CVE-2025-2604

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. It has been classified as critical. Affected is an unknown function of the file edit_act.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Kortex Lite Advocate Office Management System	1.0

References

https://github.com/Hefei-Coffee/cve/issues/14Exploit, Issue Tracking
https://vuldb.com/?ctiid.300588Permissions Required, VDB Entry
https://vuldb.com/?id.300588Third Party Advisory, VDB Entry
https://vuldb.com/?submit.517965Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/Hefei-Coffee/cve/issues/14Exploit, Issue Tracking

Timeline

Published: Mar 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-260426.0Uptime Kuma >== 1.23.0 has a ReDoS vulnerability, specifically when an administrator creates a notification through the web service. If a st CVE-2025-260475.1Loggrove v1.0 is vulnerable to SQL Injection in the read.py file.CVE-2025-26058.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privi CVE-2025-260545.4Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.CVE-2025-260556.5An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter o CVE-2025-260565.4A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability i CVE-2025-260584.2Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or other protected areas, CVE-2025-26066.3A vulnerability was found in SourceCodester Best Church Management Software 1.0. It has been declared as critical. Affected by this vulnerab CVE-2025-260629.8An access control issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to access the router's settings file CVE-2025-260639.8An issue in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows unauthenticated attackers to execute arbitrary code via injecting a crafted pa CVE-2025-260647.3A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts o CVE-2025-260657.3A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts o