CVE-2025-5696

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in Brilliance Golden Link Secondary System up to 20250424. This vulnerability affects unknown code of the file /storagework/rentChangeCheckInfoPage.htm. The manipulation of the argument clientname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Brilliance	Golden Link Secondary System	20250424

References

https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E9%BB%84%E9%87%91%E9%80%9Astorageworkrent-ChangeCheckInfoPage.htm.mdBroken Link
https://vuldb.com/?ctiid.311212Permissions Required, VDB Entry
https://vuldb.com/?id.311212Third Party Advisory, VDB Entry
https://vuldb.com/?submit.588316Third Party Advisory, VDB Entry

Timeline

Published: Jun 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-56979.8A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affe CVE-2025-56989.8A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unkno CVE-2025-56995.5The Developer Formatter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, and incl CVE-2025-57006.4The Simple Logo Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and CVE-2025-57018.8The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a mis CVE-2025-57025.6The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to CVE-2025-57035.4The StageShow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘anchor’ parameter in all versions up to, and includ CVE-2025-57047.3A vulnerability was found in code-projects Real Estate Property Management System 1.0 and classified as critical. This issue affects some un CVE-2025-57057.3A vulnerability was found in code-projects Real Estate Property Management System 1.0. It has been classified as critical. Affected is an un CVE-2025-570529.8cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote at CVE-2025-570556.5WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An authenticated admini CVE-2025-570577.5Tenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter in the ipMacBindListStore function. This vul