github.comexploit
https://github.com/Blowingwinds/cve-report/blob/main/cve7/report.md CVE-2025-11615
MEDIUM
SourceCodester Best Salon Management System add_invoice.php sql injection
Record summary
CVE-2025-11615 has a selected CVSS score of 6.9 (medium).
Description
A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 14, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Best Salon Management SystemBrowse SourceCodester / Best Salon Management System | CVE List | 1.0 | affected |
References
6nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-11615 VDB-327946 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.327946 VDB-327946 | SourceCodester Best Salon Management System add_invoice.php sql injectionvdb entryTechnical description
https://vuldb.com/?id.327946 Submit #672822 | SourceCodester Best salon management system 1.0 SQL InjectionThird-party advisory
https://vuldb.com/?submit.672822 sourcecodester.comproduct
https://www.sourcecodester.com/