CVE-2025-12309: code-projects Nero Social Networking Site friendprofile.php sql injection

Published Oct 27, 2025

Updated

A weakness has been identified in code-projects Nero Social Networking Site 1.0. This affects an unknown part of the file /friendprofile.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.

Affected Software

2 affected components

Code-projects Nero Social Networking Site

Fabian Nero Social Networking Site=1.0

Event History

Oct 27, 2025

CVE Published

via MITRE·07:02 PM

Data Sourced

via MITRE·07:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Oct 8, 2026

Event

via NVD·12:45 PM

Frequently Asked Questions

What is the severity of CVE-2025-12309?

CVE-2025-12309 has been classified with a critical severity due to its ability to allow SQL injection attacks remotely.

How do I fix CVE-2025-12309?

To fix CVE-2025-12309, ensure that all user inputs are properly sanitized and use prepared statements for database queries.

What software is affected by CVE-2025-12309?

CVE-2025-12309 affects the Nero Social Networking Site version 1.0 developed by Code-projects.

Can CVE-2025-12309 be exploited remotely?

Yes, CVE-2025-12309 can be exploited remotely by manipulating the ID parameter in the friendprofile.php file.

What type of vulnerability is CVE-2025-12309?

CVE-2025-12309 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL code on the database.