PT-2026-5871 · Fikir Odalari · Adminpando

Published 2026-02-03 · Updated 2026-02-03 · CVE-2025-10878

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fikir Odalari AdminPando versions prior to 2026-01-26 Fikir Odalari AdminPando version 1.0.1

Description A SQL injection issue exists in the login functionality. The username and password parameters are susceptible to SQL injection, potentially allowing unauthenticated attackers to bypass authentication. Successful exploitation can grant full administrative access, including the ability to manipulate the public-facing website content (HTML/DOM manipulation).

Recommendations Versions prior to 2026-01-26 should be updated. Version 1.0.1 should be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-10878

Affected Products

Adminpando

References · 8

• 🔥 https://onurcangenc.com.tr/posts/cve-2025-10878-sql-authentication-bypass-in-fikir-odalar%C4%B1-adminpando · Exploit
• 🔥 https://github.com/onurcangnc/CVE-2025-10878-AdminPandov1.0.1-SQLi · Exploit
• https://osv.dev/vulnerability/CVE-2025-10878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10878 · Security Note
• https://twitter.com/TheHackerWire/status/2018781556874383832 · Twitter Post
• https://twitter.com/0dayPublishing/status/2018775614782586881 · Twitter Post
• https://twitter.com/CveFindCom/status/2018794493374312888 · Twitter Post
• https://twitter.com/CVEnew/status/2018778347585561087 · Twitter Post