CVE-2025-5650

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in 1000projects Online Notice Board 1.0. This vulnerability affects unknown code of the file /register.php. The manipulation of the argument fname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
1000projects	Online Notice Board	1.0

References

https://github.com/ubfbuz3/cve/issues/17Exploit, Issue Tracking
https://vuldb.com/?ctiid.311140Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.311140Third Party Advisory, VDB Entry
https://vuldb.com/?submit.589819Third Party Advisory, VDB Entry
https://github.com/ubfbuz3/cve/issues/17Exploit, Issue Tracking

Timeline

Published: Jun 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-565036.5An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Admini CVE-2025-56515.4A vulnerability, which was classified as problematic, has been found in code-projects Traffic Offense Reporting System 1.0. This issue affec CVE-2025-565139.8NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of i CVE-2025-565145.4Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are r CVE-2025-565158.8File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG fi CVE-2025-56528.8A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 2.0. Affected is an unknown function CVE-2025-565205.3Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_files.RemoteFileUplo CVE-2025-565266.1Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF.CVE-2025-565277.5Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.CVE-2025-56538.8A vulnerability has been found in PHPGurukul Complaint Management System 2.0 and classified as critical. Affected by this vulnerability is a CVE-2025-565346.1A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary CVE-2025-565356.1A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a