CVE-2025-10795 is a high severity SQL injection flaw (CVSS 7.3) in code-projects Online Bidding System version 1.0, reached through the ID argument of /administrator/bidupdate.php. The record names no fixed version, so assume none exists until the vendor says otherwise and restrict or retire the app.
What's affected
The record lists one affected product: code-projects Online Bidding System 1.0. The description says the weakness sits in an unknown function of /administrator/bidupdate.php, and that changing the ID argument results in SQL injection. It can be reached remotely.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. In plain terms, it is reachable over the network, takes little effort, and needs no privileges and no user interaction. Impact is rated low to moderate on confidentiality, integrity and availability, which is how a score of 7.3 comes out.
Fixed versions: the record does not list any, and the reference pages (a public issue report and VulDB entries) are not vendor advisories. Check the vendor or the project page for any update before you rely on one. The record also says an exploit has been published, so do not wait on that check before limiting exposure.
The weakness classes are CWE-89 (SQL injection) and CWE-74 (improper neutralization of special elements in output used by a downstream component).
How to check if you're exposed
This product is typically installed from a source code download rather than a package manager, so there is usually no lockfile entry to query. Work from the filesystem and the web server instead.
- Find the code. On the web host, search the document root for the named file, for example
find /var/www -name "bidupdate.php" 2>/dev/null. Adjust the path for your server. - Confirm the version. The record covers version 1.0. Look at the project's readme, the about page, or the download you installed from.
- Check who can reach it. If the application is only on an internal network or behind a VPN with single sign on, the exposure is smaller than if it faces the internet.
- Look in your web server logs for requests to
/administrator/bidupdate.phpand read them for unusual values in theIDparameter, such as quote characters or SQL keywords. Treat any sign of that as a reason to start incident review. - For code you maintain, search for query strings built by concatenating request values:
grep -rn "mysqli_query\|mysql_query" .shows where to look.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses.
What to do now
- Take the application off the public internet if it does not have to be there. Put it behind a VPN or an allow list.
- Check the vendor or project page for a fixed release. The record lists none, so do not assume one exists.
- If you maintain the code, replace string built queries with prepared statements and parameter binding in
/administrator/bidupdate.phpand every file that handles the same kind of input. - Run the database account for the app with the least privilege it needs. It should not own the schema or have file or admin rights.
- If a web application firewall is in front, add a rule set for SQL injection as a temporary layer. It does not replace the code fix.
- Review the database and logs for signs that the flaw was used. Rotate any credentials stored in that database if you find any.
- Decide whether this app should stay in service at all if nobody maintains it.
Why it matters
SQL injection happens when user input is placed into a database query as text instead of as a bound value. The database then cannot tell the developer's query from the attacker's input. The result depends on the query and the database account, which is why the score here is moderate across confidentiality, integrity and availability.
This record names one file and one parameter, but a flaw like this is rarely alone. If one page builds queries from request values, others in the same code base often do too, so fixing a single file is not enough. The record does not say that this CVE is on CISA's Known Exploited Vulnerabilities list, and the KEV flag in our data is false. It does say a public exploit exists, which makes it easy for others to try.
Quick check
Is there a patch for CVE-2025-10795?
The record lists no fixed version and no vendor advisory. Check the vendor or project page directly. Until then, limit access and review the code.
Is CVE-2025-10795 known to be exploited in the wild?
Not according to the record. The KEV flag is false. The description says an exploit has been published, so the risk is still real for exposed installs.
Sources
Last reviewed: 19 October 2026.
