CVE-2025-26198

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary SQL payloads and bypass authentication, gaining unauthorized administrative access. The vulnerability is triggered when an attacker supplies specially crafted input in the username field, such as ' OR '1'='1, leading to complete compromise of the login mechanism and potential exposure of sensitive backend data.

• CWE-89

• https://gist.github.com/tansique-17/0776791b8edd4931216be452a6971f5eExploit, Third Party Advisory
• https://github.com/tansique-17/CVE-2025-26198/Exploit, Third Party Advisory

Published

Jun 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-26169IXON VPN Client before 1.4.4 on Windows allows Local Privile…8.1
• CVE-2025-2617A vulnerability classified as problematic was found in yangy…4.8
• CVE-2025-2618A vulnerability, which was classified as critical, has been …9.8
• CVE-2025-26182An issue in xxyopen novel plus v.4.4.0 and before allows a r…6.5
• CVE-2025-26186SQL Injection vulnerability in openSIS v.9.1 allows a remote…8.1
• CVE-2025-2619A vulnerability, which was classified as critical, was found…9.8
• CVE-2025-26199CloudClassroom-PHP-Project v1.0 is affected by an insecure c…9.8
• CVE-2025-2620A vulnerability has been found in D-Link DAP-1620 1.03 and c…9.8
• CVE-2025-26200SQL injection in SLIMS v.9.6.1 allows a remote attacker to e…7.2
• CVE-2025-26201Credential disclosure vulnerability via the /staff route in …9.1
• CVE-2025-26202Cross-Site Scripting (XSS) vulnerability exists in the WPA/W…4.3
• CVE-2025-26204Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…