CVE-2025-15354

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admin.php. Executing manipulation of the argument Username can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-153556.1ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers CVE-2025-153568.8A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSetCVE-2025-153579.8A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulatCVE-2025-153587.5DVP-12SE11T - Denial of Service VulnerabilityCVE-2025-153599.8DVP-12SE11T - Out-of-bound memory write VulnerabilityCVE-2025-15367.3A vulnerability was found in Raisecom Multi-Service Intelligent Gateway up to 20250208. It has been declared as critical. This vulnerabilityCVE-2025-153607.2A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controlCVE-2025-153635.9The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perforCVE-2025-153647.3The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3CVE-2025-153665.9The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commandsCVE-2025-153675.9The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands CVE-2025-153688.8The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'temp