Description Summary:
Campcodes Farm Management System 1.0 contains a SQL injection vulnerability in the rating argument of the reviewInput.php file, allowing remote attackers to execute arbitrary database commands.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Farm Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a severe risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2025-9811

Affected Software: Campcodes Farm Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the rating parameter within the reviewInput.php file. This flaw permits unauthenticated remote attackers to inject malicious SQL statements directly into the backend database.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive agricultural data, potential modification of records, or the complete exfiltration of the backend database contents. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate further unauthorized access to the underlying server infrastructure.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected web interface and disable the vulnerable functionality if it is not business critical.

Proactive Monitoring: Security teams should review web server access logs for anomalous request patterns targeting reviewInput.php, particularly those containing SQL syntax characters in the rating parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns to provide a virtual patch until an official vendor update is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of September 3, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on the rating parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, organizations using Campcodes Farm Management System must prioritize limiting exposure. Until the vendor provides a formal security update, the implementation of strict WAF filtering and egress traffic monitoring is necessary to mitigate the risk of unauthorized data access.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 contains a SQL injection vulnerability in the pos_transac.php script, allowing remote attackers to manipulate database queries via the cash parameter.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-9794

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the cash or firstname arguments within the /pages/pos_transac.php?action=add endpoint. This flaw allows unauthenticated remote attackers to inject malicious SQL commands into the backend database.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive customer or inventory records, potential data exfiltration, or modification of transaction history, resulting in significant operational and reputational damage. The CVSS score of 7.3 reflects the high risk associated with remote, unauthenticated access to the database layer.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable endpoint if not required for business operations.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected input in the cash and firstname parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the specified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical reference provided by the researcher (https://github.com/e1evensu/cve/issues/1).

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Computer Sales and Inventory System must prioritize hardening the application environment and implementing strict input validation or WAF rules to prevent unauthorized database interaction until a vendor-supplied patch is issued.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the teacher_signup.php file.

Executive Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to unauthenticated SQL injection, posing a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-9786

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the teacher_signup.php file, specifically triggered via the firstname parameter. The flaw allows unauthenticated remote attackers to execute arbitrary SQL commands against the application database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to or manipulation of the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to the exposure of sensitive user information, administrative credentials, or full application compromise. Organizations relying on this platform for educational management face potential data breaches and service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the teacher_signup.php endpoint or disable the registration functionality until a security update is released by the vendor.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unusual syntax or unexpected SQL keywords, specifically originating from the teacher_signup.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect incoming requests for SQL injection payloads targeting the firstname parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability to a credible threat. We strongly recommend that administrators audit their implementations of Campcodes Online Learning Management System immediately and apply the suggested compensating controls to prevent potential exploitation until an official vendor patch is provided.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Hospital Management System 1.0 admin dashboard login, allowing unauthenticated remote attackers to manipulate the password argument.

Executive Summary:
Campcodes Hospital Management System 1.0 contains a critical SQL injection vulnerability in the admin login portal that allows for remote, unauthenticated unauthorized access.

Vulnerability Details

CVE-ID: CVE-2025-9770

Affected Software: Campcodes Hospital Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the admin dashboard login functionality. An unauthenticated attacker can inject malicious SQL commands via the password parameter to bypass authentication or manipulate backend database queries.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms, potentially gaining full administrative control over the Hospital Management System. This poses a severe risk of data breach, unauthorized access to sensitive patient records, and full system compromise, justifying the CVSS score of 7.3.

Remediation Plan

Immediate Action: There is currently no official patch from the vendor for this version. Administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting until an official security update is released by Campcodes.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as union-based queries or unexpected character sequences, originating from the admin login endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting login parameters.

Exploitation Status

Public Exploit Available: Yes — a technical write-up containing attack details and proof-of-concept information is available via the Yashh-G GitHub repository.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to the integrity and confidentiality of the Hospital Management System. Administrators are strongly urged to isolate the administrative interface from the public internet immediately and monitor for any suspicious access attempts until the vendor provides a formal patch.

Description Summary:
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the student_signup.php file via the Username parameter, allowing for unauthenticated remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to remotely manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-9763

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the Username parameter within the student_signup.php script, which facilitates SQL injection. This vulnerability is remotely exploitable by unauthenticated users, as confirmed by the CVSS attack vector.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to student records, administrative credentials, or full database exposure. With a CVSS score of 7.3, this high severity flaw warrants immediate attention to prevent potential system compromise or data exfiltration.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should restrict access to the affected registration portal if it is not business-critical. Users are advised to monitor the official Campcodes website for urgent security updates.

Proactive Monitoring: Security teams should review server access logs for anomalous patterns in HTTP requests directed at student_signup.php, specifically looking for SQL syntax characters such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the registration endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit given the lack of authentication requirements and the nature of the injection point.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a credible risk to the integrity of the Learning Management System. Organizations using Campcodes Online Learning Management System 1.0 must prioritize the implementation of WAF protections and maintain a close watch for official remediation releases from the vendor.

Description Summary:
Campcodes Online Feeds Product Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the /feeds/index.php file via the Username parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Feeds Product Inventory System 1.0 poses a significant risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-9761

Affected Software: Campcodes Online Feeds Product Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /feeds/index.php file. An unauthenticated attacker can exploit this by manipulating the Username parameter to execute arbitrary SQL commands.

Business Impact

Successful exploitation allows an attacker to interact directly with the underlying database, which may lead to unauthorized data disclosure, modification, or potential administrative bypass. While the CVSS score of 7.3 indicates a high severity, the ability for an unauthenticated user to perform these actions remotely makes this a primary target for automated exploitation.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /feeds/index.php endpoint or disable the vulnerable component entirely until a fix is released by the vendor.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically focusing on SQL syntax characters like single quotes, dashes, or UNION statements within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to block SQL injection attempts against the identified vulnerable parameter to provide a temporary virtual patch.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists via the GitHub repository referenced in the vulnerability disclosure.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the public availability of exploit material and the lack of a vendor patch, organizations utilizing this system must prioritize immediate mitigation. Restricting network access to the application and implementing WAF protections are essential to prevent potential compromise of the backend database until the vendor provides an official security update.

Description Summary:
The Courier Management System 1.0 contains an unauthenticated SQL injection vulnerability in the Signup function of ajax.php via the lastname argument.

Executive Summary:
Campcodes and SourceCodester Courier Management System 1.0 is vulnerable to an unauthenticated SQL injection flaw that allows remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-9759

Affected Software: Campcodes / SourceCodester Courier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the lastname parameter within the Signup function located in ajax.php. This allows an unauthenticated attacker to inject malicious SQL commands to interact directly with the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data compromise and system instability for organizations relying on this software.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict network access to the affected instance or disable the vulnerable registration functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting ajax.php, specifically looking for SQL syntax patterns or unusual character strings in the lastname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the database layer.

Analyst Recommendation

This vulnerability presents a clear and immediate risk due to the availability of public exploit material and the lack of required authentication. Organizations currently running Courier Management System 1.0 must prioritize the implementation of WAF protections or network isolation to prevent exploitation while awaiting a formal vendor security update.

Description Summary:
The Courier Management System 1.0 contains an unauthenticated SQL injection vulnerability in the login function of the ajax.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in the Courier Management System allows unauthenticated remote attackers to manipulate database queries via the email parameter.

Vulnerability Details

CVE-ID: CVE-2025-9757

Affected Software: Campcodes / SourceCodester Courier Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the login function within the ajax.php file. The application fails to properly sanitize the email input, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to bypass authentication, access sensitive data stored in the database, or interfere with system operations. Given the CVSS score of 7.3, this represents a high-risk security gap that could lead to unauthorized data disclosure and compromise of the application integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the login interface and the vulnerable ajax.php endpoint using network-level controls.

Proactive Monitoring: Monitor server access logs for anomalous requests to the ajax.php file, specifically looking for SQL-related characters or patterns in the email parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application login flow.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue tracker referenced by the vulnerability record.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, users of the Courier Management System 1.0 are at significant risk. Organizations must prioritize isolating the affected component from the public internet and implementing strict input validation or WAF filtering to prevent unauthorized database access until a secure version is released.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the Username argument in login.php, allowing for unauthorized database interaction.

Executive Summary:
Campcodes Online Learning Management System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-9751

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the Username parameter within the login.php file, which facilitates a SQL injection attack. This vulnerability is remotely exploitable by unauthenticated attackers.

Business Impact

Successful exploitation of this flaw allows an attacker to manipulate database queries, potentially leading to unauthorized data access, modification, or the disclosure of sensitive information. Given the CVSS score of 7.3, this represents a high-severity risk to the confidentiality and integrity of the learning management system, which could result in significant operational disruption and data breach consequences.

Remediation Plan

Immediate Action: Since a specific patch is not currently identified, administrators should restrict access to the login portal via network-level controls or a Web Application Firewall until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous patterns or characters typically associated with SQL injection attempts, such as the use of single quotes, comment indicators, or SQL keywords in the username field.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block common SQL injection payloads targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the referenced GitHub issue.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to its remote, unauthenticated nature.

Analyst Recommendation

This vulnerability presents a clear risk of unauthorized database interaction due to insufficient input validation. Organizations currently running Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, and maintain close communication with the vendor for the release of an official security patch. Immediate action is required to reduce the attack surface until a permanent fix is available.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to unauthenticated SQL injection via the Username parameter in /admin/login.php.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Learning Management System allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-9750

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the Username argument of the /admin/login.php file. This flaw is remotely exploitable by unauthenticated attackers, allowing them to manipulate database queries.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive educational or user data stored within the backend database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to a complete compromise of the application's user authentication mechanism.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/login.php file or the entire application to trusted IP ranges until a security update is released by Campcodes.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically those containing SQL syntax characters, originating from the login interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes — a public proof of concept is available via the researcher's GitHub issue tracker.

Analyst Notes: As of September 2, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute, making it an attractive target for automated scanning tools.

Analyst Recommendation

This vulnerability presents a clear and present danger to the confidentiality of your system data. Because the exploit is publicly available and requires no authentication, you must prioritize restricting access to the affected login page immediately. Monitor for any signs of unauthorized database interaction and engage the vendor for a definitive patch as soon as one becomes available.

Description Summary:
Campcodes Online Loan Management System 1.0 contains an unauthenticated SQL injection vulnerability in the ajax.php file via the id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows remote attackers to compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-9678

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /ajax.php endpoint, specifically within the delete_borrower action. The application fails to properly sanitize the id parameter before processing it in SQL queries, allowing unauthenticated remote attackers to execute arbitrary database commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, resulting in the theft of sensitive borrower information, data tampering, or full system compromise. With a CVSS score of 7.3, this flaw poses a significant risk to the confidentiality and integrity of the organization, potentially causing severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable component entirely until a security update is released.

Proactive Monitoring: Review web server and database access logs for anomalous requests to ajax.php, particularly those containing SQL syntax or unusual characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the id parameter in POST requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept and technical write-up are available on GitHub.

Analyst Notes: As of August 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of authentication requirements and the direct inclusion of user input in database queries.

Analyst Recommendation

Given the availability of public proof-of-concept code and the high risk associated with SQL injection, this vulnerability must be treated with urgency. Administrators should prioritize isolating the affected system from public-facing networks and implement strict input validation or WAF filtering to prevent exploitation until a vendor-supplied patch is provided.

Description Summary:
Campcodes Payroll Management System 1.0 contains a file inclusion vulnerability in the index.php file, allowing remote attackers to manipulate the page argument to include unauthorized files.

Executive Summary:
A critical file inclusion vulnerability exists in Campcodes Payroll Management System 1.0 that enables unauthenticated remote attackers to perform unauthorized file operations.

Vulnerability Details

CVE-ID: CVE-2025-9529

Affected Software: Campcodes Payroll Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to CWE-73: File Inclusion via the page parameter in the index.php script. This flaw permits an unauthenticated remote attacker to influence file path resolution, potentially leading to unauthorized information disclosure or system manipulation.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk to the organization. Successful exploitation could lead to the unauthorized exposure of sensitive payroll data, system compromise, or the execution of arbitrary code within the context of the web server, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unavailable, administrators should immediately restrict access to the affected Payroll Management System instance until a secure update is released by Campcodes.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing directory traversal characters or unexpected file paths directed at index.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack patterns, such as directory traversal sequences, targeting the index.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub issue reference.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to any environment hosting the Campcodes Payroll Management System. Organizations must prioritize restricting network access to the application or deactivating the service until the vendor provides a formal security update.

Description Summary:
Campcodes Online Loan Management System 1.0 contains a SQL injection vulnerability in the ajax.php file via the ID parameter, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to manipulate database queries and potentially compromise system data.

Vulnerability Details

CVE-ID: CVE-2025-9506

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID parameter in the /ajax.php endpoint. The vulnerability is exploitable by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection flaw could lead to unauthorized access to sensitive financial records, data modification, or data exfiltration. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application database. If the database user has elevated privileges, the impact could extend to full system compromise.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected web server and disable the vulnerable endpoint if it is not business-critical.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the ajax.php file, specifically looking for common SQL injection payloads within the ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns directed at the /ajax.php path.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists, as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its unauthenticated remote attack vector.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of this vulnerability. Organizations using Campcodes Online Loan Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, while awaiting an official security update from the vendor. Continuous monitoring of database queries is essential until a formal patch is applied.

Description Summary:
Campcodes Online Loan Management System 1.0 contains an unauthenticated SQL injection vulnerability in the /ajax.php endpoint, allowing remote attackers to manipulate database queries via the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to manipulate database queries, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-9505

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered through the ID argument in the /ajax.php?action=save_loan_type endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform unauthenticated SQL injection allows an attacker to interact directly with the backend database. This could lead to unauthorized data exposure, modification of loan records, or potential administrative account takeover, resulting in significant operational disruption and loss of trust. With a CVSS score of 7.3, this flaw represents a high risk to the confidentiality and integrity of financial management systems.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the affected /ajax.php endpoint or disable the vulnerable loan management module entirely until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for anomalous requests to the /ajax.php file, specifically looking for unusual patterns or SQL keywords in the ID parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter and block malicious SQL injection payloads targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/Sxxxw/cve/issues/1.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its unauthenticated nature and the ease of reaching the vulnerable endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, organizations must treat this as a high-priority risk. Administrators should immediately implement restrictive access controls on the affected file and monitor for any signs of exploitation while awaiting a formal security update from Campcodes.

Description Summary:
Campcodes Online Loan Management System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /ajax.php?action=save_plan endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-9504

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the ID argument within the /ajax.php?action=save_plan endpoint, which results in a SQL injection vulnerability. This flaw is accessible to unauthenticated remote attackers.

Business Impact

Successful exploitation of this vulnerability allows unauthorized actors to execute arbitrary SQL commands against the backend database. This may lead to the exfiltration of sensitive loan data, unauthorized modification of records, or potential service disruption, carrying a CVSS score of 7.3 which reflects a high risk to data confidentiality and integrity.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict network access to the affected /ajax.php endpoint or disable the vulnerable module if it is not business critical.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns containing SQL syntax, particularly directed at the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up provided by the researcher on GitHub.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the injection vector makes this an attractive target for automated scanning tools.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, organizations using Campcodes Online Loan Management System 1.0 must treat this as a high-priority risk. Immediately implement network-level restrictions or WAF rules to prevent exploitation until an official vendor update is released and applied.

Description Summary:
Campcodes Online Loan Management System 1.0 contains an unauthenticated SQL injection vulnerability via the lastname parameter in ajax.php.

Executive Summary:
The Campcodes Online Loan Management System 1.0 is vulnerable to an unauthenticated SQL injection attack that could allow remote adversaries to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-9503

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the ajax.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the lastname argument to interact with the underlying database.

Business Impact

The exploitation of this vulnerability can lead to unauthorized access to sensitive financial records, potential data exfiltration, or modification of loan data. Given the CVSS score of 7.3, this represents a high-risk security flaw that could compromise the integrity and confidentiality of the application. Business operations relying on this system for loan processing are at significant risk of disruption.

Remediation Plan

Immediate Action: Since a formal patch is not confirmed, administrators should restrict access to the affected endpoint at the network or web server level and contact the vendor for an urgent security update.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected SQL syntax or unauthorized access attempts originating from the /ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the lastname parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability, necessitating immediate attention from security teams. Organizations using Campcodes Online Loan Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, to neutralize the threat until a vendor-supplied patch is available. Failure to secure this endpoint could result in unauthorized database access and significant data exposure.

Description Summary:
Campcodes Online Loan Management System 1.0 contains a SQL injection vulnerability in the /ajax.php endpoint via the loan_id parameter, allowing unauthenticated remote attackers to execute SQL commands.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Loan Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-9502

Affected Software: Campcodes Online Loan Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the /ajax.php?action=save_payment file. It allows an unauthenticated attacker to manipulate the loan_id argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability to perform unauthenticated SQL injection poses a severe risk to data confidentiality and integrity. Given the CVSS score of 7.3, this flaw could lead to unauthorized data exfiltration, modification of loan records, or complete database compromise, potentially resulting in significant reputational damage and operational downtime.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /ajax.php endpoint or disable the affected payment functionality until the vendor provides a security update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the /ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the loan_id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the technical write-up referenced at https://github.com/skyrainoh/CVE/issues/10.

Analyst Notes: As of August 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of an official patch and the availability of a public exploit, this vulnerability presents an immediate and elevated risk to all deployments of Campcodes Online Loan Management System 1.0. Organizations should treat this as a high priority item, implementing strict network access controls or disabling the vulnerable module immediately to prevent unauthorized database access.

Description Summary:
Campcodes Online Water Billing System 1.0 is vulnerable to remote SQL injection via the lname argument in the addclient1.php file, potentially allowing unauthorized database manipulation.

Executive Summary:
The Campcodes Online Water Billing System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-9492

Affected Software: Campcodes Online Water Billing System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the addclient1.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the lname parameter.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive billing and client data stored within the backend database. Given the CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially resulting in the exfiltration of personally identifiable information or system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and disable the vulnerable addclient1.php functionality if it is not business-critical.

Proactive Monitoring: Monitor database query logs for unusual patterns or syntax errors that may indicate injection attempts, specifically targeting traffic directed at the addclient1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, particularly those targeting the lname parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the referenced GitHub repository.

Analyst Notes: As of August 27, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger and targets a common database interaction point.

Analyst Recommendation

Due to the lack of a vendor-supplied patch and the availability of a public proof-of-concept, this vulnerability should be treated with high priority. Organizations using the Campcodes Online Water Billing System must implement restrictive network controls and WAF filtering immediately to mitigate the risk of unauthorized database access while awaiting a formal security update from the vendor.

Description Summary:
Campcodes Online Water Billing System 1.0 is vulnerable to SQL injection via the ID parameter in the editecex.php file, potentially allowing remote unauthorized database interactions.

Executive Summary:
Campcodes Online Water Billing System 1.0 contains a critical SQL injection vulnerability that could allow unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-9423

Affected Software: Campcodes Online Water Billing System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the editecex.php file, where the ID argument is not properly sanitized. This vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access.

Business Impact

Successful exploitation of this vulnerability can lead to the unauthorized disclosure, modification, or deletion of sensitive billing information stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant operational disruption and a breach of customer data confidentiality.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected editecex.php file or disable the vulnerable module entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for suspicious HTTP requests targeting the editecex.php file, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming traffic containing SQL injection patterns targeting the editecex.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of August 27, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public proof-of-concept significantly lowers the barrier to entry for potential attackers.

Analyst Recommendation

The vulnerability in Campcodes Online Water Billing System poses a serious risk to data integrity and system security. Organizations currently utilizing this software should prioritize isolating the affected component from the public network. It is imperative to monitor for official vendor communication regarding a permanent patch and to apply it immediately upon release to remediate this flaw.

Description Summary:
Campcodes Online Flight Booking Management System 1.0 contains a SQL injection vulnerability in the /admin/save_airlines.php file via the ID argument, allowing remote unauthenticated exploitation.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Flight Booking Management System allows unauthenticated attackers to remotely manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-8960

Affected Software: Campcodes Online Flight Booking Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/save_airlines.php script. An unauthenticated attacker can supply malicious input via the ID argument to bypass security controls and interact directly with the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data exposure, modification, or deletion within the flight booking database. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of system information, potentially resulting in service disruption or loss of sensitive user data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin directory using network-level controls or authentication proxies.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/save_airlines.php, particularly those containing SQL syntax or unusual character strings in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment and the availability of a public proof-of-concept, exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote interaction with the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a clear and present danger to affected deployments. Security teams should prioritize restricting external access to the administrative interface and implement strict input validation at the WAF level until the vendor releases a secure version of the software.

Description Summary:
Campcodes Online Flight Booking Management System 1.0 contains a SQL injection vulnerability in the departure_airport_id parameter of the flights.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Flight Booking Management System 1.0 exposes the application to remote database manipulation and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-8957

Affected Software: Campcodes Online Flight Booking Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the flights.php script. An unauthenticated remote attacker can manipulate the departure_airport_id argument to execute malicious SQL queries against the backend database.

Business Impact

The ability to perform SQL injection allows an attacker to bypass authentication, extract sensitive customer booking information, or modify database contents. Given the CVSS score of 7.3, this high-severity flaw poses a significant risk to data confidentiality and integrity, potentially leading to regulatory non-compliance and loss of customer trust.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the affected flights.php file or disable the booking system until a secure version is released.

Proactive Monitoring: Security teams should audit web server access logs for anomalous SQL syntax, such as UNION, SELECT, or SLEEP commands, originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious payloads targeting the departure_airport_id parameter.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up provided via the VulDB reference.

Analyst Notes: As of August 15, 2025, there is no public information indicating active exploitation in the wild. However, the presence of a public proof-of-concept makes this vulnerability highly accessible to threat actors, necessitating prompt mitigation.

Analyst Recommendation

The vulnerability in the Online Flight Booking Management System presents a clear and immediate risk due to the availability of proof-of-concept code. Organizations using this software must prioritize the implementation of compensating controls, such as WAF rules, and maintain heightened monitoring until the vendor provides a security update to address the SQL injection flaw.

Description Summary:
Campcodes Online Flight Booking Management System 1.0 contains a remote SQL injection vulnerability in the login component via the Username parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Flight Booking Management System 1.0 allows remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-8952

Affected Software: Campcodes Online Flight Booking Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability occurring within the admin/ajax.php file. An unauthenticated remote attacker can manipulate the Username argument to execute unauthorized database queries.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation allows an attacker to bypass authentication mechanisms, potentially leading to unauthorized data access, modification, or full administrative takeover of the system. This poses a significant threat to the confidentiality and integrity of flight booking data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the administrative login interface. If possible, disable the vulnerable component until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server logs for suspicious activity targeting the /admin/ajax.php endpoint, specifically looking for SQL syntax patterns or anomalies in the Username parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the login interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided via the referenced vulnerability database.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote nature and the lack of complex requirements for execution.

Analyst Recommendation

This vulnerability represents a significant security risk due to the ease of exploitation and the critical nature of the authentication bypass. Organizations utilizing this system must prioritize restricting external access to the affected login files immediately. Monitor vendor communications closely for the release of an official security patch to address the underlying injection flaw.

Description Summary:
Campcodes Online Recruitment Management System 1.0 is vulnerable to remote SQL injection via the ID parameter in the view_vacancy page, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to compromise database integrity and potentially exfiltrate sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-8950

Affected Software: Campcodes Online Recruitment Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the ID argument within the Recruitment/index.php?page=view_vacancy endpoint. This SQL injection flaw can be triggered remotely by an unauthenticated attacker to manipulate backend database operations.

Business Impact

Successful exploitation of this vulnerability permits unauthorized database interaction, which may lead to the exposure of applicant data, credentials, or other sensitive recruitment information. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches and a loss of organizational trust.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected recruitment portal or implement strict input validation rules to block malicious SQL syntax.

Proactive Monitoring: Review web server access logs for suspicious patterns in URL parameters, specifically looking for SQL keywords or anomalous character sequences directed at the view_vacancy page.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the identified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of August 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its lack of authentication requirements and the ease with which the vulnerable parameter can be manipulated.

Analyst Recommendation

Due to the public availability of exploit code and the lack of an official vendor patch, this vulnerability poses a significant risk to any organization running the affected software. Security teams must prioritize isolating the vulnerable system from public access or applying robust WAF filtering to prevent unauthorized database access until a formal security update is released by the vendor.

Description Summary:
Campcodes Online Hotel Reservation System 1.0 contains an unauthenticated SQL injection vulnerability in the login component, specifically within the /admin/index.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Hotel Reservation System 1.0 allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-8378

Affected Software: Campcodes Online Hotel Reservation System

Affected Versions: 1.0

Vulnerability: The application is vulnerable to SQL injection (CWE-89) within the /admin/index.php file. An unauthenticated remote attacker can manipulate the username and password arguments to inject malicious SQL commands.

Business Impact

This vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation allows an attacker to interact directly with the backend database, which may lead to unauthorized data access, modification, or potential administrative account takeover, causing significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /admin/index.php containing SQL syntax characters, such as single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases an update.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue at https://github.com/XiaoJiesecqwq/sql/issues/1.

Analyst Notes: As of August 1, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the unauthenticated nature of the login endpoint.

Analyst Recommendation

Due to the lack of an official patch and the public disclosure of a proof-of-concept, this vulnerability poses an immediate risk to any exposed instances. Security teams must prioritize isolating the administrative login portal and implementing WAF protections immediately to prevent exploitation.

Description Summary:
A SQL injection vulnerability in the Campcodes Online Recruitment Management System allows remote, unauthenticated attackers to manipulate the ID argument in admin/ajax.php.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Recruitment Management System allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-8336

Affected Software: Campcodes Online Recruitment Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the admin/ajax.php file, specifically within the save_user function. An unauthenticated attacker can exploit this remotely by manipulating the ID argument to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive recruitment data, including user credentials and personal applicant information. Given the CVSS score of 7.3, this flaw poses a high risk to data confidentiality and integrity, potentially leading to full database compromise if the application service account holds excessive privileges.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the vulnerable ajax.php endpoint.

Proactive Monitoring: Monitor server access logs for suspicious HTTP requests targeting the admin/ajax.php file, particularly those containing SQL syntax characters like single quotes or dashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until the vendor releases a secure update.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at https://github.com/CVE-Hunter-Leo/CVE/issues/2.

Analyst Notes: As of July 31, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Given the public availability of exploit code and the lack of a vendor-provided patch, this vulnerability presents an immediate risk. Organizations utilizing this system must prioritize network segmentation and WAF-based filtering to block external access to the vulnerable administration endpoint until a formal security update is verified and applied.

Description Summary:
Campcodes Online Recruitment Management System 1.0 contains a SQL injection vulnerability in the admin/ajax.php file, allowing remote attackers to manipulate database queries via the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Recruitment Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries.

Vulnerability Details

CVE-ID: CVE-2025-8334

Affected Software: Campcodes Online Recruitment Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the file /admin/ajax.php. An unauthenticated attacker can supply malicious input to the ID argument to execute unauthorized database commands.

Business Impact

The ability to perform remote SQL injection allows an attacker to potentially extract, modify, or delete sensitive data stored within the recruitment system database. With a CVSS score of 7.3, this flaw poses a high risk to the confidentiality and integrity of applicant and administrative information, potentially leading to unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/ajax.php, particularly those containing SQL syntax characters such as single quotes, dashes, or union keywords.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the research write-up at the provided GitHub reference.

Analyst Notes: As of July 31, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability presents a significant risk to affected installations. Organizations must prioritize network-level restrictions to prevent unauthorized access to the vulnerable administrative endpoint until the vendor releases a security update.

Description Summary:
Campcodes Online Recruitment Management System 1.0 contains an unauthenticated SQL injection vulnerability in the admin/ajax.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Recruitment Management System allows unauthenticated remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-8274

Affected Software: Campcodes Online Recruitment Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID parameter in the /admin/ajax.php file when the action is set to save_recruitment_status. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive applicant data, modification of recruitment records, or potential administrative compromise of the underlying database. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, necessitating immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict access to the /admin/ajax.php endpoint or disable the affected functionality entirely until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous requests directed at /admin/ajax.php, particularly those containing SQL syntax characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the recruitment system.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of July 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database backend through a publicly accessible AJAX endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be treated as high priority. Organizations currently running Campcodes Online Recruitment Management System 1.0 must implement strict network-level access controls to isolate the vulnerable endpoint until an official patch is provided by the vendor.

Description Summary:
Campcodes Online Movie Theater Seat Reservation System 1.0 is vulnerable to unauthenticated remote SQL injection via the ID parameter in /admin/manage_seat.php.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Movie Theater Seat Reservation System allows unauthenticated remote attackers to compromise the application database.

Vulnerability Details

CVE-ID: CVE-2025-7838

Affected Software: Campcodes Online Movie Theater Seat Reservation System

Affected Versions: 1.0

Vulnerability: This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the ID argument of the /admin/manage_seat.php file. The flaw is remotely exploitable by unauthenticated users, permitting arbitrary SQL command execution.

Business Impact

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or deletion of sensitive reservation records. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity. If the database user has elevated permissions, the impact could extend to full system compromise or unauthorized administrative access.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory using IP allowlisting or VPN requirements. If possible, disable the vulnerable component until a vendor-supplied security update is released.

Proactive Monitoring: Monitor web server access logs for anomalous HTTP requests containing SQL syntax patterns or unexpected characters targeting the /admin/manage_seat.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of July 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The lack of authentication requirements makes this vulnerability highly accessible to remote actors.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the lack of authentication required to trigger the flaw, this vulnerability presents a credible risk to the platform. Organizations currently running version 1.0 should prioritize implementing compensating controls, such as WAF filtering, immediately while awaiting a formal vendor patch.

