CVE-2025-14877

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulation of the argument cmbAreaCode leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Supplier Management System	1.0

References

https://github.com/ProgramShowMaker/CVE/issues/6Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.337368Permissions Required, VDB Entry
https://vuldb.com/?id.337368Third Party Advisory, VDB Entry
https://vuldb.com/?submit.715326Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Dec 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-148789.8A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirelessRestart of the com CVE-2025-148799.8A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HT CVE-2025-14886.1The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This CVE-2025-148805.3The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability CVE-2025-148813.8Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be acces CVE-2025-148823.8An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible b CVE-2025-148847.2A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Upda CVE-2025-148858.8A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of t CVE-2025-148865.3The Japanized for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t CVE-2025-148874.4The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender CVE-2025-148884.4The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions CVE-2025-148896.3A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the f