CVE-2025-5580

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
CodeAstro	Real Estate Management System	1.0

References

https://codeastro.com/Product
https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_login.php.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.311037Permissions Required
https://vuldb.com/?id.311037Third Party Advisory, VDB Entry
https://vuldb.com/?submit.588811Third Party Advisory, VDB Entry
https://github.com/YZS17/CVE/blob/main/CodeAstro_Real_Estate_Management_System/sqli_login.php.mdExploit, Third Party Advisory

Timeline

Published: Jun 4, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-55819.8A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been declared as critical. This vulnerability affects unkno CVE-2025-558106.8A vulnerability was found in Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) with hardware version V03 and firmware version 1.4.2, wh CVE-2025-558166.1HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.CVE-2025-55829.8A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been rated as critical. This issue affects some unknown pro CVE-2025-558246.5ModStartCMS v9.5.0 has an arbitrary file write vulnerability, which allows attackers to write malicious files and execute malicious commands CVE-2025-55839.8A vulnerability classified as critical has been found in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the CVE-2025-558346.1A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logControll CVE-2025-558359.8File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering.CVE-2025-55845.4A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as problematic. Affected is an unknown functi CVE-2025-558478.8Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because CVE-2025-558488.8An issue was discovered in DIR-823 firmware 20250416. There is an RCE vulnerability in the set_cassword settings interface, as the http_cass CVE-2025-558498.4WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee