CVE-2018-25195 affects Wecodex Hotel CMS version 1.0, containing a critical SQL injection vulnerability in the admin login functionality. Unauthenticated attackers can bypass authentication by injecting malicious SQL code through the username parameter in POST requests to index.php with action=processlogin. This vulnerability allows attackers to extract sensitive database information or gain unauthorized administrative access to the hotel management system. The exploit is publicly available and documented, making it easily exploitable by threat actors targeting vulnerable installations.