CVE-2025-8378

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Campcodes Online Hotel Reservation System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
Campcodes	Online Hotel Reservation System	1.0

References

https://github.com/XiaoJiesecqwq/sql/issues/1Exploit, Issue Tracking
https://vuldb.com/?ctiid.318356Permissions Required, VDB Entry
https://vuldb.com/?id.318356Third Party Advisory, VDB Entry
https://vuldb.com/?submit.624801Third Party Advisory, VDB Entry
https://www.campcodes.com/Product

Timeline

Published: Jul 31, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-83797.2A vulnerability classified as critical has been found in Campcodes Online Hotel Reservation System 1.0. This affects an unknown part of the CVE-2025-83805.4A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown cod CVE-2025-83818.8A vulnerability, which was classified as critical, has been found in Campcodes Online Hotel Reservation System 1.0. This issue affects some CVE-2025-83828.8A vulnerability, which was classified as critical, was found in Campcodes Online Hotel Reservation System 1.0. Affected is an unknown functi CVE-2025-83834.3The Depicter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions less than, or equal to, 4.0.4. This is due to miss CVE-2025-83856.8The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is due to insufficient in CVE-2025-83866.9The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' hel CVE-2025-83886.4The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2025-83916.4The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, an CVE-2025-83926.4The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and CVE-2025-83937.3A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificat CVE-2025-83946.4The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortc