CVE-2025-10878 is a maximum severity (10.0) SQL injection in the login of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password fields let an unauthenticated visitor skip authentication and gain full administrative access. Update to a build dated 2026-01-26 or later.
What's affected
The record says AdminPando 1.0.1 before 2026-01-26 is affected, which suggests a build dated 26 January 2026 or later contains the fix. The record does not state the fixed version number, so confirm with the vendor.
Both the username and password parameters of the login are vulnerable. Successful use gives full administrative access, including the ability to change the public website content, which the record describes as HTML and DOM manipulation.
The CVSS vector is AV:N/AC:L/PR:N/UI:N with scope changed, rated high on all three impact measures.
How to check if you're exposed
Check your deployment.
- Find out whether your site runs AdminPando from Fikir Odalari and which build date it has.
- Review administrative login logs for sign ins that do not match your staff.
- Compare the public pages with your approved content, looking for injected scripts, links or text.
- Check whether the admin login is exposed to the internet.
What to do now
- Update to the vendor build dated 2026-01-26 or later and confirm the version in writing with the vendor.
- Until then, put the admin login behind an IP allowlist or VPN.
- Review the site content for unwanted changes, and restore from a known good copy where needed.
- Rotate administrator passwords and any keys stored in the application.
- Ask the vendor to confirm that login queries use prepared statements.
Why it matters
The weakness is CWE-89, SQL injection, in the most sensitive place in a web application. The login check is the query under attack, so the attacker does not need to know a password.
The scope is rated as changed because administrative access lets an attacker alter what the public sees, which affects visitors of the site and not only the operator. Defacement and injected scripts on a public site harm your users and your reputation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
The record says builds before 2026-01-26 are affected. It does not give a version number, so confirm the fixed build with the vendor.
Sources
Last reviewed: 19 October 2026.
