CVE-2025-3018

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Online Eyewear Shop	1.0

References

https://github.com/csemfl/cve/blob/main/sql.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.302070Permissions Required, VDB Entry
https://vuldb.com/?id.302070Third Party Advisory, VDB Entry
https://vuldb.com/?submit.524623Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/csemfl/cve/blob/main/sql.mdExploit, Third Party Advisory

Timeline

Published: Mar 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-301826.7Uncontrolled search path for some Intel(R) Distribution for Python software installers before version 2025.2.0 within Ring 3: User Applicati CVE-2025-301837.5CyberData 011209 Intercom does not properly store or protect web server admin credentials.CVE-2025-301849.8CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path.CVE-2025-301857.9Active debug code for some Intel UEFI reference platforms within Ring 0: Kernel may allow a denial of service and escalation of privilege. S CVE-2025-301865.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-301873.7In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over HTTPS queries, an attacker might b CVE-2025-301887.5Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict information that is requir CVE-2025-301897.4When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be us CVE-2025-30197.2KNIME Business Hub is affected by several cross-site scripting vulnerabilities in its web pages. If a user clicks on a malicious link or ope CVE-2025-301905.4Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the c CVE-2025-301915.4Malicious content from E-Mail can be used to perform a redressing attack. Users can be tricked to perform unintended actions or provide sens CVE-2025-301927.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.