CVE-2025-0208

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Shoe Store	1.0

References

https://code-projects.org/Product
https://gist.github.com/th4s1s/24925a20d1f9336858dee1cbbb30c249Exploit, Third Party Advisory
https://vuldb.com/?ctiid.290145Permissions Required, VDB Entry
https://vuldb.com/?id.290145Permissions Required, VDB Entry
https://vuldb.com/?submit.474038Third Party Advisory, VDB Entry

Timeline

Published: Jan 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-02096.1A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output CVE-2025-02109.8A vulnerability has been found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this vulnerability CVE-2025-02119.8A vulnerability was found in Campcodes School Faculty Scheduling System 1.0 and classified as critical. Affected by this issue is some unkno CVE-2025-02129.8A vulnerability was found in Campcodes Student Grading System 1.0. It has been classified as critical. This affects an unknown part of the f CVE-2025-02139.8A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown c CVE-2025-02144.1A vulnerability was found in TMD Custom Header Menu 4.0.0.1 on OpenCart. It has been rated as problematic. This issue affects some unknown p CVE-2025-02156.1The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and init CVE-2025-02177.8BeyondTrust Privileged Remote Access (PRA) versions prior to 25.1 are vulnerable to a local authentication bypass. A local authenticated att CVE-2025-02187.1When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2 CVE-2025-02192.4A vulnerability, which was classified as problematic, has been found in Trimble SPS851 488.01. Affected by this issue is some unknown functi CVE-2025-02202.4A vulnerability, which was classified as problematic, was found in Trimble SPS851 488.01. This affects an unknown part of the component Ethe CVE-2025-02215.5A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic. This vulnerability affects the function