Fikir Odalari Adminpando
CVE-2025-10878
CRITICAL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 10.0 with PoC — maximum severity. Login-based SQL injection is the most direct path to full application compromise. |
| Exploit ScenarioDerived | An attacker enters a SQL injection payload as the username (e.g., ' OR 1=1--), bypassing authentication and gaining admin access to the panel and all database contents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
AdminPando 1.0.1 by Fikir Odalari has a CVSS 10.0 SQL injection in the login functionality allowing complete authentication bypass and database takeover.
Earlier versions of this analysis (1)
CVSS 10.0 login SQL injection in AdminPando enables complete authentication bypass.
RemediationAI
Update to version 1.0.2. Use parameterized queries for authentication.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The login form in AdminPando 1.0.1 before 1.0.2 has a CWE-89 SQL injection that allows attackers to bypass authentication entirely and access the admin panel without valid credentials.
Know when Fikir Odalari Adminpando gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are vulnerable to SQL injection, allowing unauthenticated attackers to bypass authentication completely. Successful exploitation grants full administrative access to the application, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).
Executive ViewAI
A critical SQL injection vulnerability in Fikir Odalari AdminPando 1.0.1 allows unauthenticated attackers to completely bypass login authentication with a public exploit available. Any organization running this version faces immediate risk of unauthorized administrative access, data breach, and system compromise with no vendor patch currently available.
Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in username and password fields; restrict network access to AdminPando to trusted IP ranges only using network segmentation; disable AdminPando service entirely until patch is available; require multi-factor authentication on all administrative access layers behind AdminPando; deploy intrusion detection/prevention systems to monitor for exploitation attempts; consider temporary migration of administrative functions to alternative, patched systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB