CVE-2025-4721

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /drive.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-472106.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then CVE-2025-472114.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrat CVE-2025-472127.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administ CVE-2025-472134.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-472144.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an a CVE-2025-472198.1In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 fil CVE-2025-47229.8A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of th CVE-2025-472205.3A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which CVE-2025-472215.3An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETOD CVE-2025-472226.5A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties r CVE-2025-472263.3Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-472277.5In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandle