CVE-2025-7127

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /admin/changepassword.php. The manipulation of the argument currentpassword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jul 7, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-712705.5In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enable exception fixup for specific ADE subcode This patch CVE-2025-712715.5In the Linux kernel, the following vulnerability has been resolved: hfsplus: ensure sb->s_fs_info is always cleaned up When hfsplus was co CVE-2025-712725.5In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths T CVE-2025-712735.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() Simplify t CVE-2025-712744.7In the Linux kernel, the following vulnerability has been resolved: rpmsg: core: fix race in driver_override_show() and use core helper Th CVE-2025-712766.1SOGo before 5.12.5 is prone to a XSS vulnerability with events, tasks, and contacts categories.CVE-2025-712788.8XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes. This affects any customer using OAuth2 clients on any CVE-2025-712799.8XenForo before 2.3.7 contains a security issue affecting Passkeys that have been added to user accounts. An attacker may be able to compromi CVE-2025-71289.8A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown cod CVE-2025-712805.5XenForo before 2.3.7 allows information disclosure via local account page caching on shared systems. On systems where multiple users share a CVE-2025-712819.8XenForo before 2.3.7 does not properly restrict methods callable from within templates. A loose prefix match was used instead of a stricter CVE-2025-712827.5XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker t