CVE-2025-3039

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /add_employee.php. The manipulation of the argument lname/fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-303908.8Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.CVE-2025-303917.5Improper input validation in Microsoft Dynamics allows an unauthorized attacker to disclose information over a network.CVE-2025-303929.8Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.CVE-2025-303937.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303945.9Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a CVE-2025-303977.5Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code CVE-2025-303988.1Missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network.CVE-2025-303997.5Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2025-30409.8A vulnerability was found in Project Worlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some uCVE-2025-304007.8Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.CVE-2025-304016.7A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file CVE-2025-304028.1A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code exec
CVE-2025-3039: High severity, CVSS 8.8 | Vulnix