CVE-2025-7587 MEDIUM

CVE-2025-7587: code-projects Online Appointment Booking System cover.php sql injection

Vendor Code-Projects

Product Online Appointment Booking System

Weakness CWE-89 · SQLi

Published July 14, 2025

Last update July 14, 2025

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cover.php. The manipulation of the argument uname/psw leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Key dates

02Disclosure timeline

July 14, 2025 CVE published

July 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-7587 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

04Related CVE

CVE-2025-12261 CodeAstro Gym Management System remove-announcement.php sql injection CVE-2024-10425 Project Worlds Student Project Allocation System Project Selection Page move_up_project.php sql injection CVE-2025-48998 Dataease MYSQL JDBC File Reading Vulnerability CVE-2024-11009 Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter CVE-2024-2067 SourceCodester Computer Inventory System delete-computer.php sql injection