CVE-2025-10109 MEDIUM

CVE-2025-10109: Campcodes Online Loan Management System ajax.php sql injection

Vendor Campcodes
Product Online Loan Management System
Weakness CWE-89 · SQLi
Published September 8, 2025
Last update September 9, 2025
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in Campcodes Online Loan Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_payment. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

Key dates

02Disclosure timeline

September 8, 2025 CVE published
September 9, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-25554 OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass CVE-2025-10142 PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection CVE-2025-1374 code-projects Real Estate Property Management System search.php sql injection CVE-2024-12937 code-projects Simple Admin Panel addVariationController.php sql injection CVE-2024-3356 SourceCodester Aplaya Beach Resort Online Reservation System sql injection