByte Sunshine for Windows is vulnerable to DLL search-order hijacking, which allows attackers to execute malicious code via user-writable directories in the system PATH.

Executive Summary:
A DLL search-order hijacking vulnerability in LizardByte Sunshine for Windows, version v2025.122.141614, permits local attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-10198

Affected Software: LizardByte Sunshine

Affected Versions: v2025.122.141614

Vulnerability: The software fails to properly restrict the search path for dynamically linked libraries. This allows an attacker with local access to place a malicious DLL into a directory within the application search path, leading to code execution when the application initializes.

Business Impact

The exploitation of this vulnerability results in a total compromise of the affected system, as the attacker can execute code with the privileges of the application process. With a CVSS score of 7.8, this flaw represents a significant risk to data integrity and system availability, potentially facilitating lateral movement within the network if the affected host is a critical workstation or server.

Remediation Plan

Immediate Action: Users should restrict write permissions on directories present in the system PATH to prevent unauthorized placement of malicious DLL files. Monitor vendor communication channels for the release of an official patch to address the underlying search path logic.

Proactive Monitoring: Security teams should monitor file integrity on system directories and audit the system PATH for unexpected or user-writable entries. Alerting on the execution of unsigned or suspicious DLLs loaded by the Sunshine process is recommended.

Compensating Controls: Implement Endpoint Detection and Response (EDR) solutions to detect and block unauthorized DLL loading attempts. Ensure that least-privilege principles are applied to user accounts to limit the ability to modify system-level paths.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any local user capable of writing to directories indexed in the system PATH, making it a viable vector for privilege escalation.

Analyst Recommendation

Given the potential for total system compromise, administrators should prioritize hardening the environment by restricting directory permissions for standard users. While a specific patch version remains unconfirmed in the provided data, users must track the LizardByte repository for updates and apply them immediately upon release to remediate the insecure path handling.

Description Summary:
A blind XML External Entity (XXE) injection in the OpenMessaging webservice of TecCom TecConnect 4.1 allows unauthenticated attackers to exfiltrate arbitrary files.

Executive Summary:
A critical XXE vulnerability in TecCom TecConnect 4.1 allows unauthenticated attackers to exfiltrate sensitive system files, posing a severe risk to data confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-10183

Affected Software: TecCom TecConnect

Affected Versions: 4.1

Vulnerability: This vulnerability is an XML External Entity (XXE) injection (CWE-611) occurring within the OpenMessaging webservice. It allows an unauthenticated remote attacker to perform unauthorized file reads by injecting malicious XML input.

Business Impact

The ability to exfiltrate arbitrary files from the host server can lead to the exposure of configuration files, credentials, or sensitive business data. Given the CVSS score of 9.1, this vulnerability presents a high risk of total system compromise or information disclosure, potentially leading to further lateral movement within the network.

Remediation Plan

Immediate Action: Contact the vendor for the latest security patch or update guidance, as a specific patch version is not currently listed.

Proactive Monitoring: Monitor network traffic for unusual XML payloads targeting the OpenMessaging webservice and review server access logs for anomalous file read requests.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block XML entities and DTD declarations in incoming web requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Due to the critical severity and the existence of a proof-of-concept, organizations running TecCom TecConnect 4.1 must prioritize mitigation. If a vendor patch is unavailable, restrict network access to the affected webservice immediately to prevent unauthorized exploitation.

Description Summary:
The Plugin Archiver WordPress plugin contains a path traversal vulnerability in the prepare_items function, allowing authenticated administrators to delete arbitrary files on the server.

Executive Summary:
A high-severity path traversal vulnerability in the Plugin Archiver WordPress plugin allows authenticated administrators to perform arbitrary file deletion, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-10176

Affected Software: The Hack Repair Guy Plugin Archiver

Affected Versions: 0 through 2.0.4

Vulnerability: The plugin fails to properly validate file paths within the prepare_items function, enabling an authenticated attacker with Administrator-level access to delete sensitive system files. This vulnerability leverages path traversal techniques to target critical configuration files, such as wp-config.php.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to system integrity and availability. By deleting critical application files, an attacker can achieve remote code execution, compromise administrative credentials, or cause complete site downtime. With a CVSS score of 7.2, the vulnerability is classified as High, reflecting the significant impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Since no official patch is currently available, immediately deactivate and remove the Plugin Archiver plugin from all WordPress installations until a secure update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the plugin directory and monitor for unexpected file system modifications or sudden service interruptions.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts, and ensure strict file system permissions are enforced to limit the impact of potential deletions.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of September 15, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation and remote code execution, though it is mitigated by the requirement for Administrator-level access.

Analyst Recommendation

Given the high CVSS score and the catastrophic potential for remote code execution via file deletion, organizations must prioritize the removal of this plugin. Until the vendor provides a verified security update, the safest course of action is to eliminate the attack surface entirely by uninstalling the affected component.

Description Summary:
PanCafe Pro is vulnerable to cleartext transmission of sensitive information, which may allow an attacker to intercept sensitive data or perform flooding attacks.

Executive Summary:
A high-severity cleartext transmission vulnerability in PanCafe Pro poses a significant risk of data interception and service disruption.

Vulnerability Details

CVE-ID: CVE-2025-10174

Affected Software: Pan Software & Information Technologies Ltd, PanCafe Pro

Affected Versions: < 3.3.2 through 23092025

Vulnerability: The application is susceptible to CWE-319, which involves the transmission of sensitive information in cleartext. Per the CVSS vector (AV:A/PR:N/UI:N), the vulnerability can be triggered by an unauthenticated attacker positioned on the local network.

Business Impact

The lack of encryption for sensitive data streams can lead to the compromise of credentials or administrative information, potentially resulting in unauthorized access to the application. Given the CVSS score of 8.3, this flaw presents a high risk to organizational security, as it facilitates both information disclosure and the potential for service-impacting flooding attacks.

Remediation Plan

Immediate Action: Consult the official vendor security advisories from the National Cyber Security Directorate of Turkey for specific patch instructions or configuration changes to enable encryption.

Proactive Monitoring: Monitor network traffic for unusual patterns or high-volume data transmissions that may indicate a flooding attack or unauthorized interception attempts.

Compensating Controls: Implement network-level segmentation to restrict access to the PanCafe Pro server, and utilize a Virtual Private Network (VPN) or IPsec tunnel to encrypt traffic if native application encryption is currently unavailable.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ability to be triggered by unauthenticated actors on the local network segment.

Analyst Recommendation

Organizations utilizing PanCafe Pro must prioritize assessing their network exposure to this vulnerability. Because the flaw allows for both sensitive data interception and service flooding, administrators should restrict network access to the software until official patches are applied to ensure all communications are properly encrypted.

Description Summary:
A buffer overflow vulnerability in the UTT Jinqi 750W router allows remote attackers to trigger a denial of service via the importpictureurl parameter in the /goform/formPictureUrl endpoint.

Executive Summary:
The UTT Jinqi 750W router is vulnerable to a remotely exploitable buffer overflow that can lead to a complete denial of service.

Vulnerability Details

CVE-ID: CVE-2025-10172

Affected Software: UTT Jinqi 750W

Affected Versions: UTT 750W: 3.2.2-191225

Vulnerability: This memory corruption flaw exists within the /goform/formPictureUrl endpoint. An authenticated attacker can send a crafted request containing an oversized payload in the importpictureurl parameter to trigger a buffer overflow, resulting in a system crash.

Business Impact

Successful exploitation of this vulnerability results in a denial of service, rendering the network appliance unresponsive and disrupting all traffic routed through the device. Given the CVSS score of 8.8, this represents a high-severity risk to business continuity, as routers are critical infrastructure for network connectivity and security enforcement.

Remediation Plan

Immediate Action: Since the vendor has not provided a patch, restrict access to the web management interface to trusted administrative IP addresses only. Disable remote management features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for unusual POST requests directed at the /goform/formPictureUrl endpoint. Watch for unexpected system restarts or periods of device unavailability that may indicate crash attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with custom signatures to inspect and block excessively long strings sent to the importpictureurl parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exploit is available via the researcher's published write-up on GitHub.

Analyst Notes: As of September 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it involves a classic stack-based buffer overflow via an insecure strcpy function call.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the availability of a functional proof-of-concept, this vulnerability poses a significant risk to network stability. Administrators should immediately isolate the management interface of affected UTT routers from untrusted networks and implement strict access control lists to prevent unauthorized access until a firmware update is released.

Description Summary:
A buffer overflow vulnerability exists in the UTT Jinqi 1250GW router, specifically within the formConfigApConfTemp function, which may allow for remote denial of service.

Executive Summary:
A buffer overflow vulnerability in the UTT Jinqi 1250GW router allows an authenticated attacker to trigger a denial of service condition via the administrative configuration interface.

Vulnerability Details

CVE-ID: CVE-2025-10171

Affected Software: UTT Jinqi 1250GW

Affected Versions: <=3.2.2-200710

Vulnerability: This memory corruption flaw is caused by improper handling of input within the sub_453DC function of the /goform/formConfigApConfTemp endpoint. An attacker with administrative credentials can trigger a buffer overflow by sending a maliciously crafted POST request to the configuration interface.

Business Impact

Successful exploitation of this vulnerability results in a denial of service, rendering the affected network router unresponsive. Given the device's role as a network gateway, this leads to significant business disruption, loss of connectivity for internal systems, and potential requirements for manual hardware reboots. While the CVSS score of 8.8 indicates a high severity, the impact is primarily focused on availability rather than remote code execution.

Remediation Plan

Immediate Action: As there is currently no vendor-provided patch, administrators should restrict access to the management interface to trusted IP addresses only and ensure that administrative credentials are complex and unique.

Proactive Monitoring: Monitor system logs for repeated crashes of the management service or unauthorized attempts to access the /goform/formConfigApConfTemp endpoint.

Compensating Controls: Deploy a Web Application Firewall or network access control list to filter traffic to the router management interface, specifically blocking large or malformed POST requests to the identified vulnerable path.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of September 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform bounds checking during the string copy operation within the configuration function.

Analyst Recommendation

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, users of the UTT Jinqi 1250GW should prioritize isolating the management interface from the public internet. Organizations must verify their firmware versions and apply any future security updates from the vendor as soon as they become available to remediate the underlying memory corruption flaw.

Description Summary:
The UTT Jinqi 1200GW router contains a buffer overflow vulnerability in the formApLbConfig handler, allowing remote attackers to trigger memory corruption via the loadBalanceNameOld parameter.

Executive Summary:
A buffer overflow vulnerability in the UTT Jinqi 1200GW router, reachable via the web interface, poses a significant risk of service disruption or potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-10170

Affected Software: UTT Jinqi 1200GW

Affected Versions: 3.0.0-170831 and prior

Vulnerability: The vulnerability exists within the sub_4B48F8 function, which fails to perform bounds checking when processing the loadBalanceNameOld argument during an add action on the /goform/formApLbConfig endpoint. This flaw requires the attacker to be authenticated as a user with sufficient privileges to access the configuration form.

Business Impact

Successful exploitation of this buffer overflow can lead to a denial of service, effectively taking the router offline and disrupting network connectivity for all dependent systems. Given the CVSS score of 8.8, the vulnerability is considered high severity, as memory corruption flaws frequently provide a pathway for an attacker to execute arbitrary code with the privileges of the web service, leading to full device compromise.

Remediation Plan

Immediate Action: As the vendor has not provided a patch, administrators should restrict access to the management interface to trusted internal networks only. If possible, disable the affected configuration features or the web management interface entirely until a firmware update is released.

