PKrystian Full-Stack-Bank User sql injection

Published 10 mo ago 2025-12-31 · modified 10 d ago 2026-10-28 · JSON

CVSS

4.7

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.2%

percentile 15%

Public exploits

none known

A vulnerability was detected in PKrystian Full-Stack-Bank up to bf73a0179e3ff07c0d7dc35297cea0be0e5b1317. This vulnerability affects unknown code of the component User Handler. Performing manipulation results in sql injection. It is possible to initiate the attack remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The patch is named 25c9965a872c704f3a9475488dc5d3196902199a. It is suggested to install a patch to address this issue.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 10 mo ago 2026-01-02

Exploit prediction (EPSS)

0.24% probability of exploitation in the next 30 days, higher than 15% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X`
CNA	3.1	4.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C`
CNA	3.0	4.7	`CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C`
CNA	2.0	5.8	`AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C`
CNA	4.0	5.1	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	4.7	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L`
CNA	2.0	5.8	`AV:N/AC:L/Au:M/C:P/I:P/A:P`

Affected products

PKrystian Full-Stack-Bank

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

vuldb.com /?id.338650 · vdb-entry
vuldb.com /?ctiid.338650 · signature, permissions-required
github.com /PKrystian/Full-Stack-Bank/pull/21 · issue-tracking
github.com /PKrystian/Full-Stack-Bank/commit/25c9965a872c704f3a9475488dc5d3196902199a · patch

Sources

CVE List: CVE-2023-7331
NVD: CVE-2023-7331

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary