CVE-2025-0946

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of the file templatedelete.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Tailoring Management System	1.0

References

https://github.com/magic2353112890/cve/issues/7Exploit, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.294301Permissions Required, VDB Entry
https://vuldb.com/?id.294301Third Party Advisory, VDB Entry

Timeline

Published: Feb 1, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-09478.8A vulnerability, which was classified as critical, has been found in itsourcecode Tailoring Management System 1.0. Affected by this issue is CVE-2025-09488.8A vulnerability, which was classified as critical, was found in itsourcecode Tailoring Management System 1.0. This affects an unknown part o CVE-2025-09498.8A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknow CVE-2025-09509.8A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. This issue affects some unknown proces CVE-2025-09514.3Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the CVE-2025-09528.1The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead CVE-2025-09536.1The SMTP for Sendinblue – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2 du CVE-2025-09546.5The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the json_import() and CVE-2025-09555.3The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorev_import_si CVE-2025-09568.1The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 24.4 CVE-2025-09577.2The SMTP for Amazon SES – YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.1 CVE-2025-09586.3The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and