CVE-2025-1162

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /\_parse/load\_user-profile.php. The manipulation of the argument userhash leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Job Recruitment	1.0

References

https://code-projects.org/Product
https://github.com/J0hnFFFF/j0hn_upload_two/blob/main/web1.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.295065Permissions Required, VDB Entry
https://vuldb.com/?id.295065Third Party Advisory, VDB Entry
https://vuldb.com/?submit.494007Third Party Advisory, VDB Entry

Timeline

Published: Feb 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116207.2The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2025-116218.1Vault and Vault Enterprise’s (“Vault”) AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_princ CVE-2025-116227.8Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privileg CVE-2025-116236.5SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the data CVE-2025-116249.8Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system han CVE-2025-116259.8Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of cl CVE-2025-116265.5MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service CVE-2025-116276.5The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in al CVE-2025-116284.7A flaw has been found in jimit105 Project-Online-Shopping-Website up to 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown fu CVE-2025-116299.8A vulnerability has been found in RainyGao DocSys up to 2.02.36. This impacts the function getUserList of the file /Manage/getUserList.do. S CVE-2025-11637.5A vulnerability classified as critical was found in code-projects Vehicle Parking Management System 1.0. This vulnerability affects the func CVE-2025-116309.8A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the comp