CVE-2025-4069

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, has been found in code-projects Product Management System 1.0. Affected by this issue is the function add_item. The manipulation of the argument st.productname leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-121

Affected software

Vendor	Product	Versions
code-projects	Product Management System	1.0

References

https://code-projects.org/Product
https://github.com/zzzxc643/cve/blob/main/PRODUCT_MANAGEMENT_SYSTEM.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.306506Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.306506Third Party Advisory, VDB Entry
https://vuldb.com/?submit.559516Third Party Advisory, VDB Entry
https://github.com/zzzxc643/cve/blob/main/PRODUCT_MANAGEMENT_SYSTEM.mdExploit, Third Party Advisory

Timeline

Published: Apr 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-406909.8SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and dele CVE-2025-406919.8SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and dele CVE-2025-406929.8SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and dele CVE-2025-406935.4Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS du CVE-2025-406945.4Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack CVE-2025-406955.4Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack CVE-2025-406965.4Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack CVE-2025-406975.1Reflected Cross-Site Scripting (XSS) vulnerability in '/index.php' in Lewe WebMeasure, which allows remote attackers to execute arbitrary co CVE-2025-406988.7SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and CVE-2025-40709.8A vulnerability, which was classified as critical, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of CVE-2025-407006.1Reflected Cross-Site Scripting (XSS) in IDI Eikon's Governalia. The vulnerability allows an attacker to execute JavaScript code in the victi CVE-2025-407015.1Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute JavaScript code in th