CVE-2025-13422

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

A vulnerability was detected in freeprojectscodes Sports Club Management System 1.0. The affected element is an unknown function of the file /dashboard/admin/change_s_pwd.php. Performing manipulation of the argument login_id results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
freeprojectscodes	Sports Club Management System	1.0

References

https://github.com/f14g-orz/CVE/issues/10Exploit, Third Party Advisory
https://vuldb.com/?ctiid.332944Permissions Required, VDB Entry
https://vuldb.com/?id.332944Third Party Advisory, VDB Entry
https://vuldb.com/?submit.696004Third Party Advisory, VDB Entry
https://github.com/f14g-orz/CVE/issues/10Exploit, Third Party Advisory

Timeline

Published: Nov 20, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-134237.2A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/a CVE-2025-134249.8A vulnerability has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_product.CVE-2025-134251.9A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns n CVE-2025-134268.7A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy t CVE-2025-134276.9An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted cha CVE-2025-134287.2A vulnerability exists in the SecOps SOAR server. The custom integrations feature allowed an authenticated user with an "IDE role" to achiev CVE-2025-134316.5The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and in CVE-2025-134324.3Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may a CVE-2025-134337.0A security flaw has been discovered in Muse Group MuseHub 2.1.0.1567. The affected element is an unknown function of the file C:\Program Fil CVE-2025-134347.5A weakness has been identified in jameschz Hush Framework 2.0. The impacted element is an unknown function of the file Hush\hush-lib\hush\Ut CVE-2025-134358.1A security vulnerability has been detected in Dreampie Resty up to 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-http CVE-2025-134366.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1