Threat database

CVE-2025-10878 is a critical SQL injection vulnerability in the login functionality of Insaat's Fikir Odalari AdminPando version 1.0.1 and earlier. It allows unauthenticated attackers to inject malicious SQL commands via the username and password parameters, bypassing authentication entirely. Successful exploitation grants full administrative control over the application, enabling attackers to manipulate website content and potentially compromise confidentiality, integrity, and availability. The vulnerability has a CVSS score of 10, indicating maximum severity, with no user interaction or privileges required for exploitation. Although no known exploits are currently reported in the wild, the risk is significant due to the ease of exploitation and the broad impact. European organizations using this product should prioritize patching or mitigating this flaw immediately. Countries with higher adoption of Insaat products or strategic targets for web defacement and data theft are at greater risk. Immediate mitigation steps include implementing input validation, using prepared statements, and restricting database permissions.