CVE-2025-9492

5.5 mediumEPSS 0.6%

Medium (5.5) in campcodes online water billing system. EPSS 0.6% chance of exploitation in the next 30 days.

A vulnerability was determined in Campcodes Online Water Billing System 1.0. This affects an unknown function of the file /addclient1.php. Executing manipulation of the argument lname can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Other parameters might be affected as well.

Severity

CVSS 4.0

5.5 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWEs: CWE-74, CWE-89
Published: 2025-08-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

campcodes:online_water_billing_system

References

https://github.com/skyrainoh/CVE/issues/9
https://vuldb.com/?ctiid.321473
https://vuldb.com/?id.321473
https://vuldb.com/?submit.635352
https://www.campcodes.com/

Check your stack JSON