CVE-2025-12929

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A flaw has been found in SourceCodester Survey Application System 1.0. This impacts the function save_user/update_user of the file /LoginRegistration.php. Executing manipulation of the argument fullname can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Survey Application System	1.0

References

https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.331649Permissions Required, VDB Entry
https://vuldb.com/?id.331649Third Party Advisory, VDB Entry
https://vuldb.com/?submit.681746Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/lakshayyverma/CVE-Discovery/blob/main/Survey%20Application%20System.mdExploit, Third Party Advisory

Timeline

Published: Nov 10, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-12938.2Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authe CVE-2025-129309.8A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The CVE-2025-129319.8A vulnerability was found in SourceCodester Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file CVE-2025-129329.8A vulnerability was determined in SourceCodester Baby Care System 1.0. Affected by this issue is some unknown functionality of the file /adm CVE-2025-129339.8A vulnerability was identified in SourceCodester Baby Care System 1.0. This affects an unknown part of the file /updatewelcome.php?id=siteop CVE-2025-129348.1The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to unauthorized access and modification of data due to a miss CVE-2025-129356.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vuln CVE-2025-129376.5The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o CVE-2025-129389.8A vulnerability was identified in projectworlds Online Admission System 1.0. Affected by this vulnerability is an unknown functionality of t CVE-2025-129399.8A security flaw has been discovered in SourceCodester Interview Management System up to 1.0. Affected by this issue is some unknown function CVE-2025-12947.2The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4 CVE-2025-129405.5Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Mu