CVE-2025-65236

CriticalCVSS 9.8/10Last modified Nov 4, 2026

Description

OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Nov 26, 2025
Last modified
Nov 4, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-652376.1A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavCVE-2025-652386.5Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackeCVE-2025-652394.3Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers CVE-2025-65243.1A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video SerCVE-2025-65254.3A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-binCVE-2025-65265.3A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processinCVE-2025-652645.5The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attackCVE-2025-652679.0In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious JavCVE-2025-65273.1A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the componeCVE-2025-652706.1Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute CVE-2025-652718.8Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the cCVE-2025-652769.8An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0