Skip to main content

Covid Tracking System CVE-2025-14666

MEDIUM
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
2025-12-14 cna@vuldb.com
SQLi Covid Tracking System Angeljudesuarez
5.5
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 17:17 vuln.today
CVE Published
Dec 14, 2025 - 16:15 cve.org
MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in itsourcecode COVID Tracking System 1.0. The affected element is an unknown function of the file /admin/?page=user. This manipulation of the argument Username causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.

AnalysisAI

SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/?page=user. Exploit code is publicly available, making exploitation straightforward, though no active exploitation has been reported by CISA. The impact is rated low, potentially allowing limited data disclosure or modification.

More in Covid Tracking System

View all
CVE-2025-14585 MEDIUM POC
5.5 Dec 12

SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL via the ID p
CVE-2025-13585 MEDIUM POC
5.5 Nov 24

A vulnerability was detected in itsourcecode COVID Tracking System 1.0.php. Rated medium severity (CVSS 6.9), this vulne
CVE-2025-14667 MEDIUM POC
5.5 Dec 14

SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to manipulate the meta_value argument
CVE-2025-14584 MEDIUM POC
5.5 Dec 12

SQL injection in itsourcecode COVID Tracking System 1.0 allows remote attackers to manipulate database queries via the U
CVE-2025-13570 LOW POC
2.1 Nov 23

A vulnerability was found in itsourcecode COVID Tracking System 1.0. Rated medium severity (CVSS 5.3), this vulnerabilit
CVE-2025-13569 LOW POC
2.1 Nov 23

A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Rated medium severity (CVSS 5.3), this vulnera
CVE-2025-13568 LOW POC
2.1 Nov 23

A flaw has been found in itsourcecode COVID Tracking System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is
CVE-2025-13567 LOW POC
2.1 Nov 23

A vulnerability was detected in itsourcecode COVID Tracking System 1.0. Rated medium severity (CVSS 5.3), this vulnerabi

Same weakness CWE-74 – Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2013-2251 CRITICAL POC
9.8
CVE-2022-27924 HIGH POC
7.5
CVE-2016-4010 CRITICAL POC
9.8
CVE-2015-1592 HIGH POC
7.5
CVE-2025-20281 CRITICAL POC
10.0
CVE-2015-7309 MEDIUM POC
6.5
CVE-2014-8423 CRITICAL POC
10.0

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Share

CVE-2025-14666 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy