CVE-2025-10878

published 2026-02-03

CVE-2025-10878: A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are…

Priority P2 65 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).

Affected

2 ranges

Vendor	Product	Version range	Fixed in
insaat	fikir_odalari_adminpando	—	—
omran	fikir_odalari_adminpando	<= 1.0.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89