CVE-2025-6883

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical was found in code-projects Staff Audit System 1.0. This vulnerability affects unknown code of the file /update_index.php. The manipulation of the argument updateid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Staff Audit System	1.0

References

https://code-projects.org/Product
https://github.com/qingchuana/q1ngchuan/issues/7Exploit, Issue Tracking
https://vuldb.com/?ctiid.314362Permissions Required, Third Party Advisory, VDB Entry
https://vuldb.com/?id.314362Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603719Third Party Advisory, VDB Entry
https://github.com/qingchuana/q1ngchuan/issues/7Exploit, Issue Tracking

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-688335.3HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access t CVE-2025-688347.5Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-s CVE-2025-688357.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matiskiba Ravpage ravpage allows Refle CVE-2025-688367.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Markbeljaars Table of Contents Creator CVE-2025-688376.5Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticke CVE-2025-688387.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discor CVE-2025-688397.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Theme Options easy-th CVE-2025-68848.8A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown p CVE-2025-688407.1Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-688417.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack CVE-2025-688427.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget CVE-2025-688437.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Schuiling FeedWordPress Advanced F