CVE-2025-1168

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-contact.php. The manipulation of the argument contact leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Contact Manager with Export to VCF	1.0

References

https://vuldb.com/?ctiid.295072Permissions Required, VDB Entry
https://vuldb.com/?id.295072Third Party Advisory, VDB Entry
https://vuldb.com/?submit.494766Exploit, Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product

Timeline

Published: Feb 11, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-116805.9Out-of-bounds Write in unfilter_scanline in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the CVE-2025-116816.5Denial-of-service condition in M-Files Server versions before 25.11.15392.1, before 25.2 LTS SR2 and before 25.8 LTS SR2 allows an authentic CVE-2025-116827.1Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authentica CVE-2025-116836.5YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure CVE-2025-116876.1A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access CVE-2025-11696.1A vulnerability was found in SourceCodester Image Compressor Tool 1.0. It has been rated as problematic. This issue affects some unknown pro CVE-2025-116908.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive inform CVE-2025-116917.5The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_CVE-2025-116925.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on CVE-2025-116939.8The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl CVE-2025-116948.7A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in th CVE-2025-116957.5When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver v