CVE-2025-6467

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Online Bidding System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
code-projectsOnline Bidding System1.0

References

Timeline

Published
Jun 22, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-646706.5Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose informaCVE-2025-646717.8Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute coCVE-2025-646729.0Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attCVE-2025-646737.8Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.CVE-2025-646759.6Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to pCVE-2025-646767.2'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.CVE-2025-646778.2Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized CVE-2025-646788.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networCVE-2025-646797.8Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2025-64689.8A vulnerability was found in code-projects Online Bidding System 1.0. It has been declared as critical. This vulnerability affects unknown cCVE-2025-646807.8Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2025-646813.7In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations
CVE-2025-6467: Critical severity, CVSS 9.8 | Vulnix