CVE-2025-3310 — Injection in Blood Bank Management System

CWE-74 — Injection CWE-89 — SQL Injection CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

6.9MEDIUMNVD

EPSS

0.2%

top 57.41%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Code-projects Blood Bank Management System Adonesevangelista Online Blood Bank Management System

Timeline

PublishedApr 6

Latest updateAug 12

Description

A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /admin/delete.php. The manipulation of the argument Search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5code-projects/blood_bank_management_system1.0

▶NVDadonesevangelista/online_blood_bank_management_system1.0

🔴Vulnerability Details

GHSA

GHSA-wr7w-v9gf-rw8c: A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1↗2025-04-07

▶

CVEList

code-projects Blood Bank Management System delete.php sql injection↗2025-04-06

▶

📋Vendor Advisories

Microsoft

Buffer overflow in the rc_mksid function in plugins/radius/util.c in Paul's PPP Package (ppp) 2.4.6 and earlier, when the PID for pppd is greater than 65535, allows remote attackers to cause a denial ↗2025-08-12

▶