CVE-2025-65235

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://eslam3kl.gitbook.ioNot Applicable
https://eslam3kl.gitbook.io/blog/web-application-findings/cve-2025-65235-ussd-gw-sql-injection-subusersExploit, Third Party Advisory
https://github.com/eslam3klNot Applicable
https://eslam3kl.gitbook.io/blog/web-application-findings/cve-2025-65235-ussd-gw-sql-injection-subusersExploit, Third Party Advisory

Timeline

Published: Nov 26, 2025
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-652369.8OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ CVE-2025-652376.1A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav CVE-2025-652386.5Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke CVE-2025-652394.3Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers CVE-2025-65243.1A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Ser CVE-2025-65254.3A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin CVE-2025-65265.3A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processin CVE-2025-652645.5The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attack CVE-2025-652679.0In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Jav CVE-2025-65273.1A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the compone CVE-2025-652706.1Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute CVE-2025-652718.8Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the c