CVE-2025-1210

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in code-projects Wazifa System 1.0. Affected by this vulnerability is an unknown functionality of the file /controllers/control.php. The manipulation of the argument to leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Wazifa System	1.0

References

https://code-projects.org/Product
https://github.com/nanguawuming/CVE2/blob/main/cve3.pdfExploit, Third Party Advisory
https://vuldb.com/?ctiid.295147Permissions Required, VDB Entry
https://vuldb.com/?id.295147VDB Entry
https://vuldb.com/?submit.497357VDB Entry

Timeline

Published: Feb 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-121007.8Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector CVE-2025-121015.9Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Pro CVE-2025-121035.0A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions CVE-2025-121049.8Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through CVE-2025-121057.5A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to ma CVE-2025-121069.1Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP CVE-2025-121077.2The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or val CVE-2025-121089.3The Survision LPR Camera system does not enforce password protection by default. This allows access to the configuration wizard immediately CVE-2025-121096.4The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CVE-2025-12116.5Versions of the package hackney before 1.21.0 are vulnerable to Server-side Request Forgery (SSRF) due to improper parsing of URLs by URI bu CVE-2025-121105.4A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh CVE-2025-121126.4The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to Stored Cross-Site Scripting via adding scripts in all