Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2025-10798: Hostel Management System 1.0: Remote SQL Injection via ID Manipulation
CVE-2025-10798 · published 1 year ago
Summary
An attacker can exploit a security flaw in the Hostel Management System 1.0 to inject malicious code into the system. This could allow them to access or modify sensitive data. Update the system or use a secure alternative to protect your data.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| angeljudesuarez | hostel_management_system |
1.0 cpe:2.3:a:angeljudesuarez:hostel_management_system:1.0:*:*:*:*:*:*:* |
Original advisory text
A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.php?view=view. Such manipulation of the ...
A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mod_roomtype/index.php?view=view. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
References
- https://code-projects.org/ Product
- https://github.com/598600/CVE/issues/1 Exploit Issue Tracking Third Party Advisory
- https://vuldb.com/?ctiid.325155 Permissions Required VDB Entry
- https://vuldb.com/?id.325155 Third Party Advisory VDB Entry
- https://vuldb.com/?submit.654092 Third Party Advisory VDB Entry
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.5
Medium
Type
CWE-74Injection
CWE-89SQL Injection
Timeline
Published22 Sep 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-10798 · NVD
Track software like this
Free during beta