CVE-2025-6118

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Das Parking Management System 停车场管理系统 6.2.0. It has been rated as critical. This issue affects some unknown processing of the file /vehicle/search of the component API. The manipulation of the argument vehicleTypeCode leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Das	Parking Management System 停车场管理系统	6.2.0

References

https://github.com/K-mxredo/MXdocument/blob/K-mxredo-blob/%E5%81%9C%E8%BD%A6%E5%9C%BA%E7%B3%BB%E7%BB%9Fvehicle-search.mdBroken Link
https://vuldb.com/?ctiid.312587Permissions Required, VDB Entry
https://vuldb.com/?id.312587Third Party Advisory, VDB Entry
https://vuldb.com/?submit.591173Third Party Advisory, VDB Entry

Timeline

Published: Jun 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-611816.5daicuocms V1.3.13 contains an arbitrary file upload vulnerability in the image upload feature.CVE-2025-611836.1Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of CVE-2025-611886.3Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files wit CVE-2025-611896.3Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerabilit CVE-2025-61195.3A vulnerability classified as critical has been found in Open Asset Import Library Assimp up to 5.4.3. Affected is the function Assimp::BVHL CVE-2025-611906.1A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functional CVE-2025-611946.5daicuocms V1.3.13 contains a SQL injection vulnerability in the file library\think\db\Builder.php.CVE-2025-611968.8An issue in BusinessNext CRMnext v.10.8.3.0 allows a remote attacker to execute arbitrary code via the comments input parameter.CVE-2025-611978.9An issue in Orban Optimod 5950, Optimod 5950HD, Optimod 5750, Optimod 5750HD, Optimod Trio Optimod version 1.0.0.33 - System version 2.5.26 CVE-2025-611985.4A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod CVE-2025-61205.3A vulnerability classified as critical was found in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the func CVE-2025-61219.8A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pur