Proactive Monitoring: Monitor device logs for repeated or suspicious POST requests to the /goform/formApLbConfig endpoint. Investigate any unexpected device reboots or service instability that may indicate a crash caused by an exploitation attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) or an intrusion detection system to filter traffic containing excessively long strings in the loadBalanceNameOld parameter. Ensure that the router management interface is never exposed to the public internet.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept has been published in the technical write-up provided by the researchers at Guangzhou University.

Analyst Notes: As of September 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the underlying code uses the unsafe strcat function on an unbounded destination buffer.

Analyst Recommendation

Given the lack of a vendor-supplied patch and the availability of a public proof-of-concept, users must prioritize the isolation of the management interface. Organizations using the UTT Jinqi 1200GW should move immediately to restrict administrative access and apply non-vendor mitigations to reduce the attack surface until official firmware updates are made available.

Description Summary:
A buffer overflow vulnerability in the UTT Jinqi 1200GW router allows an authenticated attacker to trigger memory corruption via the ssid parameter in the /goform/ConfigWirelessBase endpoint.

Executive Summary:
A buffer overflow vulnerability in the UTT Jinqi 1200GW router enables an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-10169

Affected Software: UTT Jinqi 1200GW

Affected Versions: UTT 1200GW: 3.0.0-170831

Vulnerability: The vulnerability exists within the /goform/ConfigWirelessBase endpoint, where improper handling of the ssid parameter leads to a buffer overflow via an unsafe strcpy operation. This flaw requires the attacker to be authenticated to the device.

Business Impact

Successful exploitation of this vulnerability can result in a denial of service, rendering the router unresponsive and disrupting network connectivity for all dependent users and systems. Given the CVSS score of 8.8, this poses a significant risk to network availability and operational continuity. Unauthorized manipulation of core network infrastructure may also provide a foothold for further malicious activity within the internal environment.

Remediation Plan

Immediate Action: As the vendor has not provided a patch, immediately restrict access to the device management interface to trusted administrative IP addresses only.

Proactive Monitoring: Monitor device logs for repeated authentication attempts or unusual POST requests directed at the /goform/ConfigWirelessBase endpoint.

Compensating Controls: Implement an Access Control List (ACL) on the management interface to prevent unauthorized access and utilize a Web Application Firewall (WAF) to inspect and block malformed ssid parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher write-up on GitHub.

Analyst Notes: As of September 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform bounds checking on user supplied input before copying it into fixed size memory buffers.

Analyst Recommendation

The severity of this memory corruption vulnerability necessitates immediate defensive action, particularly as a proof-of-concept is publicly available. Organizations utilizing the UTT Jinqi 1200GW should enforce strict network segmentation and administrative access controls while awaiting a formal vendor security update.

Description Summary:
The OrderConvo WordPress plugin is vulnerable to an unauthenticated path traversal attack, allowing remote attackers to read or download arbitrary files from the server.

Executive Summary:
The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin contains a critical path traversal vulnerability that allows unauthenticated attackers to access sensitive system files.

Vulnerability Details

CVE-ID: CVE-2025-10162

Affected Software: WordPress Admin and Customer Messages After Order for WooCommerce: OrderConvo

Affected Versions: 0 up to 14 (excluding 14)

Vulnerability: The plugin fails to perform adequate path validation on file download requests, which allows an unauthenticated attacker to traverse the directory structure and access arbitrary files on the underlying server.

Business Impact

This vulnerability poses a significant risk to data confidentiality, as unauthorized access to sensitive system files, configuration files, or database credentials could lead to a total compromise of the web application. With a CVSS score of 7.5, the flaw is classified as High severity, reflecting the ease with which an unauthenticated actor can extract information. Successful exploitation may result in intellectual property theft, unauthorized data exposure, and potential escalation to full system compromise.

Remediation Plan

Immediate Action: Update the Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin to version 14 or later immediately.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal sequences, such as "../" or "..".

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeting WordPress plugin endpoints.

Exploitation Status

Public Exploit Available: Yes, a public exploit is available via ExploitDB, a GitHub repository, and a Nuclei detection template.

Analyst Notes: As of October 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of weaponized exploit code in public databases significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

The combination of an unauthenticated attack vector and the availability of public exploit code makes this vulnerability an urgent priority. Administrators must prioritize updating the plugin to version 14 or higher across all affected environments to eliminate this exposure. If an update cannot be applied immediately, consider disabling the plugin until a patch is verified to prevent potential data exfiltration.

Description Summary:
An authentication bypass vulnerability in Sophos AP6 Series Wireless Access Points before firmware 1.7.2563 (MR7) allows remote attackers to gain administrative privileges.

Executive Summary:
A critical authentication bypass in Sophos AP6 Series Wireless Access Points allows remote, unauthenticated attackers to gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2025-10159

Affected Software: Sophos AP6 Series Wireless Access Points

Affected Versions: Older than 1.7.2563 (MR7)

Vulnerability: This is an authentication bypass vulnerability that permits remote, unauthenticated attackers to gain administrative privileges on the device. This effectively grants an attacker full control over the wireless access point configuration and management.

Business Impact

With a CVSS score of 9.8, this vulnerability represents an imminent threat to network integrity. An attacker gaining administrative access could intercept traffic, reconfigure network settings, or pivot into the internal network, leading to widespread unauthorized access and severe operational disruption.

Remediation Plan

Immediate Action: Update all Sophos AP6 Series Wireless Access Points to firmware version 1.7.2563 (MR7) or later immediately.

Proactive Monitoring: Review management logs for unauthorized login attempts or configuration changes originating from unknown source IP addresses.

Compensating Controls: Restrict administrative access to the access points to a dedicated, isolated management VLAN that is not accessible from the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Sep 9, 2025, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this flaw requires immediate attention, as it provides a direct path to administrative control of network infrastructure. Administrators should treat this as a high-priority update to prevent potential remote compromise of the wireless environment.

