CVE-2025-13410

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected is an unknown function of the file /admin/receipt.php. Such manipulation of the argument tid leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Retro Basketball Shoes Online Store	1.0

References

https://github.com/laosijivul/cve/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.332937Permissions Required, VDB Entry
https://vuldb.com/?id.332937Third Party Advisory, VDB Entry
https://vuldb.com/?submit.693696Third Party Advisory, VDB Entry
https://www.campcodes.com/Product
https://github.com/laosijivul/cve/issues/3Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Nov 19, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-134119.8A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this vulnerability is an unknown functionality o CVE-2025-134126.1A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of CVE-2025-134134.3The Country Blocker for AdSense plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. CVE-2025-134145.3The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing capability check on CVE-2025-134155.4A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SV CVE-2025-134164.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing CVE-2025-134178.6The Plugin Organizer WordPress plugin before 10.2.4 does not sanitize and escape a parameter before using it in a SQL statement, allowing su CVE-2025-134186.4The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all version CVE-2025-134195.3The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification o CVE-2025-134209.8A weakness has been identified in itsourcecode Human Resource Management System 1.0. This issue affects some unknown processing of the file CVE-2025-134219.8A security vulnerability has been detected in itsourcecode Human Resource Management System 1.0. Impacted is an unknown function of the file CVE-2025-134229.8A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file