Description Summary:
A critical unrestricted file upload vulnerability exists in Campcodes Online Movie Theater Seat Reservation System 1.0, allowing unauthenticated remote code execution via the save_movie function.

Executive Summary:
An unauthenticated remote file upload vulnerability in Campcodes Online Movie Theater Seat Reservation System 1.0 allows attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-7547

Affected Software: Campcodes Online Movie Theater Seat Reservation System

Affected Versions: 1.0

Vulnerability: The application fails to perform adequate file type validation within the save_movie function located in /admin/admin_class.php. An unauthenticated attacker can upload arbitrary files, such as malicious PHP scripts, to the server directory, leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain full control over the underlying web server. This could result in complete data compromise, unauthorized modification of reservation records, and potential pivot points into the broader internal network. Given the CVSS score of 7.3, this represents a significant risk to system integrity and confidentiality.

Remediation Plan

Immediate Action: As there is currently no official patch available, administrators should immediately restrict access to the /admin/ directory using network-level controls or web server authentication.

Proactive Monitoring: Monitor server logs for POST requests directed at /admin/ajax.php?action=save_movie that contain suspicious file extensions or unexpected Content-Type headers.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads that do not conform to expected image MIME types or file extensions within the reservation system.

Exploitation Status

Public Exploit Available: Yes, a technical proof-of-concept and exploitation instructions are available via the public GitHub issue referenced in the research documentation.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to execute the malicious upload.

Analyst Recommendation

Due to the critical nature of this flaw and the availability of public exploitation details, organizations currently running version 1.0 of the Campcodes Online Movie Theater Seat Reservation System are at high risk. Until an official vendor patch is released, it is strongly recommended to isolate the application from the public internet or disable the vulnerable file upload functionality entirely to prevent potential system compromise.

Description Summary:
Campcodes Sales and Inventory System 1.0 contains an unrestricted file upload vulnerability in the product update page, allowing remote attackers to upload arbitrary files.

Executive Summary:
A critical unrestricted file upload vulnerability in Campcodes Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute arbitrary file uploads.

Vulnerability Details

CVE-ID: CVE-2025-7538

Affected Software: Campcodes Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly validate the image argument within the /pages/product_update.php file, which allows an unauthenticated attacker to perform an unrestricted file upload.

Business Impact

The ability to upload arbitrary files to a web server poses a significant risk to the integrity and security of the hosting environment. Successful exploitation can lead to remote code execution, unauthorized access to sensitive data, or the complete compromise of the web application. Given the CVSS score of 7.3, this represents a high-risk vulnerability that could facilitate further lateral movement within the network.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /pages/product_update.php endpoint or disable the affected inventory system functionality until a vendor update is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious POST requests targeting the product update page and inspect the upload directory for anomalous file types or execution attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized file uploads and enforce strict file extension filtering for all user-supplied content.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it lacks any access control, allowing any remote user to interact with the vulnerable endpoint.

Analyst Recommendation

This vulnerability presents a clear and present danger due to the ease of exploitation and the lack of authentication requirements. Organizations utilizing Campcodes Sales and Inventory System 1.0 must prioritize the implementation of compensating controls, such as WAF rules or network segmentation, to prevent unauthorized access to the vulnerable upload function. Continuous monitoring for indicators of compromise is essential until a formal vendor patch is applied.

Description Summary:
Campcodes Sales and Inventory System 1.0 is vulnerable to remote SQL injection in the product_update.php file via the ID argument, potentially allowing unauthorized database manipulation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 exposes the application to remote database manipulation by unauthenticated attackers.

Vulnerability Details

CVE-ID: CVE-2025-7537

Affected Software: Campcodes Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL Injection (CWE-89) within the /pages/product_update.php script, where the ID parameter fails to properly sanitize user input. This vulnerability is remotely exploitable by unauthenticated attackers.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands poses a significant threat to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive inventory records, potential data exfiltration, or modification of application database content. With a CVSS score of 7.3, this flaw represents a high-severity risk to business operations and data security.

Remediation Plan

Immediate Action: Since no official patch is currently identified, administrators should restrict network access to the vulnerable endpoint and consider disabling the affected functionality until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing SQL syntax patterns targeting the /pages/product_update.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Sales and Inventory System 1.0 must implement strict network segmentation or Web Application Firewall filtering immediately. Prioritize monitoring for suspicious traffic patterns while awaiting further guidance or a formal security patch from the vendor.

Description Summary:
Campcodes Sales and Inventory System 1.0 is vulnerable to remote SQL injection in the receipt_credit.php file via the sid parameter, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 exposes the application to remote, unauthenticated database manipulation and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-7536

Affected Software: Campcodes Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /pages/receipt_credit.php file. An unauthenticated attacker can remotely trigger this issue by manipulating the sid argument to execute unauthorized database commands.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access or modification. Successful exploitation could allow an attacker to dump sensitive inventory or sales data, potentially leading to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected installation and disable the vulnerable /pages/receipt_credit.php endpoint if possible.

Proactive Monitoring: Monitor database query logs for suspicious patterns or unexpected syntax that deviates from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and filter malicious inputs targeting the sid parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability presents a significant risk to affected environments. Organizations must prioritize restricting access to the vulnerable system and implementing robust WAF rules to mitigate the potential for SQL injection attacks until an official security update is released.

Description Summary:
Campcodes Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the sid parameter in the /pages/reprint_cash.php file, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-7535

Affected Software: Campcodes Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered by improper sanitization of the sid argument in the /pages/reprint_cash.php file. The vulnerability is remotely exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N.

Business Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database. This can lead to unauthorized data exfiltration, modification of inventory records, or complete loss of database confidentiality and integrity. With a CVSS score of 7.3, this represents a high risk to business operations, particularly for organizations relying on this software for transaction and stock management.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /pages/reprint_cash.php endpoint or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns or unexpected characters within the sid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up referenced in the CVE record.

Analyst Notes: As of July 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to the integrity of the Sales and Inventory System. Administrators must treat this as a priority and implement stringent access controls or WAF filtering immediately to prevent potential data breaches while awaiting a vendor-supplied security update.

Description Summary:
Campcodes Payroll Management System 1.0 contains a SQL injection vulnerability in the /ajax.php endpoint via the ID parameter, allowing remote attackers to execute arbitrary database queries.

Executive Summary:
Campcodes Payroll Management System 1.0 is vulnerable to remote SQL injection, which could allow unauthorized database access and manipulation.

Vulnerability Details

CVE-ID: CVE-2025-7220

Affected Software: Campcodes Payroll Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered through the ID parameter within the /ajax.php?action=save_deductions endpoint. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive payroll data, potential modification of financial records, or the extraction of database contents, which could result in regulatory non-compliance and reputational harm. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized system interaction.

Remediation Plan

Immediate Action: Since a vendor-provided patch is currently unknown, administrators should restrict access to the affected /ajax.php endpoint via network controls or disable the Payroll Management System until a secure version is released.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests to /ajax.php, specifically monitoring for SQL syntax patterns or unexpected character strings in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application's input parameters.

Exploitation Status

Public Exploit Available: Yes, a published PoC exists, attributed to the researcher write-up at https://github.com/skyrainoh/CVE/issues/8.

Analyst Notes: As of July 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input parameter is not properly sanitized before being processed by the backend database.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a credible risk to the organization. Organizations currently utilizing Campcodes Payroll Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, and actively monitor for signs of unauthorized database interaction until an official vendor update is provided and applied.

Description Summary:
Campcodes Payroll Management System 1.0 contains a SQL injection vulnerability in the ajax.php file, allowing remote attackers to manipulate the ID argument to execute unauthorized database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-7219

Affected Software: Campcodes Payroll Management System

Affected Versions: 1.0

Vulnerability: The vulnerability resides in the ajax.php file, specifically within the delete_allowances function. An unauthenticated attacker can supply a malicious ID parameter to perform SQL injection, potentially leading to unauthorized data access or modification.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to the confidentiality and integrity of payroll data. Successful exploitation could lead to unauthorized extraction of sensitive employee information or the corruption of system records, resulting in severe operational disruption and potential regulatory non-compliance. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized database interaction.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected ajax.php endpoint via network controls or disable the vulnerable payroll module until a security update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests to ajax.php and monitor database query logs for suspicious activity or syntax errors indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting parameters in the URL query string.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced by the vulnerability research.

Analyst Notes: As of July 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature and the lack of complex requirements for execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation via the unauthenticated ajax.php endpoint, this vulnerability represents a significant risk to the environment. Organizations should prioritize isolating the affected component and implement robust WAF filtering immediately. Maintain close contact with the vendor for the release of an official security patch to permanently resolve this injection flaw.

Description Summary:
Campcodes Payroll Management System 1.0 is vulnerable to unauthenticated SQL injection via the ajax.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-7218

Affected Software: Campcodes Payroll Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /ajax.php endpoint, specifically triggered via the ID parameter. An unauthenticated remote attacker can inject malicious SQL commands to manipulate backend database operations.

Business Impact

The exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification of payroll records, or potential system instability. With a CVSS score of 7.3, this flaw presents a high risk to business operations, as the lack of required authentication makes it easily accessible to remote threat actors.

Remediation Plan

Immediate Action: As there is no official patch available, administrators should restrict network access to the /ajax.php endpoint and consider disabling the affected functionality if it is not business critical.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests containing SQL syntax patterns or unusual characters directed toward the ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of July 10, 2025, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its unauthenticated nature and the relative ease of executing SQL injection attacks against the specified endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official vendor patch, this vulnerability poses a significant risk to affected installations. Organizations must prioritize immediate mitigation by implementing WAF rules and restricting access to the vulnerable endpoint until a formal security update is released by Campcodes.

Description Summary:
Campcodes Payroll Management System 1.0 is vulnerable to SQL injection via the ID parameter in the /ajax.php?action=save_position endpoint, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Payroll Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-7217

Affected Software: Campcodes Payroll Management System

Affected Versions: 1.0

Vulnerability: This is an SQL injection vulnerability (CWE-89) triggered by the improper sanitization of the ID parameter within the /ajax.php?action=save_position endpoint. The vulnerability is remotely exploitable without requiring authentication.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive payroll information or the modification of critical system data. With a CVSS score of 7.3, this flaw represents a high-severity risk that could lead to full database compromise if the application service account lacks proper restrictions.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected /ajax.php endpoint via network controls or disable the Payroll Management System until a secure update is provided by Campcodes.

Proactive Monitoring: Review web server access logs for anomalous requests to the /ajax.php endpoint, specifically looking for URL parameters containing SQL syntax or unusual character sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the technical write-up at the referenced GitHub repository.

Analyst Notes: As of July 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the injection vector makes this vulnerability highly susceptible to automated scanning and exploitation.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack, this vulnerability poses an immediate risk to any deployment of Campcodes Payroll Management System 1.0. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied patch is released and verified.

Description Summary:
Campcodes Supplier Management System 1.0 contains a SQL injection vulnerability in the chkId[] parameter of the admin/view_products.php file, allowing unauthenticated remote code execution.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise the underlying database, posing a critical risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-15207

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the chkId[] parameter within the /admin/view_products.php file before incorporating it into SQL queries. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands, resulting in unauthorized database access and potential data manipulation.

Business Impact

Successful exploitation of this vulnerability can result in full unauthorized access to the application database, leading to the exfiltration of sensitive supplier or administrative data. Given the CVSS score of 7.3, this represents a high-severity risk that could cause significant reputational damage, regulatory non-compliance, and complete loss of confidentiality regarding internal business operations.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the /admin/view_products.php endpoint to authorized IP addresses only or disable the affected module if it is not business critical.

Proactive Monitoring: Monitor database access logs for unusual query patterns, specifically looking for time-based blind injection attempts or unexpected use of sleep functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the chkId[] parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists in the referenced GitHub security issue.

Analyst Notes: As of December 31, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to trigger.

Analyst Recommendation

The presence of a publicly available proof-of-concept increases the likelihood of opportunistic exploitation. Organizations currently running Campcodes Supplier Management System 1.0 must prioritize the implementation of strict input validation and access controls immediately, as the lack of a vendor-supplied patch necessitates robust manual mitigation strategies to prevent unauthorized database compromise.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to SQL injection via the txtAreaCode parameter in /admin/add_area.php, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-15206

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/add_area.php script, where the txtAreaCode parameter fails to sanitize user input. The flaw is exploitable by unauthenticated remote attackers who can inject malicious SQL commands directly into the application database.

Business Impact

Successful exploitation of this vulnerability allows unauthorized actors to access, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete loss of data confidentiality and integrity, potentially resulting in regulatory non-compliance and significant operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/add_area.php endpoint to authorized internal network segments only.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as the use of sleep commands or unexpected syntax, which may indicate active SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the txtAreaCode parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Analyst Notes: As of December 31, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to execute.

Analyst Recommendation

Due to the lack of an official patch and the public availability of exploit code, this vulnerability poses a credible and elevated risk to deployments of the Campcodes Supplier Management System. Organizations should prioritize isolating the affected application from public-facing networks until the vendor provides a secure update that implements prepared statements and rigorous input validation.

Description Summary:
Campcodes Complete Online Beauty Parlor Management System 1.0 contains a SQL injection vulnerability in the admin/view-appointment.php file via the viewid argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-14990

Affected Software: Campcodes Complete Online Beauty Parlor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the admin/view-appointment.php file, which fails to properly sanitize the viewid argument. The vulnerability can be exploited by an unauthenticated remote attacker.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive data stored within the database, or potentially modify administrative records. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application, which could lead to unauthorized access to customer appointments and personal information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/view-appointment.php, particularly those containing SQL syntax characters like single quotes or comment sequences.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the viewid parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up found at the GitHub repository linked in the official CVE references.

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger via the vulnerable parameter.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations using this software must restrict access to the affected management interface until an official vendor patch is released and verified. Prioritize the implementation of network-level access controls to mitigate the risk of remote exploitation.

Description Summary:
A SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the search-invoices.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Complete Online Beauty Parlor Management System 1.0 poses a significant risk of unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2025-14989

Affected Software: Campcodes Complete Online Beauty Parlor Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the search-invoices.php file, which fails to properly sanitize user-supplied input. This flaw is remotely exploitable by an unauthenticated attacker.

Business Impact

Successful exploitation allows an adversary to interact directly with the underlying database, potentially leading to the unauthorized disclosure or modification of sensitive customer and business data. Given the CVSS score of 7.3, this vulnerability is classified as High severity and represents a significant risk to the confidentiality and integrity of the application environment.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected administration interface or take the application offline until a secure version is released.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected SQL syntax errors or attempts to extract large volumes of data, which may indicate active exploitation.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the search-invoices.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the vulnerability disclosure (https://github.com/funnnxxx/my-cve/issues/3).

Analyst Notes: As of December 22, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute malicious database queries.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability necessitates urgent attention. Security teams must treat this as a high-priority risk and implement restrictive access controls or WAF filtering immediately to prevent potential data breaches while awaiting a vendor-supplied security update.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to SQL injection in the /admin/add_category.php file via the txtCategoryName parameter, allowing unauthenticated remote attackers to execute queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 poses a critical risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-14952

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the txtCategoryName parameter within the /admin/add_category.php file, allowing unauthenticated remote attackers to inject malicious SQL commands directly into database queries.

Business Impact

Successful exploitation allows an attacker to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, loss of business integrity, and prolonged service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict network access to the /admin/add_category.php endpoint and implement strict input validation for all POST requests.

Proactive Monitoring: Monitor database query logs for unusual time-based patterns, such as unexpected sleep commands or large-scale data extraction attempts originating from the application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the txtCategoryName parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 21, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to trigger the flaw.

Analyst Recommendation

The presence of a public proof-of-concept significantly elevates the risk of automated exploitation by malicious actors. Organizations currently running Campcodes Supplier Management System 1.0 are urged to isolate the application from external networks and prioritize the implementation of robust input sanitization or transition to a more secure alternative until a vendor-supplied patch is released.

Description Summary:
A SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the cmbAreaCode parameter.

Executive Summary:
The Campcodes Supplier Management System 1.0 is vulnerable to unauthenticated SQL injection, which could lead to complete database compromise and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-14877

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/add_retailer.php file. The application fails to sanitize the cmbAreaCode POST parameter, allowing unauthenticated attackers to inject malicious SQL commands directly into the backend database.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, leak sensitive data, modify database contents, or potentially gain full control over the underlying database server. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant data breaches, regulatory non-compliance, and disruption of business operations.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /admin/add_retailer.php endpoint using network-level controls or by disabling the affected module.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the add_retailer.php file, particularly those containing SQL syntax characters like single quotes, dashes, or SQL keywords such as SELECT and SLEEP.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the cmbAreaCode parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is documented in the researcher's GitHub repository.

Analyst Notes: As of December 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of authentication required for exploitation makes this a significant risk. Organizations utilizing Campcodes Supplier Management System must treat this as a high-priority item. Implement the recommended compensating controls immediately and monitor for unauthorized access until the vendor provides a formal security update.

Description Summary:
Campcodes Advanced Online Examination System 1.0 is vulnerable to unauthenticated SQL injection via the username parameter in the loginExe.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Advanced Online Examination System 1.0 allows unauthenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-14668

Affected Software: Campcodes Advanced Online Examination System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /query/loginExe.php file. An unauthenticated attacker can supply malicious input via the username POST parameter to manipulate backend database queries.

Business Impact

Successful exploitation of this vulnerability permits unauthorized access to the application database, which may result in sensitive data leakage, data tampering, or total system compromise. Given the CVSS score of 7.3 and the unauthenticated nature of the attack vector, this flaw represents a significant risk to the confidentiality and integrity of student and administrative data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the login portal via network-level controls or disable the application until a secure version is released by the vendor.

Proactive Monitoring: Monitor web server access logs for anomalous POST requests to /query/loginExe.php, specifically identifying patterns associated with SQL injection payloads, such as time-based sleep commands or SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the research write-up referenced in the CVE record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it requires no prior authentication to execute.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an elevated risk. Organizations currently utilizing Campcodes Advanced Online Examination System 1.0 must prioritize isolating the affected server from public networks and implementing strict input validation or WAF rules to prevent unauthorized database access while awaiting a vendor-supplied update.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to SQL injection via the chkId[] parameter in /admin/view_unit.php, allowing unauthenticated remote attackers to compromise the database.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated attackers to execute arbitrary database queries, posing a severe risk to data integrity and system confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-14664

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the chkId[] parameter within the /admin/view_unit.php file before using it in SQL queries. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, leading to unauthorized database access.

Business Impact

Successful exploitation permits attackers to bypass security controls to read, modify, or delete sensitive data stored within the backend database. Given the CVSS score of 7.3, this vulnerability represents a high risk that could lead to full database compromise, unauthorized administrative actions, and significant business disruption.

Remediation Plan

Immediate Action: As no official vendor patch is currently identified, administrators should restrict access to the affected endpoint at the network or web server level. Disable the vulnerable functionality if it is not business-critical until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting /admin/view_unit.php, specifically monitoring for anomalous character strings or time-based delay patterns indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP POST parameters. Additionally, ensure the application connects to the database using an account with the least privilege necessary to limit the potential impact of an exploit.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of December 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it requires no authentication and targets a common injection vector.

Analyst Recommendation

The presence of a publicly available proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Organizations using Campcodes Supplier Management System should prioritize implementing the suggested compensating controls immediately to prevent unauthorized database access while awaiting further guidance or a patch from the vendor.

Description Summary:
Campcodes Online Student Enrollment System 1.0 contains an unrestricted file upload vulnerability in the /admin/register.php script, allowing remote attackers to upload arbitrary files.

Executive Summary:
An unauthenticated remote file upload vulnerability in the Campcodes Online Student Enrollment System poses a significant risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2025-14583

Affected Software: Campcodes Online Student Enrollment System

Affected Versions: 1.0

Vulnerability: This flaw exists due to improper access controls and unrestricted file upload validation within the photo argument of the /admin/register.php file. The vulnerability is remotely exploitable by unauthenticated attackers.

Business Impact

The ability for an unauthenticated user to upload arbitrary files to the server can lead to full system compromise, as attackers may upload web shells to execute remote code. Given the CVSS score of 7.3, this represents a high severity risk that could result in unauthorized data access, system defacement, or total control of the underlying host environment.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unknown, administrators should immediately restrict access to the /admin/register.php endpoint or disable the registration feature until a security update is released.

Proactive Monitoring: Review web server access logs for suspicious file upload requests or attempts to access non-image file types within the upload directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block malicious file uploads and restrict access to administrative paths to trusted IP addresses only.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept is available via the GitHub issue referenced in the vulnerability report.

Analyst Notes: As of December 14, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of file uploads on the server.

Analyst Recommendation

This vulnerability is classified as high severity due to the potential for remote code execution via unrestricted file uploads. Organizations utilizing the Campcodes Online Student Enrollment System must treat this as a priority and implement strict network-level access controls or WAF rules immediately, as no official patch is currently available to resolve the underlying flaw.

Description Summary:
Campcodes Retro Basketball Shoes Online Store 1.0 is vulnerable to unauthenticated SQL injection via the pid argument in the admin_running.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-14529

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the admin_running.php file. An unauthenticated attacker can execute arbitrary SQL commands by manipulating the pid argument, potentially leading to unauthorized data exposure or modification.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to interact directly with the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity. If exploited, the breach could result in the unauthorized extraction of sensitive store information, customer data, or administrative credentials, leading to potential operational disruption and reputational harm.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements. Developers must sanitize all inputs within the pid argument of admin_running.php to prevent SQL injection.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the admin_running.php endpoint, particularly those containing SQL syntax characters like single quotes, dashes, or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block common SQL injection patterns targeting the identified vulnerable script.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via a security researcher's GitHub issue report.

Analyst Notes: As of December 11, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the ease of triggering the injection via a simple GET or POST request.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability makes this a high-priority issue for any organization hosting this software. Given the lack of a vendor-provided patch, immediate isolation of the affected administrative interface is required to prevent unauthorized access. Organizations should prioritize migrating away from this software or implementing strict network-level access controls until the vendor releases a secure update.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to remote SQL injection via the txtunitDetails parameter in the /admin/add_unit.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-14515

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a classic SQL injection (CWE-89) triggered by improper sanitization of the txtunitDetails argument within the /admin/add_unit.php script. The vulnerability is remotely exploitable by an unauthenticated attacker, allowing them to manipulate database queries directly.

Business Impact

Successful exploitation of this flaw enables an attacker to read, modify, or delete sensitive information stored within the application database. Given the CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exfiltration or complete loss of database confidentiality and integrity. The ability for unauthenticated remote access significantly increases the likelihood of a successful breach.

Remediation Plan

Immediate Action: As no official patch is currently available from the vendor, administrators should restrict network access to the /admin/add_unit.php endpoint or disable the affected module entirely until a security update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing SQL syntax patterns targeting the /admin/add_unit.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing malicious SQL injection payloads directed at the vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the GitHub issue reported in the exploit references.

Analyst Notes: As of December 11, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the presence of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents an immediate risk to the environment. Organizations currently utilizing Campcodes Supplier Management System version 1.0 must prioritize isolating the affected application from public-facing networks until a vendor-supplied patch is applied. Consistent monitoring for unauthorized database activity is essential to identify potential compromise attempts.

Description Summary:
Campcodes Supplier Management System 1.0 contains a SQL injection vulnerability in the add_distributor.php file, allowing remote attackers to manipulate the txtDistributorAddress argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-14514

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the txtDistributorAddress argument within the /admin/add_distributor.php endpoint. This SQL injection flaw can be triggered by an unauthenticated attacker, potentially allowing unauthorized database manipulation.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL commands poses a significant threat to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data exfiltration or modification within the supplier management database, resulting in potential operational disruption and loss of proprietary information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN authentication to prevent unauthorized requests.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/add_distributor.php, specifically looking for SQL syntax patterns or unusual string lengths in the txtDistributorAddress parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP requests containing common SQL injection payloads directed at the vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of December 12, 2025, there is no confirmed active exploitation in the wild; however, a published proof-of-concept exists via the researcher's write-up, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently running Campcodes Supplier Management System 1.0 must implement strict access controls on the administrative interface and deploy WAF rules to mitigate the risk until an official vendor update is released.

Description Summary:
Campcodes School File Management System 1.0 contains an SQL injection vulnerability in the update_query.php file, allowing remote attackers to manipulate the stud_id argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes School File Management System 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-14209

Affected Software: Campcodes School File Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located within the update_query.php file. It is triggered by the manipulation of the stud_id parameter and can be executed by an unauthenticated remote attacker.

Business Impact

The ability to perform remote SQL injection poses a significant risk to the integrity and confidentiality of the underlying database. While the CVSS score of 7.3 reflects a High severity, the impact could include unauthorized data exposure or administrative access to the application data store, leading to potential operational disruption and loss of student records.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the update_query.php file or disable the affected module entirely until a vendor update is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for unusual characters or SQL syntax in requests targeting the update_query.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeting the stud_id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of December 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate threat to the environment. Organizations currently running Campcodes School File Management System 1.0 must prioritize restricting external access to the vulnerable script and monitoring for unauthorized database interaction until a formal vendor patch is applied.

Description Summary:
Campcodes Online Polling System 1.0 is vulnerable to unauthenticated SQL injection via the email parameter in the registeracc.php file.

Executive Summary:
Campcodes Online Polling System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13557

Affected Software: Campcodes Online Polling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the registeracc.php file. The application fails to properly sanitize the email input parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the application database, potentially resulting in data exfiltration or modification. Given the CVSS score of 7.3, this represents a high-risk security flaw that could lead to full compromise of the polling system and sensitive user information stored within the backend database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the registeracc.php endpoint or disable the registration functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the registeracc.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application registration forms.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced on GitHub (ProgramShowMaker/CVE/issues/3).

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

This vulnerability presents a significant risk due to the lack of required authentication and the presence of a public proof-of-concept. Organizations utilizing the Campcodes Online Polling System must prioritize limiting exposure of the vulnerable registeracc.php endpoint immediately and monitor vendor communications for an official security update to address the injection flaw.

Description Summary:
Campcodes Online Polling System 1.0 contains an unauthenticated SQL injection vulnerability in the /admin/checklogin.php file via the myusername parameter.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Polling System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-13556

Affected Software: Campcodes Online Polling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/checklogin.php script. An unauthenticated remote attacker can manipulate the myusername argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive administrative credentials or the entire contents of the polling database. With a CVSS score of 7.3, this flaw represents a significant risk that could result in total compromise of the application data layer.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests to /admin/checklogin.php, particularly those containing SQL syntax characters like single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule designed to detect and block SQL injection patterns targeting the myusername parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research reference provided by the CVE record.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per the CVE record, a published proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require prior authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the exploit, this vulnerability requires immediate attention. Organizations utilizing Campcodes Online Polling System 1.0 must implement strict access controls and WAF protections immediately to mitigate the risk of unauthorized database manipulation while awaiting a formal vendor security update.

Description Summary:
Campcodes School File Management System 1.0 contains an unauthenticated SQL injection vulnerability in the login index.php file via the stud_no parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the Campcodes School File Management System allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-13555

Affected Software: Campcodes School File Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the login component, specifically within the index.php file. The vulnerability is triggered by manipulating the stud_no argument, and it can be exploited remotely by an unauthenticated attacker.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the backend database, potentially leading to the unauthorized disclosure or modification of sensitive student and administrative information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to a full compromise of the application data layer.

Remediation Plan

Immediate Action: Since no specific patch is currently available, administrators should restrict access to the login interface using network-level controls or a Web Application Firewall until an official vendor update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns in the stud_no parameter and monitor database audit logs for unusual query activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced on GitHub.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes School File Management System 1.0 must prioritize isolating the affected component from the public internet and implementing stringent WAF filtering to prevent potential data breaches while awaiting a vendor-supplied security update.

Description Summary:
A SQL injection vulnerability in the Campcodes Supplier Management System 1.0 login page allows unauthenticated remote attackers to manipulate the txtUsername parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows remote attackers to compromise database integrity and potentially bypass authentication.

Vulnerability Details

CVE-ID: CVE-2025-13554

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: The flaw exists within the index.php file of the Login component, where the txtUsername argument fails to properly sanitize user input. This allows an unauthenticated attacker to execute arbitrary SQL commands remotely.

Business Impact

The ability to perform unauthenticated SQL injection represents a significant risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to extract sensitive supplier data, manipulate records, or gain unauthorized access to the management console, leading to potential operational disruption and loss of trust.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the login portal and implement strict input validation at the Web Application Firewall level.

Proactive Monitoring: Review web server access logs for anomalous characters or SQL syntax patterns within the txtUsername parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule specifically designed to detect and block SQL injection attempts targeting the index.php login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up referenced at https://github.com/arpcyber060/CVE/issues/3.

Analyst Notes: As of November 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, immediate defensive measures are required. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied security patch is released and validated.

Description Summary:
Campcodes Retro Basketball Shoes Online Store 1.0 is vulnerable to unauthenticated remote SQL injection via the tid argument in the admin/receipt.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13410

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the tid argument of the admin/receipt.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially exposing sensitive database information.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the compromise of customer data or administrative credentials. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to the confidentiality and integrity of the application. Failure to address this issue may lead to data breaches and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /admin/receipt.php file or disable the vulnerable component entirely until a fix is provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the admin/receipt.php endpoint, specifically looking for unusual patterns in the tid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 20, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to any deployment of Campcodes Retro Basketball Shoes Online Store 1.0. Organizations should prioritize isolating the affected application from the internet and monitor for signs of unauthorized database interaction until the vendor releases a security update.

