CVE-2025-40728

Name of the Vulnerable Software and Affected Versions Customer Support System version 1.0

Description This issue allows an authenticated attacker to retrieve, create, update, and delete databases via the id parameter in the "/customer support/manage user.php" endpoint.

Recommendations For Customer Support System version 1.0, consider disabling the /customer support/manage user.php endpoint until a patch is available to prevent exploitation. Restrict access to the id parameter in the affected endpoint to minimize the risk of database manipulation.