CVE-2025-6448

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/delete_room.php. The manipulation of the argument room_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Simple Online Hotel Reservation System	1.0

References

https://code-projects.org/Product
https://github.com/zzb1388/cve/issues/8Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313555Permissions Required, VDB Entry
https://vuldb.com/?id.313555Third Party Advisory, VDB Entry
https://vuldb.com/?submit.598586Third Party Advisory, VDB Entry
https://github.com/zzb1388/cve/issues/8Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Jun 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-644812.7Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed in CVE-2025-644824.6Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 1 CVE-2025-644835.3Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Co CVE-2025-644848.5OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing rev CVE-2025-644855.3CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT u CVE-2025-644869.3calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, al CVE-2025-644877.6Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline CVE-2025-644888.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8 CVE-2025-644898.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-b CVE-2025-64499.8A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0 and classified as critical. Affected by this issue is CVE-2025-644908.3SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-b CVE-2025-644916.1SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow un