CVE-2025-7587
published 2025-07-14CVE-2025-7587: A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown…
PriorityP355critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
34.5th percentile
A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cover.php. The manipulation of the argument uname/psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| anisha | online_appointment_booking_system | — | — |
| code-projects | online_appointment_booking_system | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-8j32-qr7c-vxv8: A vulnerability was found in code-projects Online Appointment Booking System 1
ghsa_unreviewed·2025-07-14
CVE-2025-7587 [MEDIUM] CWE-74 GHSA-8j32-qr7c-vxv8: A vulnerability was found in code-projects Online Appointment Booking System 1
A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cover.php. The manipulation of the argument uname/psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
GHSA
Backend.AI Missing Authorization vulnerability
ghsa·2025-06-09
CVE-2025-49651 [HIGH] CWE-862 Backend.AI Missing Authorization vulnerability
Backend.AI Missing Authorization vulnerability
Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.
NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.
GHSA
BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
ghsa·2025-06-09
CVE-2025-49653 [HIGH] CWE-200 BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.
NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from https://github.com/lablup/backend.ai/pull/7587 in their instances to protect themselves from the conditions that would lead to the situation described in the CVE record.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-14
Published