CVE-2025-11663
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. Manipulation of the 'sername' argument causes SQL injection. The attack can be initiated remotely and the exploit has been made publicly available.
Risk Assessment
A remote attacker can exploit the vulnerability to gain unauthorized access to the database, modify or exfiltrate data. The public availability of the exploit increases the risk of rapid exploitation in mass attacks.
Recommendation
Immediately update or patch the system if a fix is available. In the meantime, restrict access to /admin/manage-services.php and enforce input validation and parameterized SQL queries.
Other vulnerabilities in Campcodes Online Beauty Parlor Management System
See all- CVE-2025-11664Medium
A SQL injection vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0, affecting the /admin/search-appointment.php file. Manipulation of the searchdata argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
- CVE-2025-10826Medium
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. It affects an unknown functionality of the file /admin/sales-reports-detail.php. Manipulation of the arguments fromdate/todate results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-10825Medium
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. It affects an unknown function of the file /admin/view-appointment.php. Manipulation of the argument viewid leads to SQL injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. This manipulation of the argument sername causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS