CVE-2025-11358
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In code-projects Simple Banking System 1.0, a weakness exists in an unknown function of the file /removeuser.php. Manipulation of the argument ID can lead to SQL injection. The attack may be launched remotely, and the exploit has been made public.
Risk Assessment
The risk includes potential unauthorized deletion of users or access to sensitive data in the database.
Recommendation
Update the system and implement input validation in /removeuser.php to prevent SQL injection.
Other vulnerabilities in Simple Banking System
See all- CVE-2025-11359Medium
In code-projects Simple Banking System 1.0, a SQL injection vulnerability exists in an unknown function of the file /transfermoney.php. Manipulation of the argument ID leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11357Medium
In code-projects Simple Banking System 1.0, a security flaw exists in some unknown processing of the file /createuser.php. Manipulation of the argument Name results in SQL injection. The attack may be initiated remotely, and the exploit has been released.
Original NVD description (English source)
A weakness has been identified in code-projects Simple Banking System 1.0. Impacted is an unknown function of the file /removeuser.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS