CVE-2025-4722

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in itsourcecode Placement Management System 1.0. Affected is an unknown function of the file /edit_profile.php. The manipulation of the argument Name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Placement Management System	1.0

References

https://github.com/byxs0x0/cve/issues/4Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.309024Permissions Required, VDB Entry
https://vuldb.com/?id.309024Third Party Advisory, VDB Entry
https://vuldb.com/?submit.569951Third Party Advisory, VDB Entry
https://github.com/byxs0x0/cve/issues/4Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: May 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-472205.3A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which CVE-2025-472215.3An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETOD CVE-2025-472226.5A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties r CVE-2025-472263.3Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.CVE-2025-472277.5In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandle CVE-2025-472286.7In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), shell injection in the SSH connection settings allows a CVE-2025-472295.5libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and applicatio CVE-2025-47239.8A vulnerability classified as critical was found in itsourcecode Placement Management System 1.0. Affected by this vulnerability is an unkno CVE-2025-47249.8A vulnerability, which was classified as critical, has been found in itsourcecode Placement Management System 1.0. Affected by this issue is CVE-2025-472414.0In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority CVE-2025-472447.3Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by c CVE-2025-472458.1In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.