CVE-2025-6471

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in code-projects Online Bidding System 1.0. Affected by this vulnerability is an unknown functionality of the file /administrator. The manipulation of the argument aduser leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Bidding System	1.0

References

https://code-projects.org/Product
https://github.com/ganzhi-qcy/cve/issues/11Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313579Permissions Required, VDB Entry
https://vuldb.com/?id.313579Third Party Advisory, VDB Entry
https://vuldb.com/?submit.599402Third Party Advisory, VDB Entry

Timeline

Published: Jun 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-647105.3Bitplatform Boilerplate is a Visual studio and .NET project template. Versions prior to 9.11.3 are affected by a cross-site scripting (XSS) CVE-2025-647115.4PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, d CVE-2025-647129.8The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Wor CVE-2025-647137.4WebAssembly Micro Runtime (WAMR) is a lightweight standalone WebAssembly (Wasm) runtime. Prior to version 2.4.4, an out-of-bounds array acce CVE-2025-647145.8PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, a CVE-2025-647155.5Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, C CVE-2025-647165.1Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to ve CVE-2025-647179.8ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulner CVE-2025-647185.3js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of CVE-2025-647194.9Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki p CVE-2025-64729.8A vulnerability, which was classified as critical, has been found in code-projects Online Bidding System 1.0. Affected by this issue is some CVE-2025-647207.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.