CVE-2025-14666

CriticalCVSS 9.8/10Last modified Sep 28, 2026

Description

A weakness has been identified in itsourcecode COVID Tracking System 1.0. The affected element is an unknown function of the file /admin/?page=user. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	COVID Tracking System	1.0

References

https://github.com/bardminx/Lonlydance/issues/2Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.336398Permissions Required, VDB Entry
https://vuldb.com/?id.336398Third Party Advisory, VDB Entry
https://vuldb.com/?submit.714786Third Party Advisory, VDB Entry

Timeline

Published: Dec 14, 2025
Last modified: Sep 28, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-146679.8A security vulnerability has been detected in itsourcecode COVID Tracking System 1.0. The impacted element is an unknown function of the fil CVE-2025-146689.8A vulnerability was detected in campcodes Advanced Online Examination System 1.0. This affects an unknown function of the file /query/loginE CVE-2025-14676.1Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(CVE-2025-146729.8A flaw has been found in gmg137 snap7-rs up to 1.142.1. This impacts the function TSnap7MicroClient::opWriteArea of the file s7_micro_client CVE-2025-146739.8A vulnerability has been found in gmg137 snap7-rs up to 1.142.1. Affected is the function snap7_rs::client::S7Client::as_ct_write of the fil CVE-2025-146746.3A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file CVE-2025-146757.2The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_delete_file CVE-2025-14687.5An unauthenticated remote attacker can gain access to sensitive information including authentication information when using CODESYS OPC UA S CVE-2025-146843.3IBM Maximo Application Suite - Monitor Component 9.1, 9.0, 8.11, and 8.10 could allow an unauthorized user to inject data into log messages CVE-2025-146876.5IBM Db2 Intelligence Center 1.1.0, 1.1.1, 1.1.2 could allow an authenticated user to perform unauthorized actions due to client-side enforce CVE-2025-146885.3IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authentica CVE-2025-146896.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 through 12.1.3 could allow an authenticated user to cause a denial