Description Summary:
Campcodes Supplier Management System 1.0 is vulnerable to remote SQL injection in the manufacturer/confirm_order.php file via manipulation of the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Supplier Management System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13291

Affected Software: Campcodes Supplier Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /manufacturer/confirm_order.php file. An unauthenticated attacker can exploit this by manipulating the ID parameter to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated remote attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive supplier or order information stored within the application database. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent potential data exfiltration or database compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected file or disable the vulnerable module until the vendor releases a security update.

Proactive Monitoring: Review application and database logs for suspicious SQL syntax, such as unexpected UNION, SELECT, or sleep commands, specifically targeting the confirm_order.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns and sanitize input for all HTTP requests targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical documentation provided in the referenced GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, the risk of exploitation is elevated. Organizations currently running Campcodes Supplier Management System 1.0 must prioritize isolating the affected system from external networks and implementing strict WAF filtering to mitigate the threat until a vendor-supplied update is available.

Description Summary:
Campcodes School Fees Payment Management System 1.0 contains a remote SQL injection vulnerability in manage_course.php via the ID parameter.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes School Fees Payment Management System allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-13272

Affected Software: Campcodes School Fees Payment Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the manage_course.php file, where insufficient input validation on the ID argument allows an unauthenticated attacker to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated remote attacker to inject SQL commands poses a significant threat to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or financial records stored within the database, potentially resulting in data exfiltration or system compromise. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized database manipulation.

Remediation Plan

Immediate Action: Since no official patch is currently available, users should restrict network access to the application or disable the vulnerable manage_course.php file if it is not business-critical.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests containing SQL syntax or unusual parameters targeting the manage_course.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the research documentation provided by ASantsSec on GitHub.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the backend database.

Analyst Recommendation

The presence of a public proof-of-concept combined with the lack of an official patch makes this a high-priority risk. Organizations utilizing this system must implement immediate network-level protections or WAF filtering to mitigate the threat of remote SQL injection. Security teams should prioritize moving this application behind restrictive access controls until the vendor provides a secure update.

Description Summary:
Campcodes School Fees Payment Management System 1.0 contains a SQL injection vulnerability in the login function, allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes School Fees Payment Management System 1.0 poses a significant risk of unauthorized database interaction and potential information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-13271

Affected Software: Campcodes School Fees Payment Management System

Affected Versions: 1.0

Vulnerability: The vulnerability exists within the ajax.php file, specifically via the login action. An unauthenticated attacker can inject malicious SQL commands into the Username parameter, leading to unauthorized database manipulation.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands presents a high risk to data integrity and confidentiality. With a CVSS score of 7.3, this flaw could allow an attacker to bypass authentication mechanisms, access sensitive student or financial records, or potentially modify system data. Such an incident could result in significant operational disruption and loss of sensitive institutional information.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the affected web interface or implement input validation controls to sanitize the Username parameter. If possible, disable the vulnerable login functionality until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for suspicious patterns or anomalous characters in login requests directed at ajax.php. Monitor database query logs for unexpected syntax errors or unauthorized access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of November 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization in the login module.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes School Fees Payment Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules, to mitigate the risk until the vendor releases a formal security patch. Continuous monitoring for signs of unauthorized access is essential for maintaining the security posture of the affected system.

Description Summary:
Campcodes Retro Basketball Shoes Online Store 1.0 contains a SQL injection vulnerability in the admin_football.php file, allowing unauthenticated remote attackers to manipulate the pid argument.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 poses a significant risk of unauthorized database interaction and data exposure.

Vulnerability Details

CVE-ID: CVE-2025-12339

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /admin/admin_football.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the pid argument.

Business Impact

The ability for an unauthenticated remote attacker to perform SQL injection can lead to unauthorized access to sensitive data, potential modification of database content, and overall compromise of the application integrity. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention as it allows for trivial exploitation of the backend database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable functionality if possible.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/admin_football.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or comment indicators in the pid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block common SQL injection patterns directed at the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of October 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability presents a tangible risk to any deployment of the affected software. Organizations currently running Campcodes Retro Basketball Shoes Online Store 1.0 should prioritize isolating the application until a vendor-supplied security update is released and verified.

Description Summary:
A SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows remote attackers to manipulate the pid argument in /admin/admin_product.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store version 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-12338

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the /admin/admin_product.php file. An unauthenticated remote attacker can exploit this by manipulating the pid parameter to execute arbitrary SQL commands.

Business Impact

The exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in data exfiltration or integrity compromise. Given the CVSS score of 7.3, this is classified as a High severity issue. Failure to mitigate this flaw may allow attackers to gain visibility into sensitive backend information, threatening the confidentiality and operational security of the online store.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until a vendor-supplied update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /admin/admin_product.php file, specifically looking for SQL syntax patterns within the pid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/HYLCXH/CVE/issues/16.

Analyst Notes: As of October 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with database-level queries.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a credible risk to the affected infrastructure. Organizations should prioritize isolating the vulnerable application component and monitoring for suspicious activity until an official security patch is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in Campcodes Retro Basketball Shoes Online Store 1.0 via the pid argument in /admin/admin_feature.php, allowing remote unauthenticated attackers to execute queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-12337

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located within the /admin/admin_feature.php script. An unauthenticated remote attacker can manipulate the pid parameter to inject malicious SQL commands into the application database.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting its high potential for impact despite the limited scope of the base vector. Successful exploitation could lead to unauthorized data exposure, modification of database contents, or potential service disruption within the online store environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax or unexpected query patterns originating from the /admin/admin_feature.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the pid parameter in the application URL structure.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's write-up at the referenced GitHub repository.

Analyst Notes: As of October 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit significantly lowers the barrier for attackers to weaponize this flaw.

Analyst Recommendation

Given the availability of a public proof-of-concept, this vulnerability should be treated with high priority. Organizations using this software must implement immediate network-level restrictions to prevent unauthorized access to the vulnerable administrative endpoint until an official vendor patch is released.

Description Summary:
Campcodes Retro Basketball Shoes Online Store 1.0 contains an unauthenticated SQL injection vulnerability in the admin_index.php file via the Username parameter.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-12336

Affected Software: Campcodes Retro Basketball Shoes Online Store

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection through the Username argument in the admin_index.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

Business Impact

The vulnerability carries a CVSS score of 7.3, representing a high risk to the confidentiality, integrity, and availability of the application. Successful exploitation could lead to unauthorized data exposure, bypass of authentication mechanisms, or potential database corruption, which may result in significant operational disruption and loss of sensitive customer information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and consider disabling the vulnerable component until a fix is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns containing SQL keywords or characters like single quotes, dashes, or semicolon delimiters targeting the admin_index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads before they reach the application server.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists via the referenced GitHub issue.

Analyst Notes: As of October 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The presence of a publicly accessible exploit write-up significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the public availability of exploit material and the unauthenticated nature of this vulnerability, immediate defensive measures are required. Organizations should prioritize restricting access to the administrative interface and implementing WAF protections to mitigate the risk of exploitation while awaiting a vendor-supplied security update.

Description Summary:
Campcodes Online Apartment Visitor Management System version 1.0 contains a SQL injection vulnerability in the forgot-password.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
A SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 presents a significant risk of unauthorized database interaction and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2025-11599

Affected Software: Campcodes Online Apartment Visitor Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /forgot-password.php file. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands via the email parameter.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to bypass security controls, extract sensitive user information, or modify database contents. With a CVSS score of 7.3, this flaw is categorized as high severity due to the lack of required authentication and the potential for direct database manipulation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /forgot-password.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server and application logs for anomalous SQL syntax, such as union-based queries or unexpected character patterns originating from the /forgot-password.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules designed to detect and block common SQL injection patterns in HTTP requests directed at the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of October 12, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability poses a clear and present risk to the confidentiality and integrity of the application. Organizations should prioritize implementing WAF filtering and restricting network access to the vulnerable component until an official vendor patch is deployed.

Description Summary:
A SQL injection vulnerability exists in Campcodes Online Learning Management System 1.0 via the date_start argument in /admin/calendar_of_events.php, allowing remote unauthenticated exploitation.

Executive Summary:
Campcodes Online Learning Management System version 1.0 is vulnerable to a remote SQL injection attack that allows unauthenticated adversaries to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-11555

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/calendar_of_events.php file. An unauthenticated remote attacker can trigger the vulnerability by injecting malicious payloads into the date_start parameter.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to gain unauthorized access to the application database. Given the CVSS score of 7.3, this represents a significant risk, potentially resulting in data exfiltration, modification of administrative records, or complete compromise of the learning management system environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements to prevent unauthenticated remote access.

Proactive Monitoring: Review web server and database logs for anomalous input patterns, specifically looking for SQL syntax characters or unexpected strings within the date_start parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting administrative endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/Rowantu/CVE/issues/2.

Analyst Notes: As of October 10, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require authentication to execute.

Analyst Recommendation

Due to the lack of an official patch and the presence of a public proof-of-concept, this vulnerability poses an elevated risk to the availability and integrity of the system. Organizations should immediately implement network-level access controls to isolate the vulnerable administrative endpoint until a vendor-supplied update is released.

Description Summary:
A SQL injection vulnerability in the Campcodes Advanced Online Voting Management System 1.0 allows remote, unauthenticated attackers to execute unauthorized database queries via the Username argument.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Campcodes Advanced Online Voting Management System 1.0 poses a significant risk to data integrity and system confidentiality.

Vulnerability Details

CVE-ID: CVE-2025-11422

Affected Software: Campcodes Advanced Online Voting Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the Username parameter in the /admin/login.php file. This flaw allows an unauthenticated attacker to inject malicious SQL commands, which are executed directly against the backend database.

Business Impact

The ability for an unauthenticated user to interact directly with the database via SQL injection presents a severe risk of unauthorized data exposure, potential modification of records, and unauthorized administrative access. With a CVSS score of 7.3, this high-severity vulnerability could lead to a complete compromise of the voting data and the underlying system, resulting in significant reputational damage and loss of operational trust.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/login.php endpoint to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters within the Username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting login endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists and is attributed to the technical report hosted on GitHub at https://github.com/hbesljx/vul/issues/5.

Analyst Notes: As of October 9, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running Campcodes Advanced Online Voting Management System 1.0 must implement strict access controls and WAF filtering immediately until the vendor releases a security update addressing the improper input sanitization.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Online Apartment Visitor Management System 1.0 via the fromdate and todate arguments in bwdates-reports-details.php.

Executive Summary:
A remote, unauthenticated SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-11350

Affected Software: Campcodes Online Apartment Visitor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located within the bwdates-reports-details.php file. An unauthenticated attacker can manipulate the fromdate or todate parameters to execute arbitrary SQL commands against the backend database.

Business Impact

The ability to perform SQL injection without authentication allows an attacker to bypass standard security controls, potentially leading to the unauthorized disclosure or modification of sensitive visitor and resident data. With a CVSS score of 7.3, this high-severity flaw represents a significant threat to data confidentiality and integrity, which could result in severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected interface or disable the visitor management system entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for anomalous requests containing SQL syntax patterns targeting the bwdates-reports-details.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the identified parameters.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists and is documented in the technical write-up provided via the GitHub reference.

Analyst Notes: As of October 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to its lack of authentication requirements and the relative simplicity of the injection vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability must be treated with high priority. Organizations currently utilizing Campcodes Online Apartment Visitor Management System 1.0 should immediately implement network-level access controls to prevent remote exploitation while awaiting a formal security patch from the vendor.

Description Summary:
Campcodes Online Apartment Visitor Management System 1.0 is vulnerable to remote SQL injection via the searchdata argument in the search-visitor.php file.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows attackers to manipulate database queries without authorization.

Vulnerability Details

CVE-ID: CVE-2025-11349

Affected Software: Campcodes Online Apartment Visitor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the search-visitor.php script, specifically within the searchdata argument. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive visitor information or the compromise of the underlying database server. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent potential data breaches or unauthorized administrative access.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict access to the search-visitor.php file or disable the affected module until a vendor-supplied update is available.

Proactive Monitoring: Review web server access logs for anomalous URL patterns containing SQL syntax or unusual query parameters directed at search-visitor.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing common SQL injection payloads targeted at the searchdata parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as referenced in the vulnerability disclosure via GitHub.

Analyst Notes: As of October 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability presents a tangible risk to organizations utilizing this software. Administrators are strongly advised to implement the suggested compensating controls immediately and prioritize monitoring for any signs of exploitation while awaiting an official security patch from the vendor.

Description Summary:
A SQL injection vulnerability in the Campcodes Online Apartment Visitor Management System 1.0 allows remote attackers to manipulate the Username argument via index.php.

Executive Summary:
The Campcodes Online Apartment Visitor Management System 1.0 contains a critical SQL injection vulnerability that permits remote, unauthenticated attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-11348

Affected Software: Campcodes Online Apartment Visitor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the index.php file, where the Username parameter fails to properly sanitize user input. The vulnerability is exploitable remotely by unauthenticated attackers.

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to bypass authentication, access sensitive visitor data, or modify database contents. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application, potentially leading to unauthorized data exfiltration or system compromise.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or implement rigorous input validation rules for the Username parameter. If possible, consider isolating the application until a security update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server logs for suspicious patterns in the Username field, such as SQL syntax characters or unexpected query structures. Review database logs for anomalous queries originating from the web application service account.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection payloads targeting the index.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/arpcyber040/CVE/issues/3.

Analyst Notes: As of October 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its remote, unauthenticated nature and the lack of complex requirements for execution.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability poses a clear and present risk to any organization running version 1.0 of the Campcodes Online Apartment Visitor Management System. Organizations should prioritize implementing WAF filtering or network isolation immediately while awaiting a vendor-supplied patch.

Description Summary:
Campcodes Online Apartment Visitor Management System 1.0 is vulnerable to remote SQL injection via the editid argument in the /visitor-detail.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11334

Affected Software: Campcodes Online Apartment Visitor Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /visitor-detail.php file. An unauthenticated attacker can manipulate the editid argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL queries poses a severe risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive visitor information or administrative credentials, potentially resulting in full system compromise. With a CVSS score of 7.3, this vulnerability represents a high-severity risk that requires immediate attention to prevent data exfiltration.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict access to the /visitor-detail.php endpoint at the network or web server level. If the functionality is not required, disable the affected module entirely until a vendor-supplied update is released.

Proactive Monitoring: Monitor web server access logs for suspicious patterns in the editid parameter, such as the inclusion of SQL syntax (e.g., SELECT, UNION, or comment characters).

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the /visitor-detail.php file.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced GitHub repository.

Analyst Notes: As of October 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public exploit simplifies the attack vector, significantly increasing the probability of malicious activity.

Analyst Recommendation

Given the availability of a public proof-of-concept and the unauthenticated nature of this vulnerability, immediate mitigation is required. Organizations should prioritize blocking access to the vulnerable endpoint and monitor for signs of unauthorized database interaction until Campcodes releases a formal security patch.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Advanced Online Voting Management System 1.0, specifically within the /admin/candidates_edit.php file, allowing for remote exploitation.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Advanced Online Voting Management System 1.0 poses a significant risk of unauthorized database interaction and data compromise.

Vulnerability Details

CVE-ID: CVE-2025-11111

Affected Software: Campcodes Advanced Online Voting Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered via the ID argument in the /admin/candidates_edit.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data disclosure or modification. With a CVSS score of 7.3, this flaw represents a High severity risk, as it allows remote attackers to interact with the application database without requiring prior authentication.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should immediately restrict access to the /admin directory using IP allowlisting or by implementing additional authentication layers at the web server level.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax, such as UNION statements or unexpected character escaping, which may indicate exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the GitHub reference provided in the vulnerability disclosure.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it does not require user interaction or pre-existing privileges.

Analyst Recommendation

The presence of a public proof-of-concept and the ease of remote exploitation make this vulnerability an immediate concern for organizations utilizing the Campcodes Advanced Online Voting Management System. Administrators must apply the recommended compensating controls immediately and monitor vendor channels for the release of a permanent security patch to fully remediate this risk.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the school_year parameter in the /admin/school_year.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-11110

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the school_year argument within the /admin/school_year.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N (Privileges Required: None).

Business Impact

Successful exploitation of this SQL injection vulnerability could allow an attacker to view, modify, or delete sensitive data stored within the database. Given the CVSS score of 7.3, this represents a high risk to data confidentiality and integrity, potentially leading to unauthorized access to administrative functions or student information. Such a breach could result in significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: Since a formal vendor patch is currently unknown, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests containing SQL syntax patterns targeting the school_year.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical documentation provided at the GitHub reference link.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize restricting network access to the affected administrative interface until an official vendor patch is released and verified.

Description Summary:
A SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to manipulate the ID argument in /pages/us_edit.php.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to remote unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-11109

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability occurring within the /pages/us_edit.php script, triggered by manipulating the ID parameter. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation of this flaw allows an attacker to interact directly with the underlying database, potentially leading to unauthorized data exposure or modification. Given the CVSS score of 7.3, this represents a high risk to the confidentiality and integrity of business records stored within the inventory system.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or place the application behind a robust Web Application Firewall (WAF) configured to block SQL injection patterns.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /pages/us_edit.php file, specifically monitoring for SQL syntax characters such as single quotes or comment sequences in the ID parameter.

Compensating Controls: Implement strict input validation and parameterized queries in the source code to neutralize the injection vector, and ensure the database user account used by the application has the minimum necessary privileges.

Exploitation Status

Public Exploit Available: Yes, a published proof of concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of required authentication.

Analyst Recommendation

The presence of a publicly available proof of concept elevates the risk of this vulnerability significantly. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must treat this as a high priority, applying network-level restrictions immediately until a vendor-supplied patch is released.

Description Summary:
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the /admin/edit_content.php file, allowing remote attackers to manipulate the Title argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows for unauthenticated remote data manipulation and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11102

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered via the Title argument in the /admin/edit_content.php file. The vulnerability is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector PR:N.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high risk of unauthorized database interaction. Successful exploitation could lead to unauthorized data access, modification of educational content, or potential full database compromise, which may result in significant reputational damage and loss of system integrity for the institution.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /admin/edit_content.php, particularly those containing SQL syntax characters in the Title parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize inputs containing common SQL injection payloads targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication for the vulnerable endpoint.

Analyst Recommendation

Given the availability of a public exploit and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to any deployment of Campcodes Online Learning Management System 1.0. Organizations should prioritize isolating the affected application from public-facing network segments and implement strict input validation via a WAF until a secure update is released by the vendor.

Description Summary:
A SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to manipulate the Title argument in admin/add_content.php.

Executive Summary:
A critical SQL injection vulnerability exists in Campcodes Online Learning Management System 1.0, posing a significant risk of unauthorized database interaction and data exposure.

Vulnerability Details

CVE-ID: CVE-2025-11077

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /admin/add_content.php file. An unauthenticated remote attacker can inject malicious SQL commands via the Title parameter, potentially leading to unauthorized database access.

Business Impact

The ability for an unauthenticated user to execute arbitrary SQL commands poses a severe risk to the confidentiality, integrity, and availability of the underlying database. With a CVSS score of 7.3, this high-severity vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative data, or modify system content, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin directory and ensure that all input fields are properly sanitized or parameterized at the source code level.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the /admin/add_content.php endpoint, specifically looking for common SQL injection patterns like single quotes, union selects, or comment characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection attempts, which can provide a necessary layer of protection until the vendor provides a formal update.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the vulnerability record.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct exposure of the vulnerable endpoint.

Analyst Recommendation

Given the availability of public proof-of-concept code and the high potential for database compromise, this vulnerability requires immediate attention. Security teams must prioritize restricting access to the affected management interfaces and implement robust WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to SQL injection via the department argument in the /admin/edit_teacher.php file, allowing for potential remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated remote attackers to manipulate backend database queries.

Vulnerability Details

CVE-ID: CVE-2025-11076

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/edit_teacher.php script. An unauthenticated attacker can supply malicious input to the department parameter to execute arbitrary SQL commands against the database.

Business Impact

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. Successful exploitation may allow an attacker to unauthorizedly access, modify, or delete sensitive information stored within the learning management system database. Given the CVSS score of 7.3, this flaw represents a high risk to organizational assets, potentially leading to total system compromise or unauthorized data exfiltration.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/edit_teacher.php endpoint to trusted network segments or authorized personnel only.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting /admin/edit_teacher.php that contain SQL syntax, such as UNION, SELECT, or sleep commands.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns specifically targeting the department argument.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the researcher's write-up at https://github.com/xiaolonr/cve/issues/1.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of an official patch and the availability of public proof-of-concept code, this vulnerability presents a high risk to deployments of Campcodes Online Learning Management System 1.0. Organizations should immediately restrict access to the affected administrative interface and implement robust WAF filtering. Prioritize migrating to a more secure platform or applying vendor-provided security updates as soon as they are released.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the /admin/de_activate.php file via the ID argument.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-11075

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the /admin/de_activate.php file. An unauthenticated attacker can manipulate the ID argument to perform unauthorized database operations remotely.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation could lead to unauthorized access to sensitive educational data, potential modification of administrative records, or complete compromise of the underlying database, causing significant reputational and operational damage to the institution.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable functionality if it is not business critical.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /admin/de_activate.php, specifically monitoring for SQL syntax patterns or unexpected characters in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this specific endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists via the technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of authentication requirements and the simplicity of the attack vector.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation for unauthenticated users, this vulnerability poses a significant risk. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls, such as WAF rules and access restrictions, until the vendor provides a permanent security update.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the department argument within the admin/teachers.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote, unauthenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-11064

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the department argument of the admin/teachers.php script. The vulnerability allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive student or faculty information, potential modification of database records, or a complete compromise of the learning management platform. Given the CVSS score of 7.3, this represents a high-severity threat that requires immediate attention to prevent unauthorized data exposure.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/teachers.php endpoint or disable the affected module until the vendor releases a secure update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the /admin/teachers.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch until an official fix is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the ease of exploitation via simple URL manipulation.

Analyst Recommendation

This vulnerability presents a high risk due to the lack of required authentication for exploitation. Security teams must prioritize restricting access to the vulnerable endpoint immediately. Organizations should actively monitor vendor communications for a security patch and apply it as soon as it becomes available to remediate the underlying code vulnerability.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the d argument in the /admin/edit_department.php file, allowing unauthenticated attackers to manipulate data.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-11063

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) residing in the /admin/edit_department.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the d parameter to execute arbitrary SQL commands.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL queries creates a significant threat to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative records, or modify database contents. Such unauthorized access can lead to severe reputational damage and regulatory non-compliance regarding data privacy.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the /admin/edit_department.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the edit_department.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the vulnerable d parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's write-up at https://github.com/luyisi-7/CVE/issues/3.

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so the exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication or user interaction.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of vendor-supplied patches, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize immediate mitigation via network segmentation or WAF rules to prevent exploitation until the vendor releases a secure version. Continuous monitoring of application logs is essential to detect any early signs of compromise.

Description Summary:
Campcodes Online Learning Management System version 1.0 contains a SQL injection vulnerability in the admin/save_student.php file via the class_id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to execute arbitrary database queries.

Vulnerability Details

CVE-ID: CVE-2025-11062

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/save_student.php script. An unauthenticated remote attacker can manipulate the class_id parameter to inject malicious SQL commands into the application database.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database, potentially leading to unauthorized data exposure or modification. With a CVSS score of 7.3, this represents a high-risk security flaw that could compromise the integrity and confidentiality of student records and administrative data stored within the system.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and the affected script to trusted IP addresses only.

Proactive Monitoring: Security teams should monitor database logs for anomalous query patterns, specifically looking for SQL syntax errors or unexpected union-based queries originating from the /admin/save_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the class_id parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists via the technical write-up published on GitHub.

Analyst Notes: As of September 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because it does not require authentication to interact with the vulnerable parameter.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of an official patch, this vulnerability poses a significant risk to the integrity of the application. Organizations should prioritize restricting access to the administrative interface and implement robust input validation as a stopgap measure until the vendor releases a secure update.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the edit_student.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database interaction and potential data exposure.

Vulnerability Details

CVE-ID: CVE-2025-11061

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the /admin/edit_student.php file via the cys parameter. This vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive student or system data stored in the database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in full database compromise, data exfiltration, or loss of system integrity. Such an incident poses significant risks to institutional data privacy and operational continuity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/edit_student.php file to trusted IP addresses only or disable the affected module entirely.

Proactive Monitoring: Review web server and application logs for suspicious HTTP requests containing SQL syntax or unusual characters directed at the edit_student.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting application parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the technical write-up referenced by the CVE record (https://github.com/luyisi-7/CVE/issues/5).

Analyst Notes: As of September 28, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute malicious database queries.

Analyst Recommendation

The presence of a public proof-of-concept and the lack of a vendor-supplied patch necessitate immediate defensive action. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize isolating the affected component to prevent unauthorized access. Monitor for updates from the vendor and apply them as soon as they become available to permanently remediate this SQL injection flaw.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to SQL injection via the ID parameter in the /pages/us_edit1.php file, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity and access.

Vulnerability Details

CVE-ID: CVE-2025-11039

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/us_edit1.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification of inventory records, or potential administrative account takeover within the application. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the underlying database, which may contain sensitive business or user information.

Remediation Plan

Immediate Action: Since an official patch is currently unknown, administrators should restrict network access to the vulnerable /pages/us_edit1.php endpoint or disable the affected module entirely if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server logs for suspicious URL parameters containing SQL syntax or unusual activity targeting the /pages/ directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 26, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to execute, making it highly accessible to remote actors.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a clear and present danger to affected systems. Organizations running Campcodes Computer Sales and Inventory System 1.0 must prioritize implementing network-level blocks or WAF rules immediately to prevent unauthorized database access until an official vendor patch is released.

Description Summary:
A SQL injection vulnerability in the login.php file of Campcodes Point of Sale System 1.0 allows remote, unauthenticated attackers to manipulate the Username argument to execute arbitrary database queries.

Executive Summary:
Campcodes Point of Sale System 1.0 is vulnerable to an unauthenticated SQL injection attack that could lead to unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10857

Affected Software: Campcodes Point of Sale System

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability located in the login.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to interact directly with the backend database. This could result in the unauthorized extraction of sensitive business data, such as customer records or login credentials, and may facilitate further attacks against the underlying server infrastructure. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the point of sale environment.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the login portal using IP whitelisting or VPN requirements to prevent unauthorized exposure.

Proactive Monitoring: Monitor web server access logs for anomalous requests to login.php, particularly those containing SQL syntax characters such as single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced at the Yuque security portal.

Analyst Notes: As of September 24, 2025, there is no confirmed active exploitation in the wild; however, a public proof-of-concept is available, which significantly lowers the barrier for entry for malicious actors. The vulnerability's reliance on a simple parameter manipulation makes it highly susceptible to automated exploitation.

Analyst Recommendation

Due to the lack of an official patch and the public availability of a proof-of-concept, this vulnerability poses an immediate threat to organizations using Campcodes Point of Sale System 1.0. Organizations should prioritize implementing network-level access controls and WAF protections immediately. Continuous monitoring for suspicious login attempts is mandatory until a vendor-supplied update is verified and applied.

Description Summary:
Campcodes Gym Management System 1.0 is vulnerable to remote SQL injection via the Username argument in the ajax.php login function, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Gym Management System 1.0 poses a significant risk of unauthorized data access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-10851

Affected Software: Campcodes Gym Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the /ajax.php endpoint. An unauthenticated attacker can supply malicious input to the Username parameter to execute arbitrary SQL commands against the backend database.

Business Impact

The ability for an unauthenticated user to interact directly with the database poses a severe threat to data confidentiality and integrity. With a CVSS score of 7.3, this high-severity flaw could lead to the unauthorized exfiltration of user credentials or sensitive gym member information, potentially resulting in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or disable the affected login functionality if possible.

Proactive Monitoring: Monitor database query logs for unusual syntax patterns, such as UNION or SLEEP commands, and review web server access logs for repeated requests to the ajax.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the Username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up provided in the reference documentation.

Analyst Notes: As of September 24, 2025, there is no public information indicating active exploitation in the wild, though the existence of a public proof-of-concept makes this vulnerability highly accessible to threat actors. The flaw is inherently dangerous due to its unauthenticated remote nature and the lack of complex requirements for successful exploitation.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Gym Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, while maintaining close contact with the vendor for an official security update.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Computer Sales and Inventory System 1.0 via the prodcode argument in the /pages/pro_edit1.php file, allowing remote, unauthenticated exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote, unauthenticated attackers to manipulate database queries, posing a significant risk of unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-10831

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) because it fails to properly sanitize the prodcode parameter within the /pages/pro_edit1.php file. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting a high risk due to the lack of required authentication and the potential for direct database manipulation. Successful exploitation could lead to the unauthorized disclosure or modification of sensitive inventory and sales data, resulting in potential data breaches and loss of system integrity.

Remediation Plan

Immediate Action: Since no official vendor patch is currently confirmed, administrators should restrict access to the /pages/pro_edit1.php endpoint or disable the affected module entirely until a secure update is provided by Campcodes.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeted at the /pages/pro_edit1.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the research write-up at the referenced GitHub repository.

