CVE-2025-11664
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A SQL injection vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0, affecting the /admin/search-appointment.php file. Manipulation of the searchdata argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.
Risk Assessment
The vulnerability allows a remote attacker to execute arbitrary SQL queries, potentially leading to data leakage or modification. The public availability of the exploit increases the risk of exploitation.
Recommendation
Immediately implement input validation and restrict access to the admin panel. Consider updating or replacing the system if no patch is available.
Other vulnerabilities in Campcodes Online Beauty Parlor Management System
See all- CVE-2025-11663Medium
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. Manipulation of the 'sername' argument causes SQL injection. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2025-10826Medium
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. It affects an unknown functionality of the file /admin/sales-reports-detail.php. Manipulation of the arguments fromdate/todate results in SQL injection. The attack can be launched remotely. The exploit has been released to the public and may be exploited.
- CVE-2025-10825Medium
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. It affects an unknown function of the file /admin/view-appointment.php. Manipulation of the argument viewid leads to SQL injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Original NVD description (English source)
A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /admin/search-appointment.php. Such manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS