CVE-2025-11556CWE-74CWE-89sql-injection

CVE-2025-11556

High · published October 10, 2025

CVSS v3.1

7.3

EPSS

Percentile

40.3

In the wild

Unconfirmed

What it is

A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argument table causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00478 · 40.3th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-10-10T01:15Z

Affected products (1)

Product	Versions	Fixed in
carmelo/simple_leave_manager	all versions	—

References (6)

https://code-projects.org/ · [email protected]https://github.com/asd1238525/cve/blob/main/SQL8.md · [email protected]https://vuldb.com/?ctiid.327716 · [email protected]https://vuldb.com/?id.327716 · [email protected]https://vuldb.com/?submit.671358 · [email protected]https://github.com/asd1238525/cve/blob/main/SQL8.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

09 OCT 20:32Z
code-projects Simple Leave Manager user.php sql injection
cvelistv5