CVE-2025-6891

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability classified as critical has been found in code-projects Inventory Management System 1.0. Affected is an unknown function of the file /php_action/createUser.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Inventory Management System	1.0

References

https://code-projects.org/Product
https://github.com/tangjihong1974/cve/issues/2Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.314370Permissions Required, VDB Entry
https://vuldb.com/?id.314370Third Party Advisory, VDB Entry
https://vuldb.com/?submit.603882Third Party Advisory, VDB Entry

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-689109.9Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogzee blogzee allows Using Malicious Files.This issue affects CVE-2025-689116.5Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This i CVE-2025-689128.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Harmonic Design HDForms hdforms allows Path CVE-2025-689137.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Miion mi CVE-2025-689145.3Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/login.cgi username SQL Injection. For example, an attacker can delete the LOGIN CVE-2025-689154.8Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/loginbanner_w.cgi XSS via a crafted banner.CVE-2025-689167.2Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code ex CVE-2025-689176.4ONLYOFFICE Docs before 9.2.1 allows XSS in the textarea of the comment editing form. This is related to DocumentServer.CVE-2025-689195.6Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenanc CVE-2025-68928.7An Incorrect Authorization vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the API authentica CVE-2025-689208.9C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12) before 244644d allows a remote Kermit system to overwrite files on the local sy CVE-2025-689217.8SteelSeries Nahimic 3 1.10.7 allows Directory traversal.