Medium severity · published Oct 13, 2025
CVE-2025-11663
Campcodes Online Beauty Parlor Management System manage-services.php sql injection
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness has been identified in Campcodes Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin/manage-services.php. This manipulation of the argument sername causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OB
Online Beauty Parlor Management System · Campcodes
1.0 · source: vendor, NVD
Affected product
OB
Online Beauty Parlor Management System
Campcodes
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11663
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11663
Exploit
https://github.com/HYLCXH/CVE/issues/12
Permissions Required
https://vuldb.com/?ctiid.328082
Third Party Advisory
https://vuldb.com/?id.328082
Third Party Advisory
https://vuldb.com/?submit.672848
Product
https://www.campcodes.com/
More from Online Beauty Parlor Management System
9.8
CVE-2025-11664
Campcodes Online Beauty Parlor Management System search-appointment.php sql injection
8.8
CVE-2025-10826
Campcodes Online Beauty Parlor Management System sales-reports-detail.php sql injection
8.8
CVE-2025-10825
Campcodes Online Beauty Parlor Management System view-appointment.php sql injection
8.8
CVE-2025-10807
Campcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injection
8.8
CVE-2025-10806
Campcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injection