CVE-2025-6840

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in code-projects Product Inventory System 1.0. This affects an unknown part of the file /index.php of the component Login. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-684008.8ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEma CVE-2025-684014.8ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/JS without sufficien CVE-2025-684028.2FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. password CVE-2025-684034.6An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an admi CVE-2025-684047.5A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability coul CVE-2025-684066.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit t CVE-2025-68417.2A vulnerability has been found in code-projects Product Inventory System 1.0 and classified as critical. This vulnerability affects unknown CVE-2025-68427.2A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processi CVE-2025-684207.5Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs i CVE-2025-684218.7Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a CVE-2025-684224.3Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended CVE-2025-684287.5jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the