First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-61540

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 16, 2025
Last modified: Nov 5, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-615417.1Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset link sent to users is CVE-2025-615437.1A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2. The system uses `$_SERVER['HTTP_HOST CVE-2025-615469.1There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 CVE-2025-615476.8Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76 CVE-2025-615489.8SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business CVE-2025-615496.1Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Pr CVE-2025-61559.8A vulnerability was found in PHPGurukul Hostel Management System 1.0. It has been classified as critical. Affected is an unknown function of CVE-2025-615505.4Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx end CVE-2025-615538.2An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows l CVE-2025-615545.5A divide-by-zero in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local a CVE-2025-615577.5nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal.CVE-2025-61568.8A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been declared as critical. Affected by this vulner

CVE-2025-61540: Medium severity, CVSS 6.5 | Vulnix