CVE-2025-6867

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability was found in SourceCodester Simple Company Website 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/services/manage.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
SourceCodester	Simple Company Website	1.0

References

https://github.com/ez-lbz/poc/issues/23Exploit, Issue Tracking
https://vuldb.com/?ctiid.314339Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.314339Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603637Third Party Advisory, VDB Entry
https://www.sourcecodester.com/Product
https://github.com/ez-lbz/poc/issues/23Exploit, Issue Tracking

Timeline

Published: Jun 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-686709.8xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stem CVE-2025-686714.8lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps CVE-2025-686757.5In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embed CVE-2025-68687.2A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been classified as critical. Affected is an unknown function CVE-2025-686865.9An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1,CVE-2025-68697.2A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been declared as critical. Affected by this vulnerability is CVE-2025-686968.2httparty is an API tool. In versions 0.23.2 and prior, httparty is vulnerable to SSRF. This issue can pose a risk of leaking API keys, and i CVE-2025-686975.4n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy CVE-2025-686987.5Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulne CVE-2025-686996.5NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsis CVE-2025-68704.7A vulnerability was found in SourceCodester Simple Company Website 1.0. It has been rated as critical. Affected by this issue is some unknow CVE-2025-687008.8RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions prior to 0.23.0, a low-privileged authenticated user (nor