CVE-2025-6917

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in code-projects Online Hotel Booking 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/registration.php. The manipulation of the argument uname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-89

Affected software

VendorProductVersions
code-projectsOnline Hotel Booking1.0

References

Timeline

Published
Jun 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-691708.1Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.CVE-2025-691718.1Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.CVE-2025-691728.1Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.CVE-2025-691738.1Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.CVE-2025-691748.1Unauthenticated Local File Inclusion in Etude <= 1.6 versions.CVE-2025-691758.1Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.CVE-2025-691768.1Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.CVE-2025-691778.1Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.CVE-2025-691788.1Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.CVE-2025-691799.8Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions.CVE-2025-69189.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL CVE-2025-691808.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-por
CVE-2025-6917: Critical severity, CVSS 9.8 | Vulnix