CVE-2025-3135

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /api/system/dept/update. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
fcba_zzm	ics-park Smart Park Management System	2.1

References

https://vuldb.com/?ctiid.303040Permissions Required, VDB Entry
https://vuldb.com/?id.303040Third Party Advisory, VDB Entry
https://vuldb.com/?submit.525136Third Party Advisory, VDB Entry
https://www.yuque.com/yuqueyonghuveuwuh/aveeid/yvtgf3ynsi949ve3?singleDocBroken Link
https://www.yuque.com/yuqueyonghuveuwuh/aveeid/yvtgf3ynsi949ve3?singleDocBroken Link

Timeline

Published: Apr 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-313508.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-313518.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-313528.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-313538.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL inj CVE-2025-313544.3Subnet Solutions PowerSYSTEM Center's SMTPS notification service can be affected by importing an EC certificate with crafted F2m parameters,CVE-2025-313559.8A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. A specially craft CVE-2025-313565.7Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow CVE-2025-313575.3An unauthenticated attacker can obtain a user's plant list by knowing the username.CVE-2025-313598.8A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879). CVE-2025-31363.3A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.cac CVE-2025-313607.5Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users.CVE-2025-313618.7A privilege escalation vulnerability exists in the ControlVault WBDI Driver WBIO_USH_ADD_RECORD functionality of Dell ControlVault3 prior to