CVE-2025-11615

HIGH

Best Salon Management System 1.0 - SQL Injection via ServiceId Parameter

Title source: llm
STIX 2.1

Description

A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add_invoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.327946
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.327946
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.672822

Scores

CVSS v3 7.3
EPSS 0.0043
EPSS Percentile 33.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-89
Status published
Products (1)
mayurik/best_salon_management_system 1.0
Published Oct 11, 2025
Tracked Since Feb 18, 2026