CVE-2025-10841

CriticalCVSS 9.8/10Last modified Oct 11, 2026

Description

A security vulnerability has been detected in code-projects Online Bidding System 1.0. This impacts an unknown function of the file /administrator/weweee.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Bidding System	1.0

References

https://code-projects.org/Product
https://github.com/fengzipan/cve/blob/master/tmp30/tmp30/report.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.325203Permissions Required, VDB Entry
https://vuldb.com/?id.325203Third Party Advisory, VDB Entry
https://vuldb.com/?submit.657195Third Party Advisory, VDB Entry

Timeline

Published: Sep 23, 2025
Last modified: Oct 11, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-108429.8A vulnerability was detected in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /administrator/wew.php.CVE-2025-108439.8A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the CVE-2025-108448.8A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/C CVE-2025-108458.8A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The CVE-2025-108468.8A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurr CVE-2025-108478.4DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) compo CVE-2025-108488.8A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the fil CVE-2025-108495.3The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'proces CVE-2025-10854.3A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the fil CVE-2025-108509.8The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to th CVE-2025-108519.8A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=log CVE-2025-108536.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encod