What is the CVSS score of CVE-2025-69941?

CVE-2025-69941 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tailor Management System are affected by CVE-2025-69941?

SourceCodester Tailor Management System 1.0 contains a critical unauthenticated SQL injection vulnerability (CVE-2025-69941, CVSS 9.8) enabling attackers to directly manipulate database contents…

How to fix or mitigate CVE-2025-69941?

Within 24 hours: inventory all SourceCodester Tailor Management System 1.0 instances and immediately restrict network access to addmeasurement.php to trusted internal networks only; verify internet-facing exposure and apply firewall rules to block external connections. Within 7 days: deploy Web Application Firewall rules to block SQL injection patterns targeting the 'id' parameter of addmeasurement.php, enforce database least-privilege accounts (read-only where operationally feasible), and enable comprehensive logging of database queries and failed access attempts. Within 30 days: contact SourceCodester for official patch timeline or initiate formal migration planning to a patched alternative version or replacement system; if a patch is released, conduct staged testing and deploy across all instances.

Tailor Management System CVE-2025-69941

EUVD-2025-210563 CRITICAL

SQL Injection (CWE-89)

2026-07-30 mitre

GHSA-pccf-x8vx-c2x6

PHP SQLi N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQL injection via a GET parameter with no user interaction gives AV:N/AC:L/PR:N/UI:N and full C/I/A impact on the backend database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:26 vuln.today

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 30, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 30, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.

AnalysisAI

SQL injection in SourceCodester Tailor Management System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the 'id' parameter of addmeasurement.php. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation with no authentication, and while rated 9.8 Critical, the EPSS score of 0.14% (4th percentile) reflects low observed exploitation activity. No public exploit code is identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is a PHP-based small-business web application (Tailor Management System) built by SourceCodester, a source of open-source PHP/MySQL demo and hobby projects. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the 'id' GET parameter in addmeasurement.php is concatenated into a SQL query without parameterization or input sanitization, allowing attacker-controlled input to alter query structure. This class of flaw is typical of legacy PHP applications using direct mysqli/mysql query string building rather than prepared statements. CPE data is uninformative here (cpe:2.3:a:n/a:n/a) as the vendor/product were recorded as 'n/a' in the source feed, so the CPE cannot be used to programmatically match affected assets.

RemediationAI

No vendor-released patch is identified at time of analysis, as SourceCodester demo applications are frequently unmaintained. The most effective mitigation is to rewrite the affected query in addmeasurement.php to use parameterized prepared statements (PDO or mysqli bound parameters) and to cast the 'id' parameter to an integer server-side, since it is expected to be numeric. As compensating controls, restrict access to the application and specifically the addmeasurement.php endpoint to trusted internal users via network ACLs or authentication, and deploy a WAF rule to block SQL metacharacters in the 'id' parameter (trade-off: WAF signatures can be bypassed and may cause false positives on legitimate input). Given the application's demo/hobby nature, the strongest option for production environments is to remove it from internet-facing exposure entirely or replace it. Reference the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-69941 and the technical writeup on the TaintRadar repository for the exact injection point.