Critical severity · published Feb 3, 2026
CVE-2025-10878
A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fikir Odalari AdminPando · Insaat
1.0.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10878
Exploit
https://github.com/onurcangnc/CVE-2025-10878-AdminPandov1.0.1-SQLi
Exploit
https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando/