CVE-2025-63689

CRITICAL 10.0CVE-2025-63689 · Published 07/11/2025 · updated 17/06/2026

In short

CVE-2025-63689 is a CRITICAL (CVSS 10.0) vulnerability affecting money-pos (ycf1998).
Chance of exploitation in the next 30 days (EPSS): 0.92%, higher than 60.3% of all vulnerabilities.
Fix: update to 2025-09-14 or later.

Package	Affected versions	Patched versions
money-pos ycf1998	`< 2025-09-14`	`2025-09-14`

Description

Multiple SQL injection vulnerabilitites in ycf1998 money-pos system before commit 11f276bd20a41f089298d804e43cb1c39d041e59 (2025-09-14) allows a remote attacker to execute arbitrary code via the orderby parameter

References

gist.github.com/LockeTom/2ed0f3751c88542f48b7c230468d2a46 · Exploit
ycf1998/money-pos commit 11f276b · Patch
ycf1998/money-pos · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free