Vulnerabilites related to code-projects - Online Event Judging System
CVE-2025-10102 (GCVE-0-2025-10102)
Vulnerability from cvelistv5
Published
2025-09-08 18:32
Modified
2025-09-08 18:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown function of the file /index.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.323068 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.323068 | signature, permissions-required | |
https://vuldb.com/?submit.645297 | third-party-advisory | |
https://github.com/yihaofuweng/cve/issues/14 | exploit, issue-tracking | |
https://code-projects.org/ | product |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
code-projects | Online Event Judging System |
Version: 1.0 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-10102", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-09-08T18:51:33.970993Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-09-08T18:51:59.214Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Online Event Judging System", "vendor": "code-projects", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "qujun (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A security flaw has been discovered in code-projects Online Event Judging System 1.0. This affects an unknown function of the file /index.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited." }, { "lang": "de", "value": "Eine Schwachstelle wurde in code-projects Online Event Judging System 1.0 gefunden. Hierbei betrifft es unbekannten Programmcode der Datei /index.php. Durch Manipulation des Arguments Username mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff l\u00e4sst sich \u00fcber das Netzwerk starten. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-74", "description": "Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-09-08T18:32:09.841Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-323068 | code-projects Online Event Judging System index.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.323068" }, { "name": "VDB-323068 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.323068" }, { "name": "Submit #645297 | code-projects Online Event Judging System V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.645297" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/yihaofuweng/cve/issues/14" }, { "tags": [ "product" ], "url": "https://code-projects.org/" } ], "tags": [ "x_freeware" ], "timeline": [ { "lang": "en", "time": "2025-09-08T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2025-09-08T02:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2025-09-08T15:48:28.000Z", "value": "VulDB entry last update" } ], "title": "code-projects Online Event Judging System index.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2025-10102", "datePublished": "2025-09-08T18:32:09.841Z", "dateReserved": "2025-09-08T13:43:17.372Z", "dateUpdated": "2025-09-08T18:51:59.214Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-10104 (GCVE-0-2025-10104)
Vulnerability from cvelistv5
Published
2025-09-08 20:02
Modified
2025-09-08 20:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /review_search.php. The manipulation of the argument txtsearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.323070 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.323070 | signature, permissions-required | |
https://vuldb.com/?submit.645316 | third-party-advisory | |
https://github.com/yihaofuweng/cve/issues/17 | exploit, issue-tracking | |
https://code-projects.org/ | product |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
code-projects | Online Event Judging System |
Version: 1.0 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-10104", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-09-08T20:19:44.944774Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-09-08T20:19:51.283Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Online Event Judging System", "vendor": "code-projects", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "qujun (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A security vulnerability has been detected in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /review_search.php. The manipulation of the argument txtsearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used." }, { "lang": "de", "value": "In code-projects Online Event Judging System 1.0 wurde eine Schwachstelle gefunden. Hiervon betroffen ist ein unbekannter Codeblock der Datei /review_search.php. Mittels Manipulieren des Arguments txtsearch mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Angriff ist aus der Distanz m\u00f6glich. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-74", "description": "Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-09-08T20:02:06.910Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-323070 | code-projects Online Event Judging System review_search.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.323070" }, { "name": "VDB-323070 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.323070" }, { "name": "Submit #645316 | code-projects Online Event Judging System V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.645316" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/yihaofuweng/cve/issues/17" }, { "tags": [ "product" ], "url": "https://code-projects.org/" } ], "tags": [ "x_freeware" ], "timeline": [ { "lang": "en", "time": "2025-09-08T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2025-09-08T02:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2025-09-08T15:48:32.000Z", "value": "VulDB entry last update" } ], "title": "code-projects Online Event Judging System review_search.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2025-10104", "datePublished": "2025-09-08T20:02:06.910Z", "dateReserved": "2025-09-08T13:43:23.168Z", "dateUpdated": "2025-09-08T20:19:51.283Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-9610 (GCVE-0-2025-9610)
Vulnerability from cvelistv5
Published
2025-08-29 03:32
Modified
2025-08-29 13:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.321788 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.321788 | signature, permissions-required | |
https://vuldb.com/?submit.636622 | third-party-advisory | |
https://github.com/yihaofuweng/cve/issues/15 | exploit, issue-tracking | |
https://code-projects.org/ | product |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
code-projects | Online Event Judging System |
Version: 1.0 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-9610", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2025-08-29T13:41:14.914309Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-08-29T13:41:29.311Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Online Event Judging System", "vendor": "code-projects", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /create_account.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well." }, { "lang": "de", "value": "Eine Schwachstelle wurde in code-projects Online Event Judging System 1.0 gefunden. Dies betrifft einen unbekannten Teil der Datei /create_account.php. Die Ver\u00e4nderung des Parameters fname resultiert in sql injection. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit ist \u00f6ffentlich verf\u00fcgbar und k\u00f6nnte genutzt werden." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-74", "description": "Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-08-29T03:32:08.500Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-321788 | code-projects Online Event Judging System create_account.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.321788" }, { "name": "VDB-321788 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.321788" }, { "name": "Submit #636622 | code-projects Online Event Judging System V1.0 SQL Injection", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.636622" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/yihaofuweng/cve/issues/15" }, { "tags": [ "product" ], "url": "https://code-projects.org/" } ], "tags": [ "x_freeware" ], "timeline": [ { "lang": "en", "time": "2025-08-28T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2025-08-28T02:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2025-08-28T17:36:55.000Z", "value": "VulDB entry last update" } ], "title": "code-projects Online Event Judging System create_account.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2025-9610", "datePublished": "2025-08-29T03:32:08.500Z", "dateReserved": "2025-08-28T15:31:47.980Z", "dateUpdated": "2025-08-29T13:41:29.311Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2025-10103 (GCVE-0-2025-10103)
Vulnerability from cvelistv5
Published
2025-09-08 19:02
Modified
2025-09-08 19:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A weakness has been identified in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /home.php. Executing manipulation of the argument main_event can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited.
References
▼ | URL | Tags |
---|---|---|
https://vuldb.com/?id.323069 | vdb-entry, technical-description | |
https://vuldb.com/?ctiid.323069 | signature, permissions-required | |
https://vuldb.com/?submit.645298 | third-party-advisory | |
https://github.com/yihaofuweng/cve/issues/16 | exploit, issue-tracking | |
https://code-projects.org/ | product |
Impacted products
Vendor | Product | Version | ||
---|---|---|---|---|
code-projects | Online Event Judging System |
Version: 1.0 |
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2025-10103", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2025-09-08T19:34:14.406317Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2025-09-08T19:44:12.224Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "references": [ { "tags": [ "exploit" ], "url": "https://github.com/yihaofuweng/cve/issues/16" } ], "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "product": "Online Event Judging System", "vendor": "code-projects", "versions": [ { "status": "affected", "version": "1.0" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "qujun (VulDB User)" } ], "descriptions": [ { "lang": "en", "value": "A weakness has been identified in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /home.php. Executing manipulation of the argument main_event can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited." }, { "lang": "de", "value": "Es wurde eine Schwachstelle in code-projects Online Event Judging System 1.0 entdeckt. Davon betroffen ist unbekannter Code der Datei /home.php. Mittels dem Manipulieren des Arguments main_event mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Ausnutzung wurde ver\u00f6ffentlicht und kann verwendet werden." } ], "metrics": [ { "cvssV4_0": { "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "version": "4.0" } }, { "cvssV3_1": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.1" } }, { "cvssV3_0": { "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "version": "3.0" } }, { "cvssV2_0": { "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR", "version": "2.0" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-89", "description": "SQL Injection", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-74", "description": "Injection", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-09-08T19:02:07.153Z", "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB" }, "references": [ { "name": "VDB-323069 | code-projects Online Event Judging System home.php sql injection", "tags": [ "vdb-entry", "technical-description" ], "url": "https://vuldb.com/?id.323069" }, { "name": "VDB-323069 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": [ "signature", "permissions-required" ], "url": "https://vuldb.com/?ctiid.323069" }, { "name": "Submit #645298 | code-projects Online Event Judging System V1.0 sql", "tags": [ "third-party-advisory" ], "url": "https://vuldb.com/?submit.645298" }, { "tags": [ "exploit", "issue-tracking" ], "url": "https://github.com/yihaofuweng/cve/issues/16" }, { "tags": [ "product" ], "url": "https://code-projects.org/" } ], "tags": [ "x_freeware" ], "timeline": [ { "lang": "en", "time": "2025-09-08T00:00:00.000Z", "value": "Advisory disclosed" }, { "lang": "en", "time": "2025-09-08T02:00:00.000Z", "value": "VulDB entry created" }, { "lang": "en", "time": "2025-09-08T15:48:30.000Z", "value": "VulDB entry last update" } ], "title": "code-projects Online Event Judging System home.php sql injection" } }, "cveMetadata": { "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "assignerShortName": "VulDB", "cveId": "CVE-2025-10103", "datePublished": "2025-09-08T19:02:07.153Z", "dateReserved": "2025-09-08T13:43:20.320Z", "dateUpdated": "2025-09-08T19:44:12.224Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }