CVE-2025-6474

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /changeUsername.php. The manipulation of the argument user_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Inventory Management System	1.0

References

https://code-projects.org/Product
https://github.com/1609624781/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.313582Permissions Required, VDB Entry
https://vuldb.com/?id.313582Third Party Advisory, VDB Entry
https://vuldb.com/?submit.600494Third Party Advisory, VDB Entry

Timeline

Published: Jun 22, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user CVE-2025-647419.8Improper authorization handling in Zoom Workplace for Android before version 6.5.10 may allow an unauthenticated user to conduct an escalati CVE-2025-647443.5OpenObserve is a cloud-native observability platform. In versions up to and including 0.16.1, when creating or renaming an organization with CVE-2025-647456.1Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting (XSS) vulnerability exists CVE-2025-647465.4Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.13.0, Directus does not properly clean CVE-2025-647475.5Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting (XSS) vulnerability exists in CVE-2025-647486.5Directus is a real-time API and App dashboard for managing SQL database content. A vulnerability in versions prior to 11.13.0 allows authent CVE-2025-647494.3Directus is a real-time API and App dashboard for managing SQL database content. An observable difference in error messaging was found in th CVE-2025-64754.8A vulnerability was found in SourceCodester Student Result Management System 1.0 and classified as problematic. This issue affects some unkn CVE-2025-647504.5SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.3.5 and SingularityPRO 4.1.11 and 4.3.5, if a CVE-2025-647518.8OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.CVE-2025-647526.5grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a fea