CVE-2025-10843

CriticalCVSS 9.8/10Last modified Oct 11, 2026

Description

A flaw has been found in Reservation Online Hotel Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /reservation/paypalpayout.php. Executing manipulation of the argument confirm can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2025
Last modified: Oct 11, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-108448.8A vulnerability has been found in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /module/C CVE-2025-108458.8A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/ComponenteCurricular/view. The CVE-2025-108468.8A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurr CVE-2025-108478.4DX Unified Infrastructure Management (Nimsoft/UIM) and below contains an improper ACL handling vulnerability in the robot (controller) compo CVE-2025-108488.8A vulnerability was identified in Campcodes Society Membership Information System 1.0. This issue affects some unknown processing of the fil CVE-2025-108495.3The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'proces CVE-2025-10854.3A vulnerability, which was classified as problematic, was found in Animati PACS up to 1.24.12.09.03. This affects an unknown part of the fil CVE-2025-108509.8The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to th CVE-2025-108519.8A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=log CVE-2025-108536.1A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encod CVE-2025-108548.1The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path CVE-2025-108557.5Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trust