CVE-2025-6580

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Login. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best Salon Management System	1.0

References

https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-1.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.313776Permissions Required, VDB Entry
https://vuldb.com/?id.313776Third Party Advisory, VDB Entry
https://vuldb.com/?submit.601908Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-1.mdExploit, Third Party Advisory

Timeline

Published: Jun 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-658036.5An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (CVE-2025-658046.5Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable rem CVE-2025-658057.5OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a CVE-2025-658064.3The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP co CVE-2025-658078.4An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.CVE-2025-65818.8A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an un CVE-2025-658146.5A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a direc CVE-2025-658156.5A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a dir CVE-2025-658178.8LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.CVE-2025-65828.8A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue CVE-2025-658209.8An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application whic CVE-2025-658217.5As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret