CVE-2025-0874

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in code-projects Simple Plugins Car Rental Management 1.0. Affected by this issue is some unknown functionality of the file /admin/approve.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Plugins Car Rental Management	1.0

References

https://code-projects.org/Product
https://github.com/magic2353112890/cve/issues/8Exploit, Third Party Advisory
https://vuldb.com/?ctiid.294068Permissions Required, VDB Entry
https://vuldb.com/?id.294068Third Party Advisory, VDB Entry
https://vuldb.com/?submit.488538Third Party Advisory, VDB Entry

Timeline

Published: Jan 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-08756.5Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affa CVE-2025-08764.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Informa CVE-2025-08774.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management CVE-2025-08784.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross CVE-2025-08794.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App CVE-2025-08809.8A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of th CVE-2025-08819.8A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the CVE-2025-08827.5A vulnerability was found in code-projects Chat System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unk CVE-2025-08832.1Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal CVE-2025-08847.3Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges CVE-2025-08851.8Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The v CVE-2025-08867.8An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to esc