CVE-2025-11615

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best Salon Management System	1.0

References

https://github.com/Blowingwinds/cve-report/blob/main/cve7/report.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.327946Permissions Required, VDB Entry
https://vuldb.com/?id.327946Third Party Advisory, VDB Entry
https://vuldb.com/?submit.672822Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/Blowingwinds/cve-report/blob/main/cve7/report.mdExploit, Third Party Advisory

Timeline

Published: Oct 11, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116165.4A missing validation check in FreeRTOS-Plus-TCP's ICMPv6 packet processing code can lead to an out-of-bounds read when receiving ICMPv6 pack CVE-2025-116175.4A missing validation check in FreeRTOS-Plus-TCP's IPv6 packet processing code can lead to an out-of-bounds read when receiving a IPv6 packet CVE-2025-116184.3A missing validation check in FreeRTOS-Plus-TCP's UDP/IPv6 packet processing code can lead to an invalid pointer dereference when receiving CVE-2025-116198.8Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to CVE-2025-11627.5A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_pars CVE-2025-116207.2The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2025-116218.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_princ CVE-2025-116227.8Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileg CVE-2025-116236.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data CVE-2025-116249.8Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system han CVE-2025-116259.8Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of cl CVE-2025-116265.5MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service