CVE-2025-12339

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Retro Basketball Shoes Online Store	1.0

References

https://github.com/HYLCXH/CVE/issues/17Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.330126Permissions Required, VDB Entry
https://vuldb.com/?id.330126Third Party Advisory, VDB Entry
https://vuldb.com/?submit.674493Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Oct 28, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-123417.8A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of th CVE-2025-123427.3A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014. The affected element is an unknown function of the file /Auth.php of t CVE-2025-123435.5A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnn_backend_tf.c source file. The issue occurs in the dnn_execute_mod CVE-2025-123446.3A vulnerability has been found in Yonyou U8 Cloud up to 5.1sp. The impacted element is an unknown function of the file /service/NCloudGatewa CVE-2025-123458.8A security vulnerability has been detected in LLM-Claw 0.1.0/0.1.1/0.1.1a/0.1.1a-p1. The affected element is the function agent_deploy_init CVE-2025-123468.8A vulnerability was detected in MaxSite CMS up to 109. This vulnerability affects unknown code of the file application/maxsite/admin/plugins CVE-2025-123478.8A flaw has been found in MaxSite CMS up to 109. This issue affects some unknown processing of the file application/maxsite/admin/plugins/edi CVE-2025-123485.3The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in CVE-2025-123495.3The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Authorization in version CVE-2025-12354.3A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes CVE-2025-123505.3The DominoKit plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wp_ajax_nopriv_dominokit_op CVE-2025-123516.8Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially explo