Description Summary:
The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the move_as_original_file function, potentially leading to remote code execution.

Executive Summary:
A critical vulnerability in the Podlove Podcast Publisher plugin allows unauthenticated attackers to upload arbitrary files, creating a severe risk of remote code execution on the host server.

Vulnerability Details

CVE-ID: CVE-2025-10147

Affected Software: eteubert Podlove Podcast Publisher

Affected Versions: 0 through 4.2.6

Vulnerability: This flaw is caused by missing file type validation in the move_as_original_file function (CWE-434). Because the vulnerability does not require authentication, any remote attacker can upload malicious scripts to the server.

Business Impact

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code on the underlying web server. This leads to a complete compromise of the WordPress environment, potential exfiltration of sensitive site data, and the ability to pivot into the internal network. Given the CVSS score of 9.8, this is categorized as a critical risk requiring immediate remediation.

Remediation Plan

Immediate Action: Update the Podlove Podcast Publisher plugin to the latest available version beyond 4.2.6 to incorporate necessary file type validation checks.

Proactive Monitoring: Review web server access logs for requests targeting image or media upload endpoints that originate from suspicious IP addresses or contain unexpected file extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized or suspicious file upload requests to the plugin directory until the software can be patched.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/ghostpel-sec/CVE-2025-10147).

Analyst Notes: As of Sep 23, 2025, there is no public information indicating active exploitation in the wild. However, the presence of a public proof-of-concept and the trivial nature of the attack vector mean that the risk of exploitation is high.

Analyst Recommendation

The critical severity of this vulnerability, combined with the lack of authentication required for exploitation, necessitates an immediate update. Security teams should prioritize patching this plugin across all WordPress instances to prevent potential server compromise. If an immediate update is not feasible, the plugin should be deactivated until a secure version is deployed.

Description Summary:
The Auto Featured Image plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 4.

Executive Summary:
The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery, which may allow an attacker to perform unauthorized requests from the server.

Vulnerability Details

CVE-ID: CVE-2025-10145

Affected Software: WordPress Auto Featured Image (Auto Post Thumbnail) plugin

Affected Versions: 4 and earlier

Vulnerability: The plugin contains an SSRF vulnerability that enables an attacker to force the web server to make unauthorized requests to internal or external resources. This flaw typically occurs due to improper validation of user-supplied URLs passed to the plugin functionality.

Business Impact

A successful exploit could allow an attacker to bypass firewalls, interact with internal services that are not exposed to the internet, or perform port scanning on the local network. Given the CVSS score of 7.7, this vulnerability is classified as High severity and poses a significant risk to the confidentiality and integrity of the internal network infrastructure.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate and remove the Auto Featured Image (Auto Post Thumbnail) plugin from their WordPress environment until a secure update is released by the vendor.

Proactive Monitoring: Monitor server logs for suspicious outbound requests to internal IP addresses or unusual traffic patterns originating from the web server.

Compensating Controls: Implement an egress filtering policy on the web server to restrict outbound connections to only necessary and known-safe destinations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 29, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are inherently dangerous in cloud environments or restricted networks because they serve as a pivot point for further lateral movement.

Analyst Recommendation

Due to the lack of a confirmed patch, the most effective security posture is to discontinue the use of the affected plugin immediately. Administrators should audit their WordPress installations to identify if this plugin is present and prioritize its removal to eliminate the SSRF attack surface. If the functionality is critical, verify the vendor site for any newly released security updates before reinstating the software.

Description Summary:
The Catch Dark Mode plugin for WordPress is susceptible to Local File Inclusion via the catch_dark_mode shortcode, allowing authenticated attackers to execute arbitrary PHP code on the server.

Executive Summary:
The Catch Dark Mode plugin for WordPress contains a critical Local File Inclusion vulnerability that allows authenticated attackers with Contributor-level access to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-10143

Affected Software: Catch Themes Catch Dark Mode

Affected Versions: 0 through 2.0

Vulnerability: This vulnerability is a Local File Inclusion flaw (CWE-98) triggered via the catch_dark_mode shortcode. It requires an attacker to have at least Contributor-level authentication to leverage the plugin for unauthorized file inclusion and execution.

Business Impact

The ability to include and execute arbitrary PHP files poses a severe risk to the integrity and confidentiality of the entire WordPress installation. With a CVSS score of 7.5, this high-severity flaw enables attackers to bypass access controls, exfiltrate sensitive database information, or gain full system control. Such compromises often lead to site defacement, the installation of backdoors, and significant reputational damage.

Remediation Plan

Immediate Action: Update the Catch Dark Mode plugin to the latest available version provided by Catch Themes. If an update is not immediately available, deactivate and remove the plugin from the WordPress environment until a patched version is verified.

Proactive Monitoring: Review web server access logs for unusual requests containing directory traversal sequences or attempts to access non-standard PHP files. Monitor user accounts with Contributor permissions for suspicious activity or unauthorized configuration changes.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and restrict access to sensitive file paths. Ensure that the WordPress file system permissions follow the principle of least privilege to limit the impact of file inclusion attempts.

Exploitation Status

Public Exploit Available: No (the provided enrichment indicates no confirmed public exploit).

Analyst Notes: As of September 18, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the ability to execute arbitrary code, necessitating prompt remediation despite the lack of current exploitation reports.

Analyst Recommendation

Given the potential for remote code execution within the WordPress ecosystem, this vulnerability represents a significant security risk. Administrators should prioritize updating the Catch Dark Mode plugin immediately to eliminate the exposure. If the plugin is not essential for site operations, removal is the most effective way to permanently mitigate this risk.

Description Summary:
The Goza WordPress theme is vulnerable to unauthenticated arbitrary file deletion due to insufficient path validation in the alone_import_pack_restore_data() function.

Executive Summary:
An unauthenticated arbitrary file deletion vulnerability in the Goza WordPress theme allows remote attackers to delete critical server files, potentially leading to remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-10134

Affected Software: Bearsthemes Goza - Nonprofit Charity WordPress Theme

Affected Versions: Up to and including 3.2.2

Vulnerability: This flaw exists within the alone_import_pack_restore_data() function, which fails to properly validate file paths provided by users. An unauthenticated attacker can exploit this to delete arbitrary files on the hosting server, including sensitive configuration files like wp-config.php.

Business Impact

The ability for an unauthenticated attacker to delete critical system files presents a severe risk to business continuity and data integrity. Deleting core WordPress configuration files can force a site reset, enabling an attacker to reconfigure the application and achieve remote code execution. Given the CVSS score of 9.1, this vulnerability is classified as critical and requires immediate intervention to prevent total system compromise.

Remediation Plan

Immediate Action: There is no official patch currently available; users should immediately deactivate and remove the Goza theme if it is not strictly necessary for site operations.

Proactive Monitoring: Security teams should monitor server access logs for unusual requests targeting the theme import or restoration endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to theme-specific administrative or import functions.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of September 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for the vulnerable function.

Analyst Recommendation

The vulnerability in the Goza theme represents a critical security gap that could lead to full server compromise. Because an unauthenticated attacker can trigger the deletion of essential files, administrators must treat this as a high-priority issue. If a vendor update is released, apply it immediately, and maintain strict access controls on all WordPress administrative interfaces in the interim.

Description Summary:
Daikin Europe N.V Security Gateway is susceptible to an authorization bypass caused by a user-controlled key, permitting unauthenticated access to the system.

Executive Summary:
The Daikin Security Gateway contains a critical authorization bypass vulnerability that allows unauthenticated attackers to gain unauthorized access to the device.

Vulnerability Details

CVE-ID: CVE-2025-10127

Affected Software: Daikin Europe N.V Security Gateway

Affected Versions: App: 100, Frm: 214

Vulnerability: This vulnerability is an authorization bypass (CWE-640) stemming from a user-controlled key flaw. It allows an unauthenticated attacker to bypass security requirements and access the system without providing valid credentials.

Business Impact

The ability for an unauthenticated user to bypass authentication represents a severe risk to operational integrity and system confidentiality. Given the CVSS score of 7.3, this flaw enables unauthorized actors to interact with the gateway, potentially leading to unauthorized configuration changes or further exploitation of connected building management systems.

Remediation Plan

Immediate Action: Review the vendor advisory at the provided CISA ICS advisory link to determine the availability of firmware updates and apply them as soon as they are released.

Proactive Monitoring: Monitor network traffic for unusual authentication requests or unexpected access attempts originating from unauthorized IP addresses.

Compensating Controls: Restrict access to the Security Gateway interface by placing it behind a firewall or VPN, ensuring it is not exposed to the public internet.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of September 12, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its automatable nature and the lack of required user interaction or authentication.

Analyst Recommendation

This vulnerability presents a significant risk to the security of the Daikin Security Gateway. Administrators should prioritize isolating affected gateways from external network exposure until a vendor-supplied patch is applied. Continuous monitoring of device logs is recommended to detect any attempts to leverage this bypass mechanism.

Description Summary:
A buffer overflow vulnerability in the Tenda AC20 router allows remote attackers to trigger a denial of service or remote code execution via the /goform/GetParentControlInfo endpoint.

Executive Summary:
A critical buffer overflow vulnerability in Tenda AC20 routers allows remote, authenticated attackers to crash the device or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-10120

Affected Software: Tenda AC20

Affected Versions: 16.03.08.0 through 16.03.08.7 (and likely versions up to 16.03.08.12)

Vulnerability: The flaw exists in the strcpy function within the /goform/GetParentControlInfo handler. An attacker can supply a specially crafted mac parameter in an HTTP POST request to trigger a stack-based buffer overflow, requiring low-privileged user access to initiate.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the router, allowing for unauthorized code execution or persistent denial of service. Given the CVSS score of 8.8, this poses a significant risk to network availability and data integrity, potentially providing an attacker with a foothold to conduct further lateral movement within the local network.

Remediation Plan

Immediate Action: Check the Tenda support website for firmware updates addressing this buffer overflow and apply them immediately. If no patch is currently available for your specific build, restrict access to the device management interface.

Proactive Monitoring: Monitor network traffic for unusual HTTP POST requests directed at the /goform/GetParentControlInfo endpoint, which may indicate exploitation attempts.

Compensating Controls: Implement a Web Application Firewall or network access control list to restrict management access to the router to known, trusted internal IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of September 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of bounds checking on the mac parameter during the strcpy operation.

Analyst Recommendation

Due to the severity of this remote code execution vulnerability and the availability of a public proof-of-concept, users must prioritize securing their Tenda AC20 devices. If a firmware update is not yet available, immediately disable remote management features and restrict administrative access to the device to prevent unauthorized exploitation.

Description Summary:
The Student Information Management System 1.0 contains an SQL injection vulnerability in the instructor module, allowing remote attackers to manipulate database queries via the ID argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in the itsourcecode Student Information Management System poses a significant risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-10111

Affected Software: itsourcecode Student Information Management System

Affected Versions: 1.0

Vulnerability: This is an SQL injection vulnerability (CWE-89) located in the file /admin/modules/instructor/index.php. An unauthenticated remote attacker can exploit this flaw by manipulating the ID parameter to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive student data or the modification of application records. With a CVSS score of 7.3, this flaw presents a high risk to business operations, potentially resulting in severe reputational damage and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/modules/instructor/ directory and implement strict input validation for all user-supplied parameters.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests containing SQL syntax or unusual query patterns targeting the instructor index file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on the ID argument.

Analyst Recommendation

Given the availability of public exploit material, the risk of automated exploitation against this system is elevated. Organizations currently running this software should prioritize isolating the affected component and implementing robust network-level filtering to prevent unauthorized access until a vendor-supplied security update is released.

Description Summary:
Campcodes Online Loan Management System 1.0 is vulnerable to remote SQL injection via the ajax.php file, allowing attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Loan Management System 1.0 poses a significant risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10109

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID argument in the /ajax.php?action=delete_payment endpoint. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands remotely.

Business Impact

The ability to perform SQL injection against a financial management system can lead to the unauthorized disclosure, modification, or deletion of sensitive loan and payment data. Given the CVSS score of 7.3, this high-severity flaw could result in significant operational disruption and compromise the integrity of financial records.

Remediation Plan

Immediate Action: As no official patch is currently available, contact the vendor for security updates and restrict access to the affected web directory via network-level controls.

Proactive Monitoring: Review application access logs for suspicious requests targeting the /ajax.php script, particularly those containing SQL syntax or unusual characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to filter and block malicious SQL injection payloads targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the affected endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running Campcodes Online Loan Management System 1.0 must prioritize implementing compensating controls, such as WAF rules, and restrict network access to the vulnerable endpoint until an official vendor patch is released and verified.

Description Summary:
Campcodes Online Loan Management System 1.0 contains a SQL injection vulnerability in the ajax.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows for remote unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-10108

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID parameter in the /ajax.php?action=delete_loan endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform SQL injection allows an attacker to execute arbitrary queries against the application database. This can lead to unauthorized data disclosure, modification of loan records, or complete compromise of the backend database. With a CVSS score of 7.3, this represents a high-severity risk that could result in significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to mitigate the risk of exploitation.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization on the ID argument.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a significant risk to affected environments. Organizations using Campcodes Online Loan Management System 1.0 must prioritize restricting network access to the vulnerable endpoint and monitor for signs of unauthorized database manipulation until an official security patch is provided by the vendor.

Description Summary:
The Online Event Judging System 1.0 contains an SQL injection vulnerability in the review_search.php file, allowing remote attackers to manipulate the txtsearch argument.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Event Judging System 1.0 allows for unauthenticated remote data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10104

Affected Software: code-projects Online Event Judging System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection via the txtsearch parameter in the review_search.php file. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

The ability to perform SQL injection allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this flaw poses a significant risk to the integrity and confidentiality of the event judging data. Such incidents can result in severe reputational damage and the compromise of sensitive contestant or event information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation or disable the vulnerable review_search.php component until a fix is released.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the review_search.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch against incoming exploit attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the public availability of exploit information and the ease of remote execution, this vulnerability represents an urgent security risk. Organizations currently running version 1.0 of the Online Event Judging System should prioritize isolating the application from public-facing networks until a vendor-supplied patch is applied. Continuous vigilance and the application of WAF rules are essential to minimize the attack surface until formal remediation is provided.

Description Summary:
A SQL injection vulnerability exists in the Online Event Judging System 1.0 via the main_event argument in home.php, allowing remote attackers to execute arbitrary database queries.

Executive Summary:
The code-projects Online Event Judging System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10103

Affected Software: code-projects Online Event Judging System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the home.php file. An unauthenticated remote attacker can trigger the flaw by manipulating the main_event input parameter.

Business Impact

The ability to perform remote SQL injection allows an attacker to potentially bypass authentication, access sensitive data, or modify database contents. With a CVSS score of 7.3, this high-severity vulnerability poses a significant risk to the integrity and confidentiality of the event data stored within the application. Failure to remediate could lead to unauthorized data exfiltration or total compromise of the application database.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the application or implement strict input validation on the main_event parameter to neutralize malicious SQL payloads.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL patterns containing SQL syntax or unusual input in the main_event parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection patterns targeting the application.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute, significantly lowering the barrier for entry for malicious actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation over a network, this vulnerability presents an immediate risk. Organizations utilizing the Online Event Judging System 1.0 must prioritize implementing network-level blocks or WAF protections immediately, as a vendor-supplied patch is currently unavailable. Continuous monitoring for indicators of compromise is essential until a formal fix is released by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Online Event Judging System 1.0, allowing remote unauthenticated attackers to manipulate the Username argument in index.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Online Event Judging System 1.0 exposes the application to remote, unauthenticated data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10102

Affected Software: code-projects Online Event Judging System

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the /index.php file. An unauthenticated remote attacker can exploit this by manipulating the Username parameter to execute unauthorized database queries.

Business Impact

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure, modification, or deletion. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the integrity and confidentiality of the judging system, which could result in reputational damage and loss of trust in event outcomes.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the application via network-level controls or disable the vulnerable component until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious input patterns in the Username field, such as SQL syntax characters or unexpected query structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application index.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation provided in the GitHub issue linked by the CVE record.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated access to the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a verified vendor patch, this vulnerability presents an immediate risk to the affected system. Organizations should prioritize isolating the affected server from the public internet and implementing strict input validation or WAF rules to prevent exploitation attempts until an official remediation is released by the vendor.

Description Summary:
A heap-based out-of-bounds read vulnerability in the Gen Digital scanning engine when processing malformed Mach-O files can lead to local code execution or a denial of service.

Executive Summary:
A heap-based out-of-bounds read vulnerability in Gen Digital antivirus products allows local attackers to execute arbitrary code or crash the security software.

Vulnerability Details

CVE-ID: CVE-2025-10101

Affected Software: Gen Digital (Avast, AVG, Norton, Avast One, Avast Business Antivirus)

Affected Versions: Virus definition builds before VPS 25090300

Vulnerability: This is a heap-based out-of-bounds read vulnerability (CWE-125) occurring within the shared virus scanning engine. An attacker can trigger this flaw by providing a maliciously crafted Mach-O file, which, when scanned, may result in local code execution or a denial of service of the antivirus process.

