CVE-2025-63689

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the orderby parameter

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Nov 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-63698.8A vulnerability classified as critical has been found in D-Link DIR-619L 2.06B01. Affected is the function formdumpeasysetup of the file /go CVE-2025-636909.1In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management modu CVE-2025-636919.6In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interfa CVE-2025-636935.4The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable CVE-2025-636949.8DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.CVE-2025-636959.8DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.CVE-2025-63708.8A vulnerability classified as critical was found in D-Link DIR-619L 2.06B01. Affected by this vulnerability is the function formWlanGuestSet CVE-2025-637016.8A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentProp CVE-2025-637039.8npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().CVE-2025-637049.8NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query param CVE-2025-637058.8NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.CVE-2025-637069.8NPM package next-npm-version1.0.1 is vulnerable to Command injection.