CVE-2025-6470

CWE-74 CWE-89 — SQL Injection4 documents4 sources

Severity

6.9MEDIUM

EPSS

0.1%

top 78.08%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Code-projects Online Bidding System Fabian Online Bidding System

Timeline

PublishedJun 22

Latest updateJun 23

Description

A vulnerability classified as critical has been found in code-projects Online Bidding System 1.0. Affected is an unknown function of the file /bidlog.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5code-projects/online_bidding_system1.0

▶NVDfabian/online_bidding_system1.0

🔴Vulnerability Details

GHSA

GHSA-c4p4-fpv5-p2gm: A vulnerability classified as critical has been found in code-projects Online Bidding System 1↗2025-06-23

▶

CVEList

code-projects Online Bidding System bidlog.php sql injection↗2025-06-22

▶

📋Vendor Advisories

Microsoft

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries↗2019-11-12

▶