CVE-2025-9471

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been found in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /maintenance/add_maintenance_cost.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Apartment Management System	1.0

References

https://github.com/zhuyi-hz/cve/issues/12Exploit, Issue Tracking, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.321336Permissions Required, VDB Entry
https://vuldb.com/?id.321336Third Party Advisory, VDB Entry
https://vuldb.com/?submit.634082Third Party Advisory, VDB Entry
https://github.com/zhuyi-hz/cve/issues/12Exploit, Issue Tracking, Third Party Advisory

Timeline

Published: Aug 26, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-94729.8A vulnerability was found in itsourcecode Apartment Management System 1.0. This issue affects some unknown processing of the file /owner_uti CVE-2025-94739.8A security vulnerability has been detected in SourceCodester Online Bank Management System 1.0. This impacts an unknown function of the file CVE-2025-94744.5A vulnerability was detected in Mihomo Party up to 1.8.1 on macOS. Affected is the function enableSysProxy of the file src/main/sys/sysproxy CVE-2025-94759.8A flaw has been found in SourceCodester Human Resource Information System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-94769.8A vulnerability has been found in SourceCodester Human Resource Information System 1.0. Affected by this issue is some unknown functionality CVE-2025-94788.8Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2025-94794.3Out of bounds read in V8 in Google Chrome prior to 133.0.6943.141 allowed a remote attacker to potentially exploit heap corruption via a cra CVE-2025-94818.8A security vulnerability has been detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.CVE-2025-94828.8A vulnerability was detected in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.0 CVE-2025-94838.8A flaw has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. CVE-2025-94844.3GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 tha CVE-2025-94859.8The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in vers