CVE-2025-6607

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/stock.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Best Salon Management System	1.0

References

https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-8.mdExploit, Third Party Advisory
https://vuldb.com/?ctiid.313824Permissions Required, VDB Entry
https://vuldb.com/?id.313824Third Party Advisory, VDB Entry
https://vuldb.com/?submit.601916Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/Colorado-all/cve/blob/main/Best%20salon%20management%20system/SQL-8.mdExploit, Third Party Advisory

Timeline

Published: Jun 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-660707.5Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.CVE-2025-660715.3Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Explo CVE-2025-660725.3Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2025-660737.2Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks CVE-2025-660749.0Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects CVE-2025-660754.3Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiti CVE-2025-660765.3Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.CVE-2025-660775.3Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2025-660789.1Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allow CVE-2025-660796.5Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Sec CVE-2025-66088.8A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability CVE-2025-660805.3Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiti