CVE-2025-9028

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A flaw has been found in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /adphar.php. Executing manipulation of the argument phuname can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
code-projects	Online Medicine Guide	1.0

References

https://code-projects.org/Product
https://github.com/Jackie1732/CVE/issues/3Exploit, Issue Tracking, Third Party Advisory
https://vuldb.com/?ctiid.320093Permissions Required, VDB Entry
https://vuldb.com/?id.320093Third Party Advisory, VDB Entry
https://vuldb.com/?submit.630188Third Party Advisory, VDB Entry

Timeline

Published: Aug 15, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-90294.3The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to m CVE-2025-90305.4The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' p CVE-2025-90314.3Observable Timing Discrepancy vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive Web allows Cross-Domain Search Timing. T CVE-2025-90327.8Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution o CVE-2025-90337.8Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code CVE-2025-90346.1The Wp Edit Password Protected WordPress plugin before 1.3.5 does not validate a parameter before redirecting the user to its value, leadin CVE-2025-90355.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies In CVE-2025-90368.5A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted o CVE-2025-90387.5Improper Privilege Management vulnerability in GE Vernova S1 Agile Configuration Software on Windows allows Privilege Escalation.This issue CVE-2025-90394.3We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by anothe CVE-2025-90418.7A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the CVE-2025-90428.7A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the