CVE-2025-4875

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-487519.8The process_lock crate 0.1.0 for Rust allows data races in unlock.CVE-2025-487529.8In the process-sync crate 0.2.2 for Rust, the drop function lacks a check for whether the pthread_mutex is unlocked.CVE-2025-487539.8In the anode crate 0.1.0 for Rust, data races can occur in unlock in SpinLock.CVE-2025-487547.5In the memory_pages crate 0.1.0 for Rust, division by zero can occur.CVE-2025-487559.8In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).CVE-2025-487569.8In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g CVE-2025-487579.3An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to CVE-2025-48764.4ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via CVE-2025-487686.5Release of Invalid Pointer or Reference vulnerability was discovered in fs/inode/fs_inoderemove code of the Apache NuttX RTOS that allowed r CVE-2025-487698.1Use After Free vulnerability was discovered in fs/vfs/fs_rename code of the Apache NuttX RTOS, that due recursive implementation and single CVE-2025-48774.5There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerpri CVE-2025-48783.6A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function.