CVE-2025-6903

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in code-projects Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/approve.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Car Rental System	1.0

References

https://code-projects.org/Product
https://github.com/MaxedFF/cve/issues/1Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.314395Permissions Required, VDB Entry
https://vuldb.com/?id.314395Third Party Advisory, VDB Entry
https://vuldb.com/?submit.604568Third Party Advisory, VDB Entry

Timeline

Published: Jun 30, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-690305.4Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorre CVE-2025-690315.3Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2025-690325.4Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured A CVE-2025-690336.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allo CVE-2025-690348.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekke CVE-2025-690358.8Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affect CVE-2025-690368.8Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Te CVE-2025-690378.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Pippo pi CVE-2025-690388.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Hyori hy CVE-2025-690398.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bailly b CVE-2025-69049.8A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. Affected by this issue is some unknown func CVE-2025-690408.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bfres bf