CVE-2025-13075
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. An unknown function in /admin/usersettingdel.php allows SQL injection via manipulation of the eid argument. The exploit is publicly available and remote exploitation is possible.
Risk Assessment
An attacker could remotely execute arbitrary SQL queries, potentially leading to data leakage, modification, or deletion. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Immediately update the application to a non-vulnerable version or apply the vendor patch. Until then, restrict access to the admin panel and implement input filtering.
Other vulnerabilities in Responsive Hotel Site
See all- CVE-2025-13076Medium
A flaw has been found in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/usersetting.php. Executing manipulation of the argument usname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2025-12913Medium
A flaw was found in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/roomdel.php. Manipulating the ID argument enables remote attacks. The exploit has been published and may be used.
- CVE-2025-12857Medium
A security vulnerability was detected in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/roombook.php. Manipulating the rid argument enables remote attacks. The exploit has been disclosed publicly and may be used.
- CVE-2025-12856Medium
A weakness was identified in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/reservation.php. Manipulating the email argument enables remote attacks. The exploit has been made available to the public and could be exploited.
- CVE-2025-12855Medium
A security flaw was discovered in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/newsletterdel.php. Manipulating the eid argument enables remote attacks. The exploit has been released to the public and may be exploited.
Original NVD description (English source)
A vulnerability was detected in code-projects Responsive Hotel Site 1.0. Impacted is an unknown function of the file /admin/usersettingdel.php. Performing manipulation of the argument eid results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS