CVE-2025-10592

itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection

CVSS 5.3 MEDIUMEPSS 0.4%CWE-74 CWE-89

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

17 Sep 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument search_field/search_text leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Affected products

itsourcecode · Online Public Access Catalog OPAC

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/drew-byte/Online-Public-Access-Catalog-OPAC-SQLi-PoC/blob/main/README.md https://itsourcecode.com/https://vuldb.com/?ctiid.324609 https://vuldb.com/?id.324609 https://vuldb.com/?submit.648959