VulnerabilityAnalyzed
CVE-2025-10592
A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0.
LOW 2.1EPSS 0.38%
Does this matter?
Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.
Description
A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument search_field/search_text leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.
- CVSS 4.0
- 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.38% probability · 32th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-89
- Affected
- itsourcecode/online public access catalog
- Source
- cna@vuldb.com
References
- https://github.com/drew-byte/Online-Public-Access-Catalog-OPAC-SQLi-PoC/blob/main/README.mdExploit, Third Party Advisory
- https://itsourcecode.com/Product
- https://vuldb.com/?ctiid.324609Permissions Required, VDB Entry
- https://vuldb.com/?id.324609Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.648959Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.