CVE-2025-12608

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manage_user.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Online Loan Management System	1.0

References

https://github.com/cintahue/CVE/issues/5Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Permissions Required, VDB Entry
https://vuldb.com/?ctiid.330898Third Party Advisory, VDB Entry
https://vuldb.com/?id.330898Third Party Advisory, VDB Entry
https://vuldb.com/?submit.678244Third Party Advisory, VDB Entry

Timeline

Published: Nov 3, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-126098.8A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/up CVE-2025-12615.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the plugin's Cou CVE-2025-126107.2A vulnerability was determined in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/view-progress-report.CVE-2025-126119.8A vulnerability was identified in Tenda AC21 16.03.08.16. This vulnerability affects the function formSetPPTPServer of the file /goform/SetP CVE-2025-126129.8A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. This issue affects some unknown processing of th CVE-2025-126138.6Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values c CVE-2025-126149.8A weakness has been identified in SourceCodester Best House Rental Management System 1.0. Impacted is the function delete_payment of the fil CVE-2025-126158.1A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/sett CVE-2025-126165.9A vulnerability was detected in PHPGurukul News Portal 1.0. The impacted element is an unknown function of the file /onps/settings.py. Perfo CVE-2025-126179.8A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/login_crud.php. Executing CVE-2025-126189.8A vulnerability has been found in Tenda AC8 16.03.34.06. This impacts an unknown function of the file /goform/DatabaseIniSet. The manipulati CVE-2025-126199.8A vulnerability was found in Tenda A15 15.13.07.13. Affected is the function fromSetWirelessRepeat of the file /goform/openNetworkGateway. T