CVE-2025-15408

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

A vulnerability was found in code-projects Online Guitar Store 1.0. Affected is an unknown function of the file /admin/Create_product.php. Performing a manipulation of the argument dre_title results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Guitar Store	1.0

References

https://code-projects.org/Product
https://github.com/jjjjj-zr/jjjjjzr19/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.339328Permissions Required, VDB Entry
https://vuldb.com/?id.339328Third Party Advisory, VDB Entry
https://vuldb.com/?submit.728392Third Party Advisory, VDB Entry

Timeline

Published: Jan 1, 2026
Last modified: Oct 7, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-154099.8A vulnerability was determined in code-projects Online Guitar Store 1.0. Affected by this vulnerability is an unknown functionality of the f CVE-2025-154109.8A vulnerability was identified in code-projects Online Guitar Store 1.0. Affected by this issue is some unknown functionality of the file /l CVE-2025-154117.8A weakness has been identified in WebAssembly wabt up to 1.0.39. This vulnerability affects the function wabt::AST::InsertNode of the file /CVE-2025-154127.8A security vulnerability has been detected in WebAssembly wabt up to 1.0.39. This issue affects the function wabt::Decompiler::VarName of th CVE-2025-154137.8A vulnerability was detected in wasm3 up to 0.5.0. Impacted is the function op_SetSlot_i32/op_CallIndirect of the file m3_exec.h. Performing CVE-2025-154144.7A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/git_fetcher.g CVE-2025-154155.4A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.CVE-2025-154165.4A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add G CVE-2025-154175.5A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/CVE-2025-154185.5A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the CVE-2025-154195.5A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the CVE-2025-15429.3Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileg