CVE-2025-12243

A vulnerability was found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the file clientdetails/welcome.php of the component GET Parameter Handler. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0

2.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-25)

CWEs

CWE-89, CWE-74

Published

2025-10-27

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• fabian:client_details_system

References

• https://code-projects.org/
• https://github.com/hellonewbie/tutorial/issues/6
• https://vuldb.com/?ctiid.329914
• https://vuldb.com/?id.329914
• https://vuldb.com/?submit.673773

Check your stackJSON