Analyst Notes: As of September 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an immediate risk to any organization deploying this software. We strongly recommend isolating the application from external networks and applying the vendor patch as soon as it becomes available to prevent unauthorized database access.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 contains an SQL injection vulnerability in the inv_edit1.php file via the idd parameter, allowing for remote exploitation.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to unauthorized database manipulation by remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-10830

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /pages/inv_edit1.php file. An unauthenticated remote attacker can inject malicious SQL commands via the idd parameter to manipulate database queries.

Business Impact

The ability to perform SQL injection poses a severe risk to the confidentiality, integrity, and availability of stored data. With a CVSS score of 7.3, this high-severity vulnerability could allow an attacker to bypass authentication, exfiltrate sensitive customer or inventory data, or potentially modify backend database records, leading to significant operational disruption and data loss.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the affected web interface and implement strict input validation on the idd parameter within inv_edit1.php.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /pages/inv_edit1.php endpoint, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to protect the vulnerable endpoint until a formal vendor update is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication or user interaction to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to affected environments. Organizations currently using version 1.0 of the Campcodes Computer Sales and Inventory System should prioritize isolating the application and applying the recommended WAF protections immediately to prevent potential unauthorized database access.

Description Summary:
A SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to manipulate the ID argument in the sup_edit1.php file.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 exposes the application to remote data manipulation and unauthorized database access.

Vulnerability Details

CVE-ID: CVE-2025-10829

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the /pages/sup_edit1.php file. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the ID parameter.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk that could lead to unauthorized data disclosure, modification, or destruction of inventory records. Successful exploitation allows for complete interaction with the backend database, which may result in significant operational disruption and the compromise of sensitive business information.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the application or disable the vulnerable /pages/sup_edit1.php file if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or unusual characters directed at the sup_edit1.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified vulnerable argument.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as detailed in the referenced GitHub repository.

Analyst Notes: As of September 24, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its accessibility to unauthenticated users and the lack of complex requirements for execution.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations must prioritize limiting exposure by placing the application behind a WAF or restricting network access until the vendor releases a security update. Continuous monitoring of logs for signs of database probing is advised until remediation is confirmed.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the firstname argument in the admin_user.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-10817

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The application suffers from a SQL injection vulnerability (CWE-89) within the /admin/admin_user.php script. An unauthenticated attacker can manipulate the firstname argument to execute malicious SQL queries remotely.

Business Impact

The ability to perform unauthorized SQL injection attacks against a learning management system can lead to the exfiltration of sensitive user data, credential theft, or total compromise of the application database. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to organizational confidentiality and system integrity.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory and implement strict input validation for the firstname parameter.

Proactive Monitoring: Monitor server access logs for unusual HTTP requests containing SQL syntax or encoded payloads targeted at the admin_user.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns directed at the identified vulnerable script.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists as documented in the GitHub issue referenced by the CVE record.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication for the vulnerable endpoint.

Analyst Recommendation

Given the availability of a public proof-of-concept, this vulnerability should be treated with urgency despite the current absence of a vendor patch. Organizations using Campcodes Online Learning Management System 1.0 must prioritize isolating the affected component and implementing robust network-level filtering to prevent unauthorized exploitation until a vendor-supplied fix is released.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the /admin/edit_user.php file via the firstname parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to compromise the database.

Vulnerability Details

CVE-ID: CVE-2025-10810

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input validation of the firstname parameter within the /admin/edit_user.php file. The attack vector is remote, and the vulnerability can be exploited by an unauthenticated attacker.

Business Impact

The ability to perform remote SQL injection poses a significant risk to the confidentiality and integrity of the learning management system, as it allows attackers to execute arbitrary database queries. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration or potential administrative account takeover. Organizations relying on this system for sensitive user data face substantial reputational and operational risks if the database is compromised.

Remediation Plan

Immediate Action: Since a patch is currently unknown, administrators should restrict access to the /admin/edit_user.php endpoint using network-level controls or by disabling the affected module if it is not business-critical.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /admin/edit_user.php file, specifically looking for SQL syntax patterns in the firstname parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads to mitigate the risk until an official vendor update is released.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the security researcher's write-up at the provided GitHub reference.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication.

Analyst Recommendation

This vulnerability presents a high risk due to the availability of a public proof-of-concept and the lack of authentication required to execute the attack. Organizations should prioritize isolating the affected system and implementing WAF protections immediately. Continuous monitoring for indicators of compromise is essential until the vendor provides a formal security patch.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the d argument in the /admin/department.php file.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows remote attackers to compromise the database.

Vulnerability Details

CVE-ID: CVE-2025-10809

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the /admin/department.php file. An unauthenticated remote attacker can inject malicious SQL commands via the d parameter to potentially access or manipulate backend data.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may lead to the exfiltration of sensitive student or administrative information. Given the CVSS score of 7.3, this flaw presents a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/department.php endpoint to authorized internal networks only or disable the affected module until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed toward the department.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection payloads and monitor for unusual database query activity.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability creates an urgent need for mitigation. Organizations using Campcodes Online Learning Management System 1.0 must prioritize restricting network access to the vulnerable endpoint immediately, as the lack of a vendor patch leaves the system exposed to potential remote exploitation.

Description Summary:
Campcodes Farm Management System 1.0 is vulnerable to SQL injection via the Type argument in the uploadProduct.php file, allowing remote attackers to execute unauthorized database queries.

Executive Summary:
Campcodes Farm Management System version 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10808

Affected Software: Campcodes Farm Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the uploadProduct.php file. An unauthenticated attacker can exploit this by manipulating the Type parameter to execute arbitrary SQL commands.

Business Impact

The ability to perform SQL injection allows an attacker to interact directly with the backend database. This could lead to the unauthorized disclosure of sensitive agricultural or user data, modification of system records, or potential bypass of authentication mechanisms. Given the CVSS score of 7.3, this represents a high risk to the confidentiality and integrity of the application.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the uploadProduct.php file or disable the affected functionality until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious patterns, specifically looking for SQL-related keywords or unusual characters within the Type parameter of requests directed at uploadProduct.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up found at the provided GitHub reference.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote interaction with the database layer.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations utilizing Campcodes Farm Management System 1.0 must prioritize the implementation of compensating controls, such as WAF filtering, while actively monitoring for a vendor-supplied patch. Failure to mitigate this exposure increases the likelihood of unauthorized database access.

Description Summary:
A SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to manipulate database queries via the id parameter in ajax.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 poses a critical risk of data compromise and unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2025-10786

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper input sanitization in the ajax.php file. The vulnerability is accessible via the action=delete_user endpoint and requires no authentication to exploit.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification of inventory records, or complete compromise of the application user database, resulting in significant operational and reputational damage.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict network access to the application or disable the vulnerable ajax.php endpoint until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious requests targeting ajax.php, specifically looking for unusual patterns in the id parameter that include SQL syntax characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application interface.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote reachability.

Analyst Recommendation

Due to the lack of an official patch and the public availability of an exploit, this vulnerability presents an immediate and elevated risk to all deployments of version 1.0. Organizations are strongly urged to isolate affected systems from public-facing networks or implement strict WAF filtering to prevent exploitation until the vendor provides a formal remediation.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID argument in manage_user.php, allowing unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10785

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the manage_user.php file. An unauthenticated remote attacker can manipulate the ID argument to execute arbitrary SQL commands against the backend database.

Business Impact

The ability to perform SQL injection allows unauthorized parties to read, modify, or delete sensitive data stored within the inventory system. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized access to user accounts or system configuration data.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the manage_user.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing SQL syntax, such as UNION, SELECT, or OR 1=1, directed at the manage_user.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified vulnerable argument.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the referenced GitHub issue.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Due to the lack of an official patch and the availability of a public proof-of-concept, this vulnerability poses a clear and present danger to affected environments. Organizations must prioritize immediate network-level mitigation or the implementation of strict WAF filtering to prevent unauthorized database access until the vendor releases a secure update.

Description Summary:
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the edit_subject.php file due to improper neutralization of the subject_code argument.

Executive Summary:
A remote SQL injection vulnerability in Campcodes Online Learning Management System 1.0 allows unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10784

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /admin/edit_subject.php file. The application fails to properly sanitize the subject_code parameter, allowing an unauthenticated remote attacker to inject malicious SQL commands.

Business Impact

Successful exploitation of this flaw can lead to unauthorized access to sensitive data stored within the database or potential modification of learning management records. Given the CVSS score of 7.3, this represents a high-severity risk that could facilitate data exfiltration or unauthorized administrative actions. Organizations relying on this system for educational management face significant reputational risk and data privacy concerns if the database is compromised.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict access to the /admin directory using network-level controls or web application firewall rules.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as UNION or SELECT statements appearing within the subject_code parameter, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block SQL injection patterns targeting the subject_code argument in the edit_subject.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the referenced GitHub issue.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the backend database.

Analyst Recommendation

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by malicious actors. Organizations should prioritize isolating the affected system from public-facing networks until a vendor-supplied patch is identified and applied. Failure to restrict access to this vulnerable endpoint leaves the system susceptible to unauthorized data manipulation.

Description Summary:
Campcodes Online Learning Management System 1.0 contains an unauthenticated SQL injection vulnerability in the add_subject.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database access and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-10783

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: The vulnerability is a SQL injection flaw located within the add_subject.php file. An unauthenticated attacker can exploit this by injecting malicious input into the subject_code argument to execute unauthorized database commands.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL queries allows for the potential exfiltration, modification, or deletion of sensitive student and administrative data. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to significant reputational damage, loss of data integrity, and potential non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Since an official patch is currently unavailable, administrators should restrict access to the /admin/ directory to trusted internal IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous requests to /admin/add_subject.php, specifically searching for strings containing SQL syntax or unusual character patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block SQL injection patterns targeting the subject_code parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/86.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require authentication to trigger.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing Campcodes Online Learning Management System 1.0 must treat this as a high-priority item. Implement the recommended WAF rules and access restrictions immediately to prevent unauthorized exploitation while awaiting a formal vendor patch.

Description Summary:
Campcodes Online Learning Management System 1.0 is vulnerable to remote SQL injection via the class_name argument in /admin/class.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a significant risk of unauthorized database interaction and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2025-10782

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is an SQL injection flaw (CWE-89) located in the /admin/class.php file. It allows an unauthenticated, remote attacker to perform malicious operations by manipulating the class_name argument.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary SQL commands presents a high risk to the confidentiality and integrity of the application database. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized access to sensitive student or administrative data, potentially resulting in full database compromise and significant reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or web server authentication until the vendor releases a security update.

Proactive Monitoring: Review web server logs for suspicious HTTP requests targeting /admin/class.php, particularly those containing SQL syntax characters like single quotes or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the specified vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication for the affected endpoint.

Analyst Recommendation

Given the public availability of exploit code and the critical nature of SQL injection, this vulnerability requires immediate attention. Organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize implementing the suggested compensating controls and monitor for vendor updates to ensure long-term mitigation of this high-risk entry point.

Description Summary:
Campcodes Online Learning Management System 1.0 contains a SQL injection vulnerability in the admin/edit_class.php file, allowing remote attackers to manipulate the class_name parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a significant risk of unauthorized data access and potential database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10781

Affected Software: Campcodes Online Learning Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the admin/edit_class.php file. The application fails to properly sanitize the class_name argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to compromise the integrity and confidentiality of the learning management system database. Given the CVSS score of 7.3, this flaw presents a high risk of unauthorized data exposure or modification, which could lead to service disruption and significant reputational damage.

Remediation Plan

Immediate Action: Since a vendor-supplied patch is currently unavailable, administrators should restrict network access to the /admin/ directory and implement strict input validation for all administrative endpoints.

Proactive Monitoring: Security teams should monitor web server logs for suspicious HTTP requests targeting the admin/edit_class.php file, specifically looking for common SQL injection patterns such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts directed at the affected application parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the GitHub issue referenced in the CVE record.

Analyst Notes: As of September 23, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor patch, organizations utilizing Campcodes Online Learning Management System 1.0 must prioritize the implementation of compensating controls. Immediate network-level restrictions and WAF filtering are required to mitigate the risk of unauthorized database interaction until the vendor provides a secure update.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to unauthenticated SQL injection via the ID parameter in the /ajax.php?action=delete_receiving endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10565

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the ID argument within the /ajax.php?action=delete_receiving file, which allows an unauthenticated remote attacker to perform SQL injection. This flaw enables unauthorized interaction with the underlying database through the vulnerable endpoint.

Business Impact

Successful exploitation of this vulnerability permits unauthorized database access, which may lead to the exfiltration, modification, or deletion of sensitive inventory and sales data. Given the CVSS score of 7.3, this represents a significant risk to data integrity and confidentiality. Organizations relying on this system for business operations face potential service disruption and compromise of proprietary financial information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /ajax.php endpoint or disable the affected functionality entirely until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns directed at the /ajax.php file, specifically targeting the delete_receiving action.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the CVE data.

Analyst Notes: As of September 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated interaction with the database layer.

Analyst Recommendation

The presence of a public proof-of-concept significantly lowers the barrier for exploitation by unauthorized actors. Organizations using Campcodes Grocery Sales and Inventory System 1.0 must treat this as a high priority and implement the suggested access restrictions immediately. Continuous monitoring for malicious traffic is essential until a formal patch is provided by the vendor.

Description Summary:
A SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote attackers to execute arbitrary database commands via the ID parameter in ajax.php.

Executive Summary:
The Campcodes Grocery Sales and Inventory System 1.0 contains a critical SQL injection flaw that permits unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10564

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located within the ajax.php file. An unauthenticated remote attacker can manipulate the ID argument to execute unauthorized database queries.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to total system compromise or the exposure of sensitive grocery and inventory records.

Remediation Plan

Immediate Action: Since no official vendor patch is currently confirmed, users are advised to restrict network access to the affected endpoint or disable the vulnerable functionality in ajax.php until a security update is released by Campcodes.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests targeting ajax.php, specifically monitoring for SQL injection patterns such as union, select, or comment syntax in the ID parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application's URL parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at the provided GitHub reference.

Analyst Notes: As of September 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable due to the lack of input sanitization on the ID parameter.

Analyst Recommendation

The presence of a public proof-of-concept elevates the risk of this vulnerability significantly. Organizations utilizing Campcodes Grocery Sales and Inventory System 1.0 must prioritize implementing compensating controls, such as WAF rules or network segmentation, to mitigate the risk of unauthorized database access while awaiting an official vendor patch.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 contains a SQL injection vulnerability in the ajax.php file, allowing remote attackers to manipulate the ID argument.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-10563

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the ID parameter in the /ajax.php?action=save_category endpoint. This flaw allows unauthenticated remote attackers to inject malicious SQL queries, potentially leading to unauthorized data access or manipulation.

