CVE-2025-2985

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. This affects an unknown part of the file update_account.php. The manipulation of the argument deduction leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-29865.4IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbit CVE-2025-298646.2Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before CVE-2025-298658.7: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Tr CVE-2025-298668.8: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free CVE-2025-298678.5Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 202 CVE-2025-298686.5Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a CVE-2025-29875.4IBM Maximo Asset Management 7.6.1.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send un CVE-2025-298707.5Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthentica CVE-2025-298715.5An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they ca CVE-2025-298727.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gain CVE-2025-298737.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can th CVE-2025-298746.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can the