CVE-2025-11358

HighCVSS 8.8/10Last modified Oct 8, 2026

Description

A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Banking System	1.0

References

https://code-projects.org/Product
https://github.com/QuJun1/cve/issues/2Exploit, Issue Tracking
https://vuldb.com/?ctiid.327245Permissions Required, VDB Entry
https://vuldb.com/?id.327245Third Party Advisory, VDB Entry
https://vuldb.com/?submit.664963Third Party Advisory, VDB Entry

Timeline

Published: Oct 7, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-113598.8A security vulnerability has been detected in code-projects Simple Banking System 1.0. The affected element is an unknown function of the fi CVE-2025-113604.3A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js CVE-2025-113616.4The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forg CVE-2025-113627.5Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throt CVE-2025-113635.3The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to uploa CVE-2025-113656.5The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'google_map' shortcode in a CVE-2025-113669.8N-central < 2025.4 is vulnerable to authentication bypass via path traversal CVE-2025-113679.8The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via deserialization CVE-2025-113685.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and incl CVE-2025-113694.3The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of d CVE-2025-11378.8IBM Storage Scale 5.2.2.0 and 5.2.2.1, under certain configurations, could allow an authenticated user to execute privileged commands due to CVE-2025-113705.3The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider