CVE-2025-6468 MEDIUM

CVE-2025-6468: code-projects Online Bidding System bidnow.php sql injection

Vendor Code-Projects

Product Online Bidding System

Weakness CWE-89 · SQLi

Published June 22, 2025

Last update June 23, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in code-projects Online Bidding System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /bidnow.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

June 22, 2025 CVE published

June 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-6468 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2024-1751 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection CVE-2025-5580 CodeAstro Real Estate Management System login.php sql injection CVE-2015-10016 jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection CVE-2024-12497 1000 Projects Attendance Tracking Management System check_admin_login.php sql injection CVE-2026-4232 Tiandy Integrated Management Platform getAuthorityByUserId sql injection