CVE-2025-6468

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Online Bidding System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /bidnow.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-646807.8Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2025-646813.7In JetBrains Hub before 2025.3.104992 a race condition allowed bypass of the user limit via invitations CVE-2025-646823.7In JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limit CVE-2025-646837.5In JetBrains Hub before 2025.3.104432 information disclosure was possible via the Users API CVE-2025-646847.5In JetBrains YouTrack before 2025.3.104432 information disclosure was possible via the feedback form CVE-2025-646857.5In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure CVE-2025-64699.8A vulnerability was found in code-projects Online Bidding System 1.0. It has been rated as critical. This issue affects some unknown process CVE-2025-646918.8The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate p CVE-2025-646939.3Security Point (Windows) of MaLion and MaLionCloud contains a heap-based buffer overflow vulnerability in processing Content-Length. Receivi CVE-2025-646958.4Uncontrolled search path element issue exists in the installer of LogStare Collector (for Windows). If exploited, arbitrary code may be exec CVE-2025-646964.8Android App "Brother iPrint&Scan" versions 6.13.7 and earlier improperly uses an external cache directory. If exploited, application-specifi CVE-2025-646997.8An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The regService process, which runs with SYSTEM privil