Business Impact

Successful exploitation of this SQL injection vulnerability could result in the unauthorized disclosure, modification, or deletion of sensitive inventory and sales data. Given the CVSS score of 7.3, this represents a high risk to business operations, as it allows unauthenticated attackers to interact directly with the backend database. Such breaches can lead to significant reputational damage and potential regulatory non-compliance regarding data protection.

Remediation Plan

Immediate Action: Since no vendor patch is currently confirmed, administrators should restrict access to the /ajax.php endpoint or disable the affected module until an official update is provided by the vendor.

Proactive Monitoring: Security teams should monitor web access logs for unusual patterns or suspicious characters within the ID parameter of requests directed at /ajax.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the application.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/76.

Analyst Notes: As of September 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the input is processed without proper sanitization.

Analyst Recommendation

This vulnerability presents a significant risk due to the ease of remote exploitation and the existence of a public proof-of-concept. Organizations utilizing this software must prioritize the implementation of compensating controls, such as strict WAF filtering, and monitor vendor communication channels for the release of an official security update to resolve this flaw permanently.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Grocery Sales and Inventory System 1.0 via the ID parameter in the /ajax.php?action=save_product endpoint, allowing unauthenticated remote access.

Executive Summary:
The Campcodes Grocery Sales and Inventory System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10562

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) triggered through the ID argument in the /ajax.php?action=save_product file. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the application database.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized data exposure, modification, or deletion of sensitive inventory and sales records. With a CVSS score of 7.3, this represents a high risk to business operations, potentially compromising the integrity and confidentiality of the entire sales management database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected module until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for anomalous requests targeting /ajax.php, specifically looking for URL parameters containing SQL syntax or unusual query strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to filter and block malicious SQL injection patterns targeting the ID parameter in the application.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/zzb1388/cve/issues/77.

Analyst Notes: As of September 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-provided patch, this vulnerability poses a significant risk of exploitation. Organizations using this software should prioritize network-level blocks and monitor for suspicious activity immediately to prevent potential database compromise.

Description Summary:
Campcodes Online Job Finder System 1.0 contains a SQL injection vulnerability via the searchfor parameter in index.php, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote, unauthenticated attackers to potentially compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10448

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the index.php file. An unauthenticated remote attacker can inject malicious SQL commands via the searchfor argument, enabling unauthorized database interaction.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive data, potential modification of application records, or service disruption. With a CVSS score of 7.3, this flaw represents a significant risk, as it requires no prior authentication and can be executed remotely to bypass standard security controls.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the vulnerable index.php endpoint or disable the search functionality until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous GET requests containing SQL syntax patterns, such as UNION, SELECT, or sleep commands, targeting the searchfor parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter and block malicious input directed at the vulnerable application parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/HAO-RAY/HCR-CVE/issues/7.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability poses an immediate risk to the confidentiality and integrity of the system. Organizations should prioritize isolating affected instances from public networks and implementing robust WAF filtering to mitigate the threat until a formal update is provided.

Description Summary:
Campcodes Online Job Finder System 1.0 contains an unrestricted file upload vulnerability in the applicationform.php file, which may allow remote attackers to upload malicious files.

Executive Summary:
A critical file upload vulnerability in the Campcodes Online Job Finder System 1.0 allows remote, unauthenticated attackers to potentially execute arbitrary code on the affected server.

Vulnerability Details

CVE-ID: CVE-2025-10447

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: This vulnerability is an unrestricted file upload flaw (CWE-434) located in the /eris/applicationform.php file. The application fails to properly validate the picture argument, allowing an unauthenticated remote attacker to upload arbitrary files to the system.

Business Impact

The ability to upload arbitrary files to a web server typically leads to full system compromise via remote code execution. Given the CVSS score of 7.3, this represents a significant risk of data exfiltration, unauthorized system access, and complete service disruption. Organizations relying on this software face severe reputational and operational damage if the application is exploited.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict access to the affected application or disable the file upload functionality in the applicationform.php file until an official fix is released by the vendor.

Proactive Monitoring: Monitor server logs for unusual file creation events in the upload directories and review HTTP request logs for attempts to access non-image files within the application's upload path.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block requests containing suspicious file extensions or non-image MIME types directed at the applicationform.php endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability research.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of input validation on the file upload mechanism.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a high risk to any organization running Campcodes Online Job Finder System 1.0. If you cannot immediately patch or update the software, you must isolate the instance from public network access to prevent unauthorized file uploads. Prioritize the replacement or mitigation of this system as soon as possible.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /pages/cust_searchfrm.php file, potentially allowing unauthorized database access.

Executive Summary:
The Campcodes Computer Sales and Inventory System 1.0 contains a critical SQL injection vulnerability that allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10446

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the ID parameter of the /pages/cust_searchfrm.php file during edit actions. This SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary database commands.

Business Impact

This vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could allow attackers to bypass authentication, extract sensitive customer or inventory data, or modify database contents, leading to potential operational disruption and loss of trust. The CVSS score of 7.3 reflects the high risk posed by an unauthenticated remote attack vector.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /pages/cust_searchfrm.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as SQL syntax characters or unexpected queries targeting the cust_searchfrm.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting query parameters.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the security researcher's submission on GitHub.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations utilizing Campcodes Computer Sales and Inventory System 1.0 must implement network-level access controls or WAF protections to mitigate the risk of unauthorized database interaction until the vendor provides a formal security update.

Description Summary:
Campcodes Computer Sales and Inventory System version 1.0 contains an unauthenticated SQL injection vulnerability in the Username parameter of the /pages/us_transac.php script.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 allows remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-10445

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection (CWE-89) vulnerability occurring in the Username argument of the /pages/us_transac.php file. The vulnerability is exploitable by an unauthenticated remote attacker via simple HTTP GET or POST requests.

Business Impact

Successful exploitation allows an attacker to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or deletion. Given the CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of the application database. Organizations relying on this system for inventory management face potential operational disruption if the underlying database is compromised.

Remediation Plan

Immediate Action: No official patch is currently available from the vendor. Administrators should immediately restrict access to the affected web directory or disable the vulnerable functionality until a security update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /pages/us_transac.php endpoint, particularly those containing SQL syntax characters like single quotes or comment markers.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in incoming request parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the research write-up at https://github.com/e1evensu/cve/issues/2.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of input sanitization on the Username parameter.

Analyst Recommendation

The presence of a public proof-of-concept combined with the unauthenticated nature of this vulnerability necessitates immediate defensive action. Organizations should prioritize isolating the affected system or implementing strict WAF filtering to prevent exploitation while awaiting a vendor-supplied patch.

Description Summary:
Campcodes Online Job Finder System 1.0 is vulnerable to remote SQL injection via the Username parameter in advancesearch.php, allowing unauthenticated attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in Campcodes Online Job Finder System 1.0 allows remote attackers to execute arbitrary database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-10444

Affected Software: Campcodes Online Job Finder System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the advancesearch.php file. The application fails to properly sanitize the Username argument, allowing an unauthenticated remote attacker to inject malicious SQL queries into the backend database.

Business Impact

The ability to perform unauthenticated SQL injection permits attackers to bypass application logic, potentially leading to unauthorized data access, modification, or deletion. With a CVSS score of 7.3, this vulnerability represents a high risk to the confidentiality and integrity of the system, which could result in significant reputational damage and loss of sensitive user information.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the affected script or disable the online job search functionality entirely until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests to advancesearch.php, specifically monitoring for patterns containing SQL syntax such as single quotes, UNION statements, or comment characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeted at the Username parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher write-up at https://github.com/HAO-RAY/HCR-CVE/issues/5.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote access to the database layer.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be treated as a high priority. Organizations utilizing Campcodes Online Job Finder System 1.0 must implement strict WAF filtering immediately and monitor for unauthorized database activity while awaiting an official security update from the vendor.

Description Summary:
Campcodes Computer Sales and Inventory System 1.0 is vulnerable to unauthenticated SQL injection via the ID parameter in the sup_searchfrm.php file.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Campcodes Computer Sales and Inventory System 1.0 poses a significant risk to database confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2025-10436

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/sup_searchfrm.php file. An unauthenticated attacker can manipulate the ID argument to execute unauthorized database queries remotely.

Business Impact

The ability for an unauthenticated user to inject arbitrary SQL commands into the backend database presents a severe risk of unauthorized data access, modification, or deletion. Given the CVSS score of 7.3, this flaw is categorized as High severity and could lead to complete compromise of the application data layer, potentially resulting in significant operational disruption and loss of sensitive inventory information.

Remediation Plan

Immediate Action: As no official vendor patch is currently confirmed, administrators should restrict access to the affected directory /pages/sup_searchfrm.php or disable the vulnerable module until a fix is released by Campcodes.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting the sup_searchfrm.php endpoint, specifically looking for URL parameters containing SQL syntax or encoded payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit as it does not require authentication or user interaction.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for mitigation. Organizations currently running Campcodes Computer Sales and Inventory System 1.0 must implement strict access controls and WAF filtering immediately to prevent potential database compromise until an official security update is provided by the vendor.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Computer Sales and Inventory System 1.0, specifically within the cust_edit1.php file, allowing remote attackers to manipulate database queries.

Executive Summary:
A critical SQL injection vulnerability in the Campcodes Computer Sales and Inventory System 1.0 allows for remote, unauthenticated database manipulation.

Vulnerability Details

CVE-ID: CVE-2025-10435

Affected Software: Campcodes Computer Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /pages/cust_edit1.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the ID argument, which is then processed by the application without sufficient sanitization.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive customer and inventory data stored within the database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity, potentially leading to unauthorized data exfiltration or modification.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected system or disable the vulnerable module until a vendor-supplied update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns in the ID parameter of requests directed at /pages/cust_edit1.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting this endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue referenced in the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the unauthenticated nature of the attack vector.

Analyst Recommendation

The presence of a publicly available proof-of-concept elevates the risk of this vulnerability significantly. Organizations currently running the affected version of the Campcodes system must prioritize the implementation of compensating controls or network isolation to prevent exploitation, as the lack of a vendor patch leaves the system directly exposed to remote attackers.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /ajax.php endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise the database.

Vulnerability Details

CVE-ID: CVE-2025-10417

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by the improper sanitization of the ID argument within the /ajax.php file. The attack is remotely exploitable and does not require authentication, allowing an adversary to interact directly with the backend database.

Business Impact

The ability to perform unauthorized SQL queries poses a severe risk to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this flaw enables attackers to extract sensitive inventory or user data, modify records, or potentially disrupt service, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: As no official patch is currently identified, administrators should immediately restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /ajax.php, particularly those containing SQL syntax characters like single quotes, semicolons, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests to /ajax.php that contain suspicious patterns characteristic of SQL injection attempts.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub issue referenced by the vulnerability record.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated remote access vector.

Analyst Recommendation

Given the availability of a public exploit and the lack of a formal vendor patch, this vulnerability presents a high risk to the environment. Security teams must prioritize isolating the affected system or implementing strict network-level access controls to prevent unauthorized interaction with the vulnerable endpoint while awaiting further guidance from the vendor.

Description Summary:
A SQL injection vulnerability exists in the Campcodes Grocery Sales and Inventory System 1.0, specifically within the ajax.php file via the ID argument.

Executive Summary:
The Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to unauthenticated remote SQL injection, which could allow an attacker to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2025-10416

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /ajax.php endpoint via the ID parameter. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability can result in unauthorized access to sensitive data stored within the system database. With a CVSS score of 7.3, this flaw presents a high risk, as it allows for potential data exfiltration or modification without requiring any prior authentication, which could lead to significant operational disruption and loss of data integrity.

Remediation Plan

Immediate Action: Since a specific patch is not currently available, administrators should restrict network access to the affected endpoint or disable the vulnerable functionality until the vendor releases a security update.

Proactive Monitoring: Monitor web server access logs for requests directed to /ajax.php that contain suspicious characters or SQL syntax patterns, such as UNION, SELECT, or comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the ID parameter in URL queries.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked GitHub repository.

Analyst Notes: As of September 16, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses a significant risk to affected installations. Organizations must prioritize restricting access to the vulnerable system and implement robust input validation at the WAF level until an official security patch is provided by Campcodes.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to SQL injection via the ID argument in the /ajax.php?action=save_supplier endpoint, which can be exploited by remote, unauthenticated users.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows remote, unauthenticated attackers to execute unauthorized database queries.

Vulnerability Details

CVE-ID: CVE-2025-10415

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize the ID argument within the /ajax.php?action=save_supplier endpoint, leading to CWE-89 SQL Injection. This vulnerability is remotely exploitable by an unauthenticated attacker.

Business Impact

The ability for an unauthenticated user to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive information, modify database records, or disrupt system operations, leading to potential data breaches and system downtime. Given the CVSS score of 7.3, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized access to the underlying database.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /ajax.php endpoint or disable the affected functionality until a vendor update is released.

Proactive Monitoring: Monitor web server logs for suspicious requests to the /ajax.php file, specifically looking for unusual patterns or characters in the ID parameter that resemble SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize incoming requests containing SQL injection payloads targeting the specified endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists, as documented in the linked GitHub repository.

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently easy to exploit due to the lack of required authentication and the direct exposure of the vulnerable argument in the URL.

Analyst Recommendation

Given the public availability of exploit material and the unauthenticated nature of this vulnerability, organizations currently running Campcodes Grocery Sales and Inventory System 1.0 are at elevated risk. We strongly recommend implementing immediate network-level restrictions to the affected file and maintaining heightened vigilance until the vendor provides an official security patch.

Description Summary:
Campcodes Grocery Sales and Inventory System 1.0 is vulnerable to remote SQL injection via the ID parameter in the /ajax.php?action=save_customer endpoint.

Executive Summary:
A critical SQL injection vulnerability in Campcodes Grocery Sales and Inventory System 1.0 allows unauthenticated remote attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2025-10414

Affected Software: Campcodes Grocery Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input within the ID parameter of the /ajax.php?action=save_customer endpoint. This flaw allows an unauthenticated remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.

Business Impact

Successful exploitation of this SQL injection vulnerability poses a significant risk to the confidentiality and integrity of sensitive business data stored within the inventory system. With a CVSS score of 7.3, this flaw is categorized as High severity, indicating that the potential for unauthorized data exfiltration or database manipulation is substantial and requires immediate mitigation to prevent operational disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, users should restrict access to the /ajax.php endpoint via network controls or isolate the application from the public internet.

Proactive Monitoring: Security teams should audit web server access logs for anomalous requests containing SQL syntax or unusual parameters directed at the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept exists as documented in the referenced GitHub issue (https://github.com/zzb1388/cve/issues/81).

Analyst Notes: As of September 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it is remotely exploitable without authentication, making it a prime target for automated scanning tools.

Analyst Recommendation

The presence of a public proof of concept significantly increases the risk of automated exploitation attempts. Organizations utilizing Campcodes Grocery Sales and Inventory System must prioritize restricting access to the application immediately and continue monitoring vendor communications for an official security update to address this SQL injection flaw.