by Kastro
Paper/Archive/CVE-2025-40731

CVE-2025-40731

Daily Expense Manager Daily Expense Manager — SQL injection vulnerability in Daily Expense Manager

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 28.4.284 × 205.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, update and delete databases through the pname, pprice and id parameters in /update.php.

Affected

ProductAffectedFixed inSource
Daily Expense Manager1.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
INCIBE (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refincibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-daily-expense-manager