Business Impact

Successful exploitation allows a local user to compromise the integrity and availability of the host system by disabling security protections or executing unauthorized code. With a CVSS score of 8.1, the risk is classified as High because it directly undermines the primary security control meant to protect the endpoint.

Remediation Plan

Immediate Action: Update the antivirus software to ensure virus definitions are at build VPS 25090300 or later, as this update remediates the flaw through the centralized definition stream.

Proactive Monitoring: Monitor system logs for unexpected crashes of antivirus processes or multiple failed scan attempts that could indicate an attempt to trigger the buffer read error.

Compensating Controls: Restrict execution permissions for untrusted files and ensure that endpoint security policies are configured to block suspicious or malformed executable formats until the definition update is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 1, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a local attacker to provide a specially crafted file to the scanning engine, limiting the attack surface to users who can place files on the target system.

Analyst Recommendation

Given the critical role of antivirus software in defending against malware, the potential for local code execution must be addressed immediately. Administrators should verify that all managed endpoints have successfully pulled the latest virus definition update to version 25090300 to neutralize this threat.

Description Summary:
SourceCodester Simple Forum Discussion System 1.0 is vulnerable to unauthenticated remote SQL injection via the username parameter in the admin_class.php file.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Simple Forum Discussion System 1.0 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-10100

Affected Software: SourceCodester Simple Forum Discussion System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by manipulating the Username argument within the admin_class.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as confirmed by the CVSS vector AV:N/AC:L/AT:N/PR:N/UI:N.

Business Impact

Successful exploitation of this flaw allows an attacker to execute arbitrary SQL commands against the backend database. This can lead to unauthorized data exfiltration, modification of administrative credentials, or complete loss of data integrity. Given the CVSS score of 7.3, this represents a high-risk scenario for organizations relying on this software, as the vulnerability is both remotely accessible and requires no authentication.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected administrative interface via network-level controls or disable the application until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious activity involving the admin_class.php endpoint, particularly focusing on requests containing SQL syntax patterns in the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application login parameters.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the linked research write-up (https://github.com/bdrfly/cve/issues/1).

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability's design allows for trivial exploitation due to the lack of input sanitization in the affected login function.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability significantly elevates the risk of exploitation. Organizations currently utilizing SourceCodester Simple Forum Discussion System 1.0 must treat this as a high-priority issue and implement the recommended network-level restrictions or WAF protections immediately to prevent unauthorized database access.

Description Summary:
Jinher OA is vulnerable to an XML External Entity (XXE) injection flaw in the AddTask.aspx component, allowing remote unauthenticated attackers to trigger unauthorized file references.

Executive Summary:
An unauthenticated remote XML External Entity (XXE) vulnerability in Jinher OA versions 1.0 through 1.2 poses a significant risk of unauthorized data disclosure.

Vulnerability Details

CVE-ID: CVE-2025-10092

Affected Software: Jinher OA

Affected Versions: 1.0, 1.1, 1.2

Vulnerability: This vulnerability is an XML External Entity (XXE) reference flaw (CWE-611) located in the /c6/Jhsoft.Web.projectmanage/TaskManage/AddTask.aspx endpoint. The issue allows an unauthenticated remote attacker to manipulate XML inputs, potentially resulting in the disclosure of sensitive server-side data.

Business Impact

The exploitation of this XXE vulnerability can lead to unauthorized access to sensitive files stored on the server, potentially exposing configuration files, credentials, or internal system data. With a CVSS score of 7.3, this flaw represents a high-severity risk that could be leveraged by attackers to facilitate further lateral movement within the network.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain a security patch, as no official fixed version is currently documented. If a patch is unavailable, restrict access to the affected TaskManage directory at the network or application firewall level.

Proactive Monitoring: Review web access logs for unusual requests directed at the TaskManage/AddTask.aspx file, specifically looking for XML-formatted payloads containing entity declarations.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing XML entity references or suspicious XML structures targeting the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the referenced GitHub issue (https://github.com/Cstarplus/CVE/issues/3).

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high-severity potential of XXE attacks, organizations using Jinher OA must treat this vulnerability with high priority. We recommend immediate implementation of WAF-based filtering to mitigate the risk while awaiting a formal vendor patch.

Description Summary:
Jinher OA is vulnerable to XML External Entity (XXE) injection via the XmlHttp.aspx component, potentially allowing remote attackers to access sensitive local resources.

Executive Summary:
A critical XML External Entity vulnerability in Jinher OA versions 1.0 through 1.2 allows unauthenticated remote attackers to perform unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-10091

Affected Software: Jinher OA

Affected Versions: 1.0, 1.1, 1.2

Vulnerability: This vulnerability occurs in the XML Handler component within the XmlHttp.aspx file. An unauthenticated attacker can exploit this flaw to perform XML External Entity (XXE) injection, which allows the processing of malicious XML input.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized disclosure of sensitive internal files or server-side data, posing a significant risk to organizational confidentiality. Given the CVSS score of 7.3, this flaw is categorized as High severity, indicating a substantial risk to systems that are reachable by unauthorized remote actors.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the vulnerable XmlHttp.aspx endpoint or disable the affected component if it is not business-critical.

Proactive Monitoring: Review web access logs for suspicious requests targeting the /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx path, specifically looking for XML-formatted payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block or sanitize incoming XML requests containing external entity definitions.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the affected endpoint does not properly validate XML input from remote users.

Analyst Recommendation

Due to the availability of proof-of-concept code and the ease of remote exploitation, organizations using Jinher OA must treat this vulnerability with high priority. Organizations should immediately implement the recommended network-level restrictions or WAF rules while awaiting a vendor-supplied security update to address the underlying XML parsing flaw.

Description Summary:
A SQL injection vulnerability exists in Jinher OA versions 1.0 through 1.2, specifically within the GetTreeDate.aspx endpoint, allowing remote attackers to manipulate the ID argument.

Executive Summary:
Jinher OA versions 1.0 through 1.2 are vulnerable to a remote SQL injection flaw that could allow unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-10090

Affected Software: Jinher OA

Affected Versions: 1.0, 1.1, 1.2

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the ID argument within the /C6/Jhsoft.Web.departments/GetTreeDate.aspx file. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The presence of this vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration or modification. Given the CVSS score of 7.3, this is classified as a high severity issue that requires immediate attention to prevent compromise of business-critical information.

Remediation Plan

Immediate Action: Contact the vendor for the latest security patches or updates for Jinher OA. If a patch is not yet available, restrict network access to the /C6/Jhsoft.Web.departments/GetTreeDate.aspx endpoint.

Proactive Monitoring: Monitor web server logs for suspicious requests containing SQL syntax or unusual parameters directed at the GetTreeDate.aspx file.

Compensating Controls: Implement Web Application Firewall (WAF) rules designed to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its ease of remote exploitation without authentication.

Analyst Recommendation

This vulnerability represents a high risk to the organization due to the availability of proof-of-concept code and the lack of required authentication for exploitation. Security teams should prioritize identifying all instances of Jinher OA in their environment and apply vendor-supplied updates as soon as they are released. Until updates are applied, network-level restrictions or WAF filtering should be employed to mitigate the risk of remote SQL injection attempts.

Description Summary:
An uncontrolled search path element vulnerability in Mitsubishi Electric MILCO.S applications allows local attackers to execute arbitrary code via malicious DLL loading during installation.

Executive Summary:
A vulnerability in Mitsubishi Electric MILCO.S lighting control installers allows local attackers to execute arbitrary code, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-10089

Affected Software: Mitsubishi Electric MILCO.S Setting and Operation Applications

Affected Versions: All versions

Vulnerability: This is an uncontrolled search path element flaw (CWE-427) where the installer may load a malicious DLL if one is placed in the search path. The vulnerability requires local access and user interaction to trigger, and it is specific to the installation process rather than the post-installation runtime environment.

Business Impact

Successful exploitation could allow an attacker to gain full control over the host system during the installation process, leading to complete system compromise. Given the CVSS score of 7.0, this represents a high-severity risk that could lead to unauthorized access or the installation of persistent malicious software on industrial control workstations.

Remediation Plan

Immediate Action: Verify the integrity of the installation by checking the Digital Signatures tab of the MILCO.S Lighting Control.exe file for the signer name "Mitsubishi Electric Lighting," which indicates a patched version. If the signature is missing or incorrect, download the latest installer directly from the official Mitsubishi Electric website.

Proactive Monitoring: Monitor system logs for unexpected process execution during software installation and ensure that installers are only sourced from verified, official vendor channels.

Compensating Controls: Restrict local user privileges on engineering workstations to prevent unauthorized file placement in directories where the installer searches for dependencies.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is limited to the installation phase and can be avoided by ensuring the installer is obtained directly from the manufacturer.

Analyst Recommendation

The risk posed by this vulnerability is significant for environments utilizing MILCO.S lighting control systems. Administrators must ensure that all future installations of this software are performed using validated, digitally signed files obtained exclusively from Mitsubishi Electric to mitigate the risk of malicious DLL injection.

Description Summary:
A SQL injection vulnerability exists in the SourceCodester Online Polling System 1.0 via the email parameter in the /admin/manage-admins.php file.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Online Polling System 1.0 allows for remote, unauthenticated database manipulation and potential unauthorized access.

Vulnerability Details

CVE-ID: CVE-2025-10082

Affected Software: SourceCodester Online Polling System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input validation of the email argument within the /admin/manage-admins.php script. The vulnerability can be exploited remotely by an unauthenticated attacker to inject malicious SQL commands.

Business Impact

The ability to perform remote SQL injection allows an attacker to query, modify, or delete sensitive data stored within the application database. Given the CVSS score of 7.3, this represents a high-risk scenario that could lead to full compromise of user credentials, administrative access, or loss of data integrity. Such exposure poses significant risks to system availability and compliance obligations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/manage-admins.php endpoint via network controls or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests containing SQL syntax patterns, such as UNION, SELECT, or OR 1=1, directed at the administrative management files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided by the vulnerability reporter at https://github.com/ganzhi-qcy/cve/issues/22.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication to execute.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation via unauthenticated remote access, this vulnerability requires immediate attention. Organizations utilizing version 1.0 of the Online Polling System should implement strict network-level access controls and monitor for signs of unauthorized database interaction until a vendor-supplied security update is released.

Description Summary:
PHPGurukul Small CRM 4.0 is susceptible to remote SQL injection via the Contact argument in the get-quote.php file, potentially allowing unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in PHPGurukul Small CRM 4.0 allows unauthenticated remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-10079

Affected Software: PHPGurukul Small CRM

Affected Versions: 4.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the get-quote.php script. It allows an unauthenticated remote attacker to manipulate the Contact parameter to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject SQL commands presents a significant risk to data privacy and system integrity. Successful exploitation could lead to unauthorized data exfiltration, database modification, or complete service disruption. Given the CVSS score of 7.3, this issue is classified as high severity, reflecting the ease of remote exploitation without prior authentication.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict public access to the get-quote.php file or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for anomalous HTTP requests containing SQL syntax or unusual input patterns directed at the get-quote.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious SQL injection payloads targeting the Contact parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of remote execution, this vulnerability poses a credible risk to any organization running PHPGurukul Small CRM 4.0. Organizations must prioritize restricting access to the vulnerable endpoint and monitor for signs of unauthorized database interaction until a formal patch is provided by the vendor.