CVE-2025-4497

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Simple Banking System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the component Sign In. The manipulation of the argument password2 leads to buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-120

Affected software

Vendor	Product	Versions
code-projects	Simple Banking System	1.0

References

https://code-projects.org/Product
https://github.com/zzzxc643/cve/blob/main/Banking_System.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.308213Permissions Required, VDB Entry
https://vuldb.com/?id.308213Third Party Advisory, VDB Entry
https://vuldb.com/?submit.567082Third Party Advisory, VDB Entry
https://github.com/zzzxc643/cve/blob/main/Banking_System.mdExploit, Third Party Advisory

Timeline

Published: May 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-44987.8A vulnerability classified as critical has been found in code-projects Simple Bus Reservation System 1.0. Affected is the function a::instal CVE-2025-44997.8A vulnerability classified as critical was found in code-projects Simple Hospital Management System 1.0. Affected by this vulnerability is t CVE-2025-449986.1A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execut CVE-2025-45007.8A vulnerability, which was classified as critical, has been found in code-projects Hotel Management System 1.0. Affected by this issue is th CVE-2025-450017.5react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as pla CVE-2025-450025.4Vigybag v1.0 and before is vulnerable to Cross Site Scripting (XSS) via the upload profile picture function under my profile.CVE-2025-450069.1Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling CVE-2025-450074.8A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0. T CVE-2025-450095.3A HTML Injection vulnerability was discovered in the normal-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vulner CVE-2025-45017.8A vulnerability, which was classified as critical, was found in code-projects Album Management System 1.0. This affects the function searcha CVE-2025-450105.3A HTML Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System CVE-2025-450115.3A HTML Injection vulnerability was discovered in the foreigner-search.php file of PHPGurukul Park Ticketing Management System v2.0. This vul