CVE-2025-15353

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is the function edit_admin_query of the file /admin/edit_admin_query.php. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Society Management System	1.0

References

https://github.com/BUPT2025201/CVE/issues/4Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.338740Permissions Required, VDB Entry
https://vuldb.com/?id.338740Third Party Advisory, VDB Entry
https://vuldb.com/?submit.726280Third Party Advisory, VDB Entry

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-153549.8A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admi CVE-2025-153556.1ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers CVE-2025-153568.8A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet CVE-2025-153579.8A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulat CVE-2025-153587.5DVP-12SE11T - Denial of Service Vulnerability CVE-2025-153599.8DVP-12SE11T - Out-of-bound memory write Vulnerability CVE-2025-15367.3A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerability CVE-2025-153607.2A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/control CVE-2025-153635.9The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perfor CVE-2025-153647.3The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3 CVE-2025-153665.9The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands CVE-2025-153675.9The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands