Lucene search
K

CVE-2025-12287

🗓️ 27 Oct 2025 14:32:06Reported by VulDBType 
cve
 cve
🔗 web.nvd.nist.gov👁 5 Views🌐 WEB

CVE-2025-12287: Bdtask Wholesale Inventory System permits remote sql injection in edit_profile via first_name or last_name.

Related
Detection
Affected
Refs
Paths
NVD
Vulners
Node
bdtaskwholesaleRange2025-10-13
[
  {
    "vendor": "Bdtask",
    "product": "Wholesale Inventory Control and Inventory Management System",
    "versions": [
      {
        "version": "20251013",
        "status": "affected"
      }
    ]
  }
]
ParameterPositionPathDescriptionCWE
first_namerequest bodyAdmin_dashboard/edit_profileSQL injection vulnerability allowing arbitrary SQL via first_name/last_name in edit_profile.CWE-74CWE-89
last_namerequest bodyAdmin_dashboard/edit_profileSQL injection vulnerability allowing arbitrary SQL via first_name/last_name in edit_profile.CWE-74CWE-89

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

29 Apr 2026 01:00Current
6.5Medium risk
Vulners AI Score6.5
CVSS 3.14.7 - 7.2
CVSS 45.1
CVSS 25.8
CVSS 34.7
EPSS0.0001
SSVC
5