CVE-2025-13169

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /add_query_reserve.php. Such manipulation of the argument room_id leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Online Hotel Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/hanshi-798/CVE/blob/main/tmp72/report.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.332457Permissions Required, VDB Entry
https://vuldb.com/?id.332457Third Party Advisory, VDB Entry
https://vuldb.com/?submit.684616Third Party Advisory, VDB Entry
https://github.com/hanshi-798/CVE/blob/main/tmp72/report.mdExploit, Third Party Advisory

Timeline

Published: Nov 14, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-131709.8A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the CVE-2025-131718.8A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the CVE-2025-131728.8A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-r CVE-2025-131736.5Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initia CVE-2025-131746.3A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /r CVE-2025-131755.1Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using CVE-2025-131768.4Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.CVE-2025-131778.8A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-s CVE-2025-131785.4A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the CVE-2025-131796.5A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue a CVE-2025-131805.4A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an un CVE-2025-131814.8A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Execut