CVE-2025-60306

CriticalCVSS 9.9/10Last modified Nov 5, 2026

Description

code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and perform sensitive operations.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Chen1-Boop/CVE/blob/main/CVE-2025-60306.mdExploit, Third Party Advisory

Timeline

Published: Oct 10, 2025
Last modified: Nov 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-603079.8code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on CVE-2025-603084.1code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the onli CVE-2025-60317.5Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. W CVE-2025-603118.8ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page CVE-2025-603126.1Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remot CVE-2025-603136.1Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. This allows a r CVE-2025-603145.4Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the CVE-2025-603169.4SourceCodester Pet Grooming Management Software 1.0 is vulnerable to SQL Injection in admin/view_customer.php via the ID parameter.CVE-2025-603186.1SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First N CVE-2025-603196.5PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint CVE-2025-60328.3A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI r CVE-2025-603206.7memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101). The