CVE-2025-0171

CWE-74 CWE-89 — SQL Injection CWE-212 CWE-787 — Out-of-bounds Write5 documents5 sources

Severity

5.3MEDIUM

EPSS

0.1%

top 69.41%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Code-projects Chat System

Timeline

PublishedJan 2

Description

A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /admin/deleteuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5code-projects/chat_system1.0

▶NVDcode-projects/chat_system1.0

🔴Vulnerability Details

GHSA

GHSA-j8mp-8grf-469r: A vulnerability, which was classified as critical, was found in code-projects Chat System 1↗2025-01-02

▶

CVEList

code-projects Chat System deleteuser.php sql injection↗2025-01-02

▶

📋Vendor Advisories

Microsoft

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM ins↗2022-08-09

▶

Cisco

Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability↗2018-03-28

▶