CVE-2025-11664

MediumCVSS 4.7

Published: 13/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

A SQL injection vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0, affecting the /admin/search-appointment.php file. Manipulation of the searchdata argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

Risk Assessment

The vulnerability allows a remote attacker to execute arbitrary SQL queries, potentially leading to data leakage or modification. The public availability of the exploit increases the risk of exploitation.

Recommendation

Immediately implement input validation and restrict access to the admin panel. Consider updating or replacing the system if no patch is available.

Other vulnerabilities in Campcodes Online Beauty Parlor Management System

CVE-2025-11663Medium
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. Manipulation of the 'sername' argument causes SQL injection. The attack can be initiated remotely and the exploit has been made publicly available.

Original NVD description (English source)

A security vulnerability has been detected in Campcodes Online Beauty Parlor Management System 1.0. The impacted element is an unknown function of the file /admin/search-appointment.php. Such manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS