CVE-2018-25404 — The Open ISES Project 3.30A SQL Injection via add_facnote.php
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through th…
Published: 2026-05-29 · CVSS: 8.8 · CVSS 4.0
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the ticket_id parameter. Attackers can send GET requests to add_facnote.php with crafted SQL payloads to extract sensitive database information including version details and other data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7