CVE-2025-9700CWE-74CWE-89sql-injection

CVE-2025-9700

High · published August 30, 2025

CVSS v3.1

7.3

EPSS

Percentile

34.7

In the wild

Unconfirmed

What it is

A flaw has been found in SourceCodester Online Book Store 1.0. This issue affects some unknown processing of the file /publisher_list.php. This manipulation of the argument pubid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used.

The record

Technical detail

CVSS v3.1: 7.3 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.00415 · 34.7th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-08-30T22:15Z

Affected products (1)

Product	Versions	Fixed in
janobe/online_book_store	all versions	—

References (6)

https://github.com/0510green-hand/cve/issues/3 · [email protected]https://vuldb.com/?ctiid.321920 · [email protected]https://vuldb.com/?id.321920 · [email protected]https://vuldb.com/?submit.639215 · [email protected]https://www.sourcecodester.com/ · [email protected]https://github.com/0510green-hand/cve/issues/3 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

30 AUG 17:32Z
SourceCodester Online Book Store publisher_list.php sql injection